December 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:3020-1: Recommended update for clamav-database
by maintenance＠opensuse.org 06 Dec '16

06 Dec '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3020-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Dec 5th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1411=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1411=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201612050922-12.1 - openSUSE Leap 42.1 (noarch): clamav-database-201612050922-191.1 References:

1 0

openSUSE-SU-2016:3019-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Dec '16

06 Dec '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3019-1 Rating: important References: #1009026 #1010401 #1010404 #1010410 #1010411 #1010427 #1012964 Cross-References: CVE-2016-5290 CVE-2016-5291 CVE-2016-5296 CVE-2016-5297 CVE-2016-9066 CVE-2016-9079 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for MozillaThunderbird fixes some potential security issues and bugs. The following security flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2016-9079: SVG Animation Remote Code Execution (MFSA 2016-92, bsc#1012964) - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010411) - CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410) - CVE-2016-5290: Memory safety bugs fixed in Thunderbird ESR 45.5 (bsc#1010427) The update contains changes in behavior: - Changed recipient address entry: Arrow-keys now copy the pop-up value to the input field. Mouse-hovered pop-up value can no longer be confirmed with tab or enter key. This restores the behavior of Thunderbird 24. - Support changes to character limit in Twitter The following bugs were fixed: - Reply with selected text containing quote resulted in wrong quoting level indication - Email invitation might not be displayed when description contains non-ASCII characters - Attempting to sort messages on the Date field whilst a quick filter is applied got stuck on sort descending - Mail address display at header pane displayed incorrectly if the address contains UTF-8 according to RFC 6532 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1412=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): MozillaThunderbird-45.5.1-17.1 MozillaThunderbird-devel-45.5.1-17.1 MozillaThunderbird-translations-common-45.5.1-17.1 MozillaThunderbird-translations-other-45.5.1-17.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-buildsymbols-45.5.1-17.1 References: https://www.suse.com/security/cve/CVE-2016-5290.html https://www.suse.com/security/cve/CVE-2016-5291.html https://www.suse.com/security/cve/CVE-2016-5296.html https://www.suse.com/security/cve/CVE-2016-5297.html https://www.suse.com/security/cve/CVE-2016-9066.html https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1009026 https://bugzilla.suse.com/1010401 https://bugzilla.suse.com/1010404 https://bugzilla.suse.com/1010410 https://bugzilla.suse.com/1010411 https://bugzilla.suse.com/1010427 https://bugzilla.suse.com/1012964

1 0

openSUSE-OU-2016:3015-1: moderate: Optional update for libjpeg-turbo,libjpeg62-turbo
by maintenance＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Optional Update: Optional update for libjpeg-turbo,libjpeg62-turbo ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:3015-1 Rating: moderate References: #1013613 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update makes available the 32 bit version of libjpeg62, as required by the TeamViewer third party package. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1409=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libjpeg-turbo-1.3.1-33.1 libjpeg-turbo-debuginfo-1.3.1-33.1 libjpeg-turbo-debugsource-1.3.1-33.1 libjpeg62-62.1.0-33.1 libjpeg62-debuginfo-62.1.0-33.1 libjpeg62-devel-62.1.0-33.1 libjpeg62-turbo-1.3.1-33.1 libjpeg62-turbo-debugsource-1.3.1-33.1 libjpeg8-8.0.2-33.1 libjpeg8-debuginfo-8.0.2-33.1 libjpeg8-devel-8.0.2-33.1 libturbojpeg0-8.0.2-33.1 libturbojpeg0-debuginfo-8.0.2-33.1 - openSUSE Leap 42.2 (x86_64): libjpeg62-32bit-62.1.0-33.1 libjpeg62-debuginfo-32bit-62.1.0-33.1 libjpeg62-devel-32bit-62.1.0-33.1 libjpeg8-32bit-8.0.2-33.1 libjpeg8-debuginfo-32bit-8.0.2-33.1 libjpeg8-devel-32bit-8.0.2-33.1 libturbojpeg0-32bit-8.0.2-33.1 libturbojpeg0-debuginfo-32bit-8.0.2-33.1 References: https://bugzilla.suse.com/1013613

