December 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:3130-1: moderate: Recommended update for atftp
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for atftp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3130-1 Rating: moderate References: #1013565 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for atftp fixes the following issues: - honor --user and --group options in non-daemon mode (boo#1013565) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1474=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1474=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1474=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): atftp-0.7.0-171.1 atftp-debuginfo-0.7.0-171.1 atftp-debugsource-0.7.0-171.1 - openSUSE Leap 42.1 (i586 x86_64): atftp-0.7.0-170.1 atftp-debuginfo-0.7.0-170.1 atftp-debugsource-0.7.0-170.1 - openSUSE 13.2 (i586 x86_64): atftp-0.7.0-160.11.1 atftp-debuginfo-0.7.0-160.11.1 atftp-debugsource-0.7.0-160.11.1 References: https://bugzilla.suse.com/1013565

1 0

openSUSE-SU-2016:3129-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3129-1 Rating: important References: #1002639 #1004728 #1007853 #1007854 #1007855 #1007857 #1007858 #1010893 #1011805 #1011812 #974407 Cross-References: CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has four fixes is now available. Description: This update for Tomcat provides the following fixes: Feature changes: The embedded Apache Commons DBCP component was updated to version 2.0. (bsc#1010893 fate#321029) Security fixes: - CVE-2016-0762: Realm Timing Attack (bsc#1007854) - CVE-2016-5018: Security Manager Bypass (bsc#1007855) - CVE-2016-6794: System Property Disclosure (bsc#1007857) - CVE-2016-6796: Manager Bypass (bsc#1007858) - CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853) - CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805) - CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812) Bugs fixed: - Fixed StringIndexOutOfBoundsException in WebAppClassLoaderBase.filter(). (bsc#974407) - Fixed a deployment error in the examples webapp by changing the context.xml format to the new one introduced by Tomcat 8. (bsc#1004728) - Enabled optional setenv.sh script. See section '(3.4) Using the "setenv" script' in http://tomcat.apache.org/tomcat-8.0-doc/RUNNING.txt. (bsc#1002639) - Fixed regression caused by CVE-2016-6816. This update supplies the new packages apache-commons-pool2 and apache-commons-dbcp in version 2 to allow tomcat to use the DBCP 2.0 interface. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1455=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): apache-commons-dbcp-2.1.1-2.1 apache-commons-dbcp-javadoc-2.1.1-2.1 apache-commons-pool2-2.4.2-2.1 apache-commons-pool2-javadoc-2.4.2-2.1 tomcat-8.0.32-11.1 tomcat-admin-webapps-8.0.32-11.1 tomcat-docs-webapp-8.0.32-11.1 tomcat-el-3_0-api-8.0.32-11.1 tomcat-embed-8.0.32-11.1 tomcat-javadoc-8.0.32-11.1 tomcat-jsp-2_3-api-8.0.32-11.1 tomcat-jsvc-8.0.32-11.1 tomcat-lib-8.0.32-11.1 tomcat-servlet-3_1-api-8.0.32-11.1 tomcat-webapps-8.0.32-11.1 References: https://www.suse.com/security/cve/CVE-2016-0762.html https://www.suse.com/security/cve/CVE-2016-5018.html https://www.suse.com/security/cve/CVE-2016-6794.html https://www.suse.com/security/cve/CVE-2016-6796.html https://www.suse.com/security/cve/CVE-2016-6797.html https://www.suse.com/security/cve/CVE-2016-6816.html https://www.suse.com/security/cve/CVE-2016-8735.html https://bugzilla.suse.com/1002639 https://bugzilla.suse.com/1004728 https://bugzilla.suse.com/1007853 https://bugzilla.suse.com/1007854 https://bugzilla.suse.com/1007855 https://bugzilla.suse.com/1007857 https://bugzilla.suse.com/1007858 https://bugzilla.suse.com/1010893 https://bugzilla.suse.com/1011805 https://bugzilla.suse.com/1011812 https://bugzilla.suse.com/974407