1 0

openSUSE-SU-2016:3013-1: Security update for tcpreplay
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for tcpreplay ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3013-1 Rating: low References: #987846 Cross-References: CVE-2016-6160 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tcpreplay to version 4.1.2 fixes the following issues: - CVE-2016-6160: Increase max packet size to 65549 to prevent segmentation faults (boo#987846) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1408=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): tcpreplay-4.1.2-3.1 tcpreplay-debuginfo-4.1.2-3.1 tcpreplay-debugsource-4.1.2-3.1 References: https://www.suse.com/security/cve/CVE-2016-6160.html https://bugzilla.suse.com/987846

1 0

openSUSE-SU-2016:3011-1: important: Security update for Mozilla Firefox, Thunderbird and NSS
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for Mozilla Firefox, Thunderbird and NSS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3011-1 Rating: important References: #1009026 #1010401 #1010404 #1010410 #1010411 #1010427 #1012807 #1012964 Cross-References: CVE-2016-5289 CVE-2016-5290 CVE-2016-5291 CVE-2016-5292 CVE-2016-5293 CVE-2016-5294 CVE-2016-5295 CVE-2016-5296 CVE-2016-5297 CVE-2016-5298 CVE-2016-5299 CVE-2016-9061 CVE-2016-9062 CVE-2016-9063 CVE-2016-9064 CVE-2016-9065 CVE-2016-9066 CVE-2016-9067 CVE-2016-9068 CVE-2016-9069 CVE-2016-9070 CVE-2016-9071 CVE-2016-9072 CVE-2016-9073 CVE-2016-9074 CVE-2016-9075 CVE-2016-9076 CVE-2016-9077 CVE-2016-9078 CVE-2016-9079 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: This update to Mozilla Firefox 50.0.2, Thunderbird 45.5.1 and NSS 3.16.2 fixes a number of security issues. The following vulnerabilities were fixed in Mozilla Firefox (MFSA 2016-89): - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bmo#1292443) - CVE-2016-5292: URL parsing causes crash (bmo#1288482) - CVE-2016-5297: Incorrect argument length checking in Javascript (bmo#1303678) - CVE-2016-9064: Addons update must verify IDs match between current and new versions (bmo#1303418) - CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bmo#1299686) - CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore (bmo#1301777, bmo#1308922 (CVE-2016-9069)) - CVE-2016-9068: heap-use-after-free in nsRefreshDriver (bmo#1302973) - CVE-2016-9075: WebExtensions can access the mozAddonManager API and use it to gain elevated privileges (bmo#1295324) - CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied to cross-origin images, allowing timing attacks on them (bmo#1298552) - CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bmo#1292159) - CVE-2016-9070: Sidebar bookmark can have reference to chrome window (bmo#1281071) - CVE-2016-9073: windows.create schema doesn't specify "format": "relativeUrl" (bmo#1289273) - CVE-2016-9076: select dropdown menu can be used for URL bar spoofing on e10s (bmo#1276976) - CVE-2016-9063: Possible integer overflow to fix inside XML_Parse in expat (bmo#1274777) - CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP (bmo#1285003) - CVE-2016-5289: Memory safety bugs fixed in Firefox 50 - CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 The following vulnerabilities were fixed in Mozilla NSS 3.26.1: - CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bmo#1293334) Mozilla Firefox now requires mozilla-nss 3.26.2. New features in Mozilla Firefox: - Updates to keyboard shortcuts Set a preference to have Ctrl+Tab cycle through tabs in recently used order View a page in Reader Mode by using Ctrl+Alt+R - Added option to Find in page that allows users to limit search to whole words only - Added download protection for a large number of executable file types on Windows, Mac and Linux - Fixed rendering of dashed and dotted borders with rounded corners (border-radius) - Added a built-in Emoji set for operating systems without native Emoji fonts - Blocked versions of libavcodec older than 54.35.1 - additional locale mozilla-nss was updated to 3.26.2, incorporating the following changes: - the selfserv test utility has been enhanced to support ALPN (HTTP/1.1) and 0-RTT - The following CA certificate was added: CN = ISRG Root X1 - NPN is disabled and ALPN is enabled by default - MD5 signature algorithms sent by the server in CertificateRequest messages are now properly ignored Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1407=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-50.0.2-131.1 MozillaFirefox-branding-upstream-50.0.2-131.1 MozillaFirefox-buildsymbols-50.0.2-131.1 MozillaFirefox-debuginfo-50.0.2-131.1 MozillaFirefox-debugsource-50.0.2-131.1 MozillaFirefox-devel-50.0.2-131.1 MozillaFirefox-translations-common-50.0.2-131.1 MozillaFirefox-translations-other-50.0.2-131.1 MozillaThunderbird-45.5.1-70.92.1 MozillaThunderbird-buildsymbols-45.5.1-70.92.1 MozillaThunderbird-debuginfo-45.5.1-70.92.1 MozillaThunderbird-debugsource-45.5.1-70.92.1 MozillaThunderbird-devel-45.5.1-70.92.1 MozillaThunderbird-translations-common-45.5.1-70.92.1 MozillaThunderbird-translations-other-45.5.1-70.92.1 libfreebl3-3.26.2-94.1 libfreebl3-debuginfo-3.26.2-94.1 libsoftokn3-3.26.2-94.1 libsoftokn3-debuginfo-3.26.2-94.1 mozilla-nss-3.26.2-94.1 mozilla-nss-certs-3.26.2-94.1 mozilla-nss-certs-debuginfo-3.26.2-94.1 mozilla-nss-debuginfo-3.26.2-94.1 mozilla-nss-debugsource-3.26.2-94.1 mozilla-nss-devel-3.26.2-94.1 mozilla-nss-sysinit-3.26.2-94.1 mozilla-nss-sysinit-debuginfo-3.26.2-94.1 mozilla-nss-tools-3.26.2-94.1 mozilla-nss-tools-debuginfo-3.26.2-94.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.26.2-94.1 libfreebl3-debuginfo-32bit-3.26.2-94.1 libsoftokn3-32bit-3.26.2-94.1 libsoftokn3-debuginfo-32bit-3.26.2-94.1 mozilla-nss-32bit-3.26.2-94.1 mozilla-nss-certs-32bit-3.26.2-94.1 mozilla-nss-certs-debuginfo-32bit-3.26.2-94.1 mozilla-nss-debuginfo-32bit-3.26.2-94.1 mozilla-nss-sysinit-32bit-3.26.2-94.1 mozilla-nss-sysinit-debuginfo-32bit-3.26.2-94.1 References: https://www.suse.com/security/cve/CVE-2016-5289.html https://www.suse.com/security/cve/CVE-2016-5290.html https://www.suse.com/security/cve/CVE-2016-5291.html https://www.suse.com/security/cve/CVE-2016-5292.html https://www.suse.com/security/cve/CVE-2016-5293.html https://www.suse.com/security/cve/CVE-2016-5294.html https://www.suse.com/security/cve/CVE-2016-5295.html https://www.suse.com/security/cve/CVE-2016-5296.html https://www.suse.com/security/cve/CVE-2016-5297.html https://www.suse.com/security/cve/CVE-2016-5298.html https://www.suse.com/security/cve/CVE-2016-5299.html https://www.suse.com/security/cve/CVE-2016-9061.html https://www.suse.com/security/cve/CVE-2016-9062.html https://www.suse.com/security/cve/CVE-2016-9063.html https://www.suse.com/security/cve/CVE-2016-9064.html https://www.suse.com/security/cve/CVE-2016-9065.html https://www.suse.com/security/cve/CVE-2016-9066.html https://www.suse.com/security/cve/CVE-2016-9067.html https://www.suse.com/security/cve/CVE-2016-9068.html https://www.suse.com/security/cve/CVE-2016-9069.html https://www.suse.com/security/cve/CVE-2016-9070.html https://www.suse.com/security/cve/CVE-2016-9071.html https://www.suse.com/security/cve/CVE-2016-9072.html https://www.suse.com/security/cve/CVE-2016-9073.html https://www.suse.com/security/cve/CVE-2016-9074.html https://www.suse.com/security/cve/CVE-2016-9075.html https://www.suse.com/security/cve/CVE-2016-9076.html https://www.suse.com/security/cve/CVE-2016-9077.html https://www.suse.com/security/cve/CVE-2016-9078.html https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1009026 https://bugzilla.suse.com/1010401 https://bugzilla.suse.com/1010404 https://bugzilla.suse.com/1010410 https://bugzilla.suse.com/1010411 https://bugzilla.suse.com/1010427 https://bugzilla.suse.com/1012807 https://bugzilla.suse.com/1012964