1 0

openSUSE-RU-2016:3128-1: moderate: Recommended update for sg3_utils
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for sg3_utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3128-1 Rating: moderate References: #840054 #903332 #904008 #955222 #958369 #981452 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for sg3_utils provides the following fixes: - Fix handling of dmsetup output in rescan-scsi-bus.sh. (bsc#955222) - Sort output in rescan-scsi-bus.sh's doreportlun(). (bsc#958369) - Fix wrong bitmask when encoding target port group in sg_stpg. - Multiple fixes for rescan-scsi-bus.sh: (bsc#903332) - Interpret DID_NEXUS_FAILURE as 'reservation conflict'. - No space in SCSI type. - Wait up to 30 seconds for TUR. - Check for removable media in sg_turs loop. - Fix rescan-scsi-bus.sh to correctly resize multipath devices. (bsc#904008) - Fix rescan-scsi-bus.sh's 'resize' option and document '-m'. (bsc#904008) - Update rescan-scsi-bus.sh to version 20160511. (bsc#958369, bsc#981452) - Add 40-usb-blacklist.rules. (bsc#840054) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1462=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libsgutils-devel-1.42-11.1 libsgutils2-2-1.42-11.1 libsgutils2-2-debuginfo-1.42-11.1 sg3_utils-1.42-11.1 sg3_utils-debuginfo-1.42-11.1 sg3_utils-debugsource-1.42-11.1 References: https://bugzilla.suse.com/840054 https://bugzilla.suse.com/903332 https://bugzilla.suse.com/904008 https://bugzilla.suse.com/955222 https://bugzilla.suse.com/958369 https://bugzilla.suse.com/981452

1 0

openSUSE-RU-2016:3127-1: Recommended update for hawk2
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3127-1 Rating: low References: #1006169 #1008268 #1009748 #1009867 #1009869 #1010602 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for hawk2 fixes the following issues: - UI: Clearer error when creating group with no children (bsc#1006169) - UI: Use Recent events for both resources and nodes (bsc#1008268) - UI: Fix typos in RC description for m/s (bsc#1009867) - UI: Hide ACL in mainnav if offline (bsc#1009869) - Group: Don't duplicate object list on errors (bsc#1009748) - Reports: Show diff from the past, not to the future (bsc#1010602) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1458=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): hawk2-1.0.1+git.1456406635.49e230d-11.1 hawk2-debuginfo-1.0.1+git.1456406635.49e230d-11.1 hawk2-debugsource-1.0.1+git.1456406635.49e230d-11.1 References: https://bugzilla.suse.com/1006169 https://bugzilla.suse.com/1008268 https://bugzilla.suse.com/1009748 https://bugzilla.suse.com/1009867 https://bugzilla.suse.com/1009869 https://bugzilla.suse.com/1010602

1 0

openSUSE-SU-2016:3126-1: moderate: Security update for gc
by opensuse-security＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Security Update: Security update for gc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3126-1 Rating: moderate References: #1011276 Cross-References: CVE-2016-9427 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gc fixes the following issues: - integer overflow in GC_MALLOC_ATOMIC() (CVE-2016-9427, bsc#1011276) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1479=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1479=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gc-debugsource-7.2d-8.1 gc-devel-7.2d-8.1 libgc1-7.2d-8.1 libgc1-debuginfo-7.2d-8.1 - openSUSE Leap 42.1 (i586 x86_64): gc-debugsource-7.2d-7.1 gc-devel-7.2d-7.1 libgc1-7.2d-7.1 libgc1-debuginfo-7.2d-7.1 References: https://www.suse.com/security/cve/CVE-2016-9427.html https://bugzilla.suse.com/1011276