1 0

openSUSE-SU-2016:3009-1: moderate: Security update for containerd, docker, runc
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for containerd, docker, runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3009-1 Rating: moderate References: #1004490 #1006368 #1007249 #1009961 #977394 #999582 Cross-References: CVE-2016-8867 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for containerd, docker, runc fixes the following issues: Security issues fixed: - CVE-2016-8867: Fix ambient capability usage in containers (bsc#1007249). Bugfixes: - boo#1006368: Fixed broken docker/containerd installation when installed by SuSE Studio in an appliance. - boo#1004490: Update docker to 1.12.2 - boo#977394: Fix go version to 1.5. - boo#999582: Change the internal mountpoint name to not use ":" as that character can be considered a special character by other tools. - Update docker to 1.12.3 * https://github.com/docker/docker/releases/tag/v1.12.3 This update changes the runc versioning scheme to prevent version downgrades (boo#1009961). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1400=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1400=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): containerd-0.2.4+gitr565_0366d7e-5.1 containerd-ctr-0.2.4+gitr565_0366d7e-5.1 containerd-ctr-debuginfo-0.2.4+gitr565_0366d7e-5.1 containerd-debuginfo-0.2.4+gitr565_0366d7e-5.1 containerd-debugsource-0.2.4+gitr565_0366d7e-5.1 docker-1.12.3-22.1 docker-debuginfo-1.12.3-22.1 docker-debugsource-1.12.3-22.1 docker-test-1.12.3-22.1 docker-test-debuginfo-1.12.3-22.1 runc-0.1.1+gitr2816_02f8fa7-5.1 runc-debuginfo-0.1.1+gitr2816_02f8fa7-5.1 runc-debugsource-0.1.1+gitr2816_02f8fa7-5.1 - openSUSE Leap 42.2 (noarch): containerd-test-0.2.4+gitr565_0366d7e-5.1 docker-bash-completion-1.12.3-22.1 docker-zsh-completion-1.12.3-22.1 runc-test-0.1.1+gitr2816_02f8fa7-5.1 - openSUSE Leap 42.1 (i586 x86_64): containerd-0.2.4+gitr565_0366d7e-7.1 containerd-ctr-0.2.4+gitr565_0366d7e-7.1 containerd-ctr-debuginfo-0.2.4+gitr565_0366d7e-7.1 containerd-debuginfo-0.2.4+gitr565_0366d7e-7.1 containerd-debugsource-0.2.4+gitr565_0366d7e-7.1 runc-0.1.1+gitr2816_02f8fa7-7.1 runc-debuginfo-0.1.1+gitr2816_02f8fa7-7.1 runc-debugsource-0.1.1+gitr2816_02f8fa7-7.1 - openSUSE Leap 42.1 (noarch): containerd-test-0.2.4+gitr565_0366d7e-7.1 docker-bash-completion-1.12.3-24.1 docker-zsh-completion-1.12.3-24.1 runc-test-0.1.1+gitr2816_02f8fa7-7.1 - openSUSE Leap 42.1 (x86_64): docker-1.12.3-24.1 docker-debuginfo-1.12.3-24.1 docker-debugsource-1.12.3-24.1 docker-test-1.12.3-24.1 docker-test-debuginfo-1.12.3-24.1 References: https://www.suse.com/security/cve/CVE-2016-8867.html https://bugzilla.suse.com/1004490 https://bugzilla.suse.com/1006368 https://bugzilla.suse.com/1007249 https://bugzilla.suse.com/1009961 https://bugzilla.suse.com/977394 https://bugzilla.suse.com/999582

1 0

openSUSE-SU-2016:3007-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3007-1 Rating: moderate References: #1012271 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update to phpMyAdmin 4.4.15.9 fixes security issues and bugs. The following security issues were fixed: - Unsafe generation of $cfg['blowfish_secret'] (PMASA-2016-58) - phpMyAdmin's phpinfo functionality is removed (PMASA-2016-59) - AllowRoot and allow/deny rule bypass with specially-crafted username (PMASA-2016-60) - Username matching weaknesses with allow/deny rules (PMASA-2016-61) - Possible to bypass logout timeout (PMASA-2016-62) - Full path disclosure (FPD) weaknesses (PMASA-2016-63) - Multiple XSS weaknesses (PMASA-2016-64) - Multiple denial-of-service (DOS) vulnerabilities (PMASA-2016-65) - Possible to bypass white-list protection for URL redirection (PMASA-2016-66) - BBCode injection to login page (PMASA-2016-67) - Denial-of-service (DOS) vulnerability in table partitioning (PMASA-2016-68) - Multiple SQL injection vulnerabilities (PMASA-2016-69 ) - Incorrect serialized string parsing (PMASA-2016-70) - CSRF token not stripped from the URL (PMASA-2016-71) The following bugfix changes are included: - Fix for expanding in navigation pane - Reintroduced a simplified version of PmaAbsoluteUri directive (needed with reverse proxies) - Fix editing of ENUM/SET/DECIMAL field structures - Improvements to the parser Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1406=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1406=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1406=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): phpMyAdmin-4.4.15.9-28.1 - openSUSE Leap 42.1 (noarch): phpMyAdmin-4.4.15.9-28.1 - openSUSE 13.2 (noarch): phpMyAdmin-4.4.15.9-42.1 References: https://bugzilla.suse.com/1012271