1 0

openSUSE-RU-2016:3125-1: moderate: Recommended update for acpid
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for acpid ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3125-1 Rating: moderate References: #1012325 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for acpid fixes the following issues: Remove ExclusiveArch, as some ARM boards emulate ACPI events with their power button driver.(bsc#1012325) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1464=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): acpid-2.0.25-4.1 acpid-debuginfo-2.0.25-4.1 acpid-debugsource-2.0.25-4.1 References: https://bugzilla.suse.com/1012325

1 0

openSUSE-RU-2016:3124-1: Recommended update for k3b
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for k3b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3124-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for k3b fixes the following issues: - Obsolete k3b-codecs, the additional codecs are part of the main package now. - Restore conditionals for lame and libmad. - Build with ffmpeg unconditional. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1469=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): k3b-2.0.3-6.1 k3b-devel-2.0.3-6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): k3b-lang-2.0.3-6.1 References:

1 0

openSUSE-RU-2016:3123-1: moderate: Recommended update for dolphin
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for dolphin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3123-1 Rating: moderate References: #1012670 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dolphin fixes the following issues: - Fix much too slow scrolling via mouse wheel in dolphin's side panels. (boo#1012670, kde#365968) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1463=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): dolphin-16.08.2-3.1 dolphin-debuginfo-16.08.2-3.1 dolphin-debugsource-16.08.2-3.1 dolphin-devel-16.08.2-3.1 dolphin-part-16.08.2-3.1 dolphin-part-debuginfo-16.08.2-3.1 libdolphinvcs5-16.08.2-3.1 libdolphinvcs5-debuginfo-16.08.2-3.1 References: https://bugzilla.suse.com/1012670

1 0

openSUSE-RU-2016:3122-1: Recommended update for xdm
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3122-1 Rating: low References: #1013200 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xdm provides the following fixes: - Ensure that display managers will be started after systemd's login manager. (bsc#1013200) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1473=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xdm-1.1.11-13.1 xdm-debuginfo-1.1.11-13.1 xdm-debugsource-1.1.11-13.1 xdm-xsession-1.1.11-13.1 References: https://bugzilla.suse.com/1013200