1 0

openSUSE-SU-2016:3006-1: moderate: Security update for nodejs4
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for nodejs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3006-1 Rating: moderate References: #1007728 #1009011 Cross-References: CVE-2016-5180 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2016-5180: c-ares: Fix for single-byte buffer overwrite (bsc#1007728). Bug fixes: - bsc#1009011: npm4 should provide versioned nodejs-npm and npm allowing nodejs-packaging to continue to function properly in Leap 42.2 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1403=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): nodejs4-4.6.1-3.1 nodejs4-debuginfo-4.6.1-3.1 nodejs4-debugsource-4.6.1-3.1 nodejs4-devel-4.6.1-3.1 npm4-4.6.1-3.1 - openSUSE Leap 42.2 (noarch): nodejs4-docs-4.6.1-3.1 References: https://www.suse.com/security/cve/CVE-2016-5180.html https://bugzilla.suse.com/1007728 https://bugzilla.suse.com/1009011

1 0

openSUSE-SU-2016:3005-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3005-1 Rating: moderate References: #1005070 #1005072 #1005076 #986566 #989980 #998677 Cross-References: CVE-2015-2304 CVE-2016-5418 CVE-2016-5844 CVE-2016-6250 CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libarchive fixes several issues. These security issues were fixed: - CVE-2016-8687: Buffer overflow when printing a filename (bsc#1005070). - CVE-2016-8689: Heap overflow when reading corrupted 7Zip files (bsc#1005072). - CVE-2016-8688: Use after free because of incorrect calculation in next_line (bsc#1005076). - CVE-2016-5844: Integer overflow in the ISO parser in libarchive allowed remote attackers to cause a denial of service (application crash) via a crafted ISO file (bsc#986566). - CVE-2016-6250: Integer overflow in the ISO9660 writer in libarchive allowed remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow (bsc#989980). - CVE-2016-5418: The sandboxing code in libarchive mishandled hardlink archive entries of non-zero data size, which might allowed remote attackers to write to arbitrary files via a crafted archive file (bsc#998677). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1404=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bsdtar-3.1.2-16.1 bsdtar-debuginfo-3.1.2-16.1 libarchive-debugsource-3.1.2-16.1 libarchive-devel-3.1.2-16.1 libarchive13-3.1.2-16.1 libarchive13-debuginfo-3.1.2-16.1 - openSUSE Leap 42.1 (x86_64): libarchive13-32bit-3.1.2-16.1 libarchive13-debuginfo-32bit-3.1.2-16.1 References: https://www.suse.com/security/cve/CVE-2015-2304.html https://www.suse.com/security/cve/CVE-2016-5418.html https://www.suse.com/security/cve/CVE-2016-5844.html https://www.suse.com/security/cve/CVE-2016-6250.html https://www.suse.com/security/cve/CVE-2016-8687.html https://www.suse.com/security/cve/CVE-2016-8688.html https://www.suse.com/security/cve/CVE-2016-8689.html https://bugzilla.suse.com/1005070 https://bugzilla.suse.com/1005072 https://bugzilla.suse.com/1005076 https://bugzilla.suse.com/986566 https://bugzilla.suse.com/989980 https://bugzilla.suse.com/998677