1 0

openSUSE-SU-2016:3121-1: moderate: Security update for w3m
by opensuse-security＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Security Update: Security update for w3m ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3121-1 Rating: moderate References: #1011283 #1011284 #1011285 #1011286 #1011287 #1011288 #1011289 #1011290 #1011291 #1011292 #1011293 #1012021 #1012022 #1012023 #1012024 #1012025 #1012026 #1012027 #1012028 #1012029 #1012030 #1012031 #1012032 Cross-References: CVE-2016-9434 CVE-2016-9435 CVE-2016-9436 CVE-2016-9437 CVE-2016-9438 CVE-2016-9439 CVE-2016-9440 CVE-2016-9441 CVE-2016-9442 CVE-2016-9443 CVE-2016-9621 CVE-2016-9622 CVE-2016-9623 CVE-2016-9624 CVE-2016-9625 CVE-2016-9626 CVE-2016-9627 CVE-2016-9628 CVE-2016-9629 CVE-2016-9630 CVE-2016-9631 CVE-2016-9632 CVE-2016-9633 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: This update for w3m fixes the following security issues (bsc#1011293): - CVE-2016-9622: w3m: null deref (bsc#1012021) - CVE-2016-9623: w3m: null deref (bsc#1012022) - CVE-2016-9624: w3m: near-null deref (bsc#1012023) - CVE-2016-9625: w3m: stack overflow (bsc#1012024) - CVE-2016-9626: w3m: stack overflow (bsc#1012025) - CVE-2016-9627: w3m: heap overflow read + deref (bsc#1012026) - CVE-2016-9628: w3m: null deref (bsc#1012027) - CVE-2016-9629: w3m: null deref (bsc#1012028) - CVE-2016-9630: w3m: global-buffer-overflow read (bsc#1012029) - CVE-2016-9631: w3m: null deref (bsc#1012030) - CVE-2016-9632: w3m: global-buffer-overflow read (bsc#1012031) - CVE-2016-9633: w3m: OOM (bsc#1012032) - CVE-2016-9434: w3m: null deref (bsc#1011283) - CVE-2016-9435: w3m: use uninit value (bsc#1011284) - CVE-2016-9436: w3m: use uninit value (bsc#1011285) - CVE-2016-9437: w3m: write to rodata (bsc#1011286) - CVE-2016-9438: w3m: null deref (bsc#1011287) - CVE-2016-9439: w3m: stack overflow (bsc#1011288) - CVE-2016-9440: w3m: near-null deref (bsc#1011289) - CVE-2016-9441: w3m: near-null deref (bsc#1011290) - CVE-2016-9442: w3m: potential heap buffer corruption (bsc#1011291) - CVE-2016-9443: w3m: null deref (bsc#1011292) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1457=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1457=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): w3m-0.5.3.git20161120-160.1 w3m-debuginfo-0.5.3.git20161120-160.1 w3m-debugsource-0.5.3.git20161120-160.1 w3m-inline-image-0.5.3.git20161120-160.1 w3m-inline-image-debuginfo-0.5.3.git20161120-160.1 - openSUSE Leap 42.1 (i586 x86_64): w3m-0.5.3.git20161120-161.1 w3m-debuginfo-0.5.3.git20161120-161.1 w3m-debugsource-0.5.3.git20161120-161.1 w3m-inline-image-0.5.3.git20161120-161.1 w3m-inline-image-debuginfo-0.5.3.git20161120-161.1 References: https://www.suse.com/security/cve/CVE-2016-9434.html https://www.suse.com/security/cve/CVE-2016-9435.html https://www.suse.com/security/cve/CVE-2016-9436.html https://www.suse.com/security/cve/CVE-2016-9437.html https://www.suse.com/security/cve/CVE-2016-9438.html https://www.suse.com/security/cve/CVE-2016-9439.html https://www.suse.com/security/cve/CVE-2016-9440.html https://www.suse.com/security/cve/CVE-2016-9441.html https://www.suse.com/security/cve/CVE-2016-9442.html https://www.suse.com/security/cve/CVE-2016-9443.html https://www.suse.com/security/cve/CVE-2016-9621.html https://www.suse.com/security/cve/CVE-2016-9622.html https://www.suse.com/security/cve/CVE-2016-9623.html https://www.suse.com/security/cve/CVE-2016-9624.html https://www.suse.com/security/cve/CVE-2016-9625.html https://www.suse.com/security/cve/CVE-2016-9626.html https://www.suse.com/security/cve/CVE-2016-9627.html https://www.suse.com/security/cve/CVE-2016-9628.html https://www.suse.com/security/cve/CVE-2016-9629.html https://www.suse.com/security/cve/CVE-2016-9630.html https://www.suse.com/security/cve/CVE-2016-9631.html https://www.suse.com/security/cve/CVE-2016-9632.html https://www.suse.com/security/cve/CVE-2016-9633.html https://bugzilla.suse.com/1011283 https://bugzilla.suse.com/1011284 https://bugzilla.suse.com/1011285 https://bugzilla.suse.com/1011286 https://bugzilla.suse.com/1011287 https://bugzilla.suse.com/1011288 https://bugzilla.suse.com/1011289 https://bugzilla.suse.com/1011290 https://bugzilla.suse.com/1011291 https://bugzilla.suse.com/1011292 https://bugzilla.suse.com/1011293 https://bugzilla.suse.com/1012021 https://bugzilla.suse.com/1012022 https://bugzilla.suse.com/1012023 https://bugzilla.suse.com/1012024 https://bugzilla.suse.com/1012025 https://bugzilla.suse.com/1012026 https://bugzilla.suse.com/1012027 https://bugzilla.suse.com/1012028 https://bugzilla.suse.com/1012029 https://bugzilla.suse.com/1012030 https://bugzilla.suse.com/1012031 https://bugzilla.suse.com/1012032

1 0