1 0

openSUSE-SU-2016:3004-1: moderate: Security update for sudo
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3004-1 Rating: moderate References: #1007501 #1007766 #899252 #917806 #979531 Cross-References: CVE-2014-9680 CVE-2016-7032 CVE-2016-7076 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for sudo fixes the following security issues: - Fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality: * noexec bypass via system() and popen() [CVE-2016-7032, bsc#1007766] * noexec bypass via wordexp() [CVE-2016-7076, bsc#1007501] - Fix unsafe handling of TZ environment variable. [CVE-2014-9680, bsc#917806] Additionally, these non-security fixes are included in the update: - Fix "ignoring time stamp from the future" message after each boot with !tty_tickets. [bsc#899252] - Enable support for SASL-based authentication. [bsc#979531] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1402=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): sudo-1.8.10p3-8.1 sudo-debuginfo-1.8.10p3-8.1 sudo-debugsource-1.8.10p3-8.1 sudo-devel-1.8.10p3-8.1 sudo-test-1.8.10p3-8.1 References: https://www.suse.com/security/cve/CVE-2014-9680.html https://www.suse.com/security/cve/CVE-2016-7032.html https://www.suse.com/security/cve/CVE-2016-7076.html https://bugzilla.suse.com/1007501 https://bugzilla.suse.com/1007766 https://bugzilla.suse.com/899252 https://bugzilla.suse.com/917806 https://bugzilla.suse.com/979531

1 0

openSUSE-SU-2016:3003-1: moderate: Security update for tar
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for tar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3003-1 Rating: moderate References: #1007188 #913058 Cross-References: CVE-2016-6321 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for tar fixes the following issues: - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line [bsc#1007188] [CVE-2016-6321] - Fix Amanda integration issue (bsc#913058) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1401=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1401=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): tar-1.27.1-8.1 tar-backup-scripts-1.27.1-8.1 tar-debuginfo-1.27.1-8.1 tar-debugsource-1.27.1-8.1 tar-tests-1.27.1-8.1 tar-tests-debuginfo-1.27.1-8.1 - openSUSE Leap 42.2 (noarch): tar-lang-1.27.1-8.1 - openSUSE Leap 42.1 (i586 x86_64): tar-1.27.1-9.1 tar-backup-scripts-1.27.1-9.1 tar-debuginfo-1.27.1-9.1 tar-debugsource-1.27.1-9.1 tar-tests-1.27.1-9.1 tar-tests-debuginfo-1.27.1-9.1 - openSUSE Leap 42.1 (noarch): tar-lang-1.27.1-9.1 References: https://www.suse.com/security/cve/CVE-2016-6321.html https://bugzilla.suse.com/1007188 https://bugzilla.suse.com/913058

1 0

openSUSE-SU-2016:3002-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3002-1 Rating: moderate References: #1005070 #1005072 #1005076 #986566 #989980 #998677 Cross-References: CVE-2015-2304 CVE-2016-5418 CVE-2016-5844 CVE-2016-6250 CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libarchive fixes several issues. These security issues were fixed: - CVE-2016-8687: Buffer overflow when printing a filename (bsc#1005070). - CVE-2016-8689: Heap overflow when reading corrupted 7Zip files (bsc#1005072). - CVE-2016-8688: Use after free because of incorrect calculation in next_line (bsc#1005076). - CVE-2016-5844: Integer overflow in the ISO parser in libarchive allowed remote attackers to cause a denial of service (application crash) via a crafted ISO file (bsc#986566). - CVE-2016-6250: Integer overflow in the ISO9660 writer in libarchive allowed remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow (bsc#989980). - CVE-2016-5418: The sandboxing code in libarchive mishandled hardlink archive entries of non-zero data size, which might allowed remote attackers to write to arbitrary files via a crafted archive file (bsc#998677). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1405=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): bsdtar-3.1.2-16.1 bsdtar-debuginfo-3.1.2-16.1 libarchive-debugsource-3.1.2-16.1 libarchive-devel-3.1.2-16.1 libarchive13-3.1.2-16.1 libarchive13-debuginfo-3.1.2-16.1 - openSUSE Leap 42.2 (x86_64): libarchive13-32bit-3.1.2-16.1 libarchive13-debuginfo-32bit-3.1.2-16.1 References: https://www.suse.com/security/cve/CVE-2015-2304.html https://www.suse.com/security/cve/CVE-2016-5418.html https://www.suse.com/security/cve/CVE-2016-5844.html https://www.suse.com/security/cve/CVE-2016-6250.html https://www.suse.com/security/cve/CVE-2016-8687.html https://www.suse.com/security/cve/CVE-2016-8688.html https://www.suse.com/security/cve/CVE-2016-8689.html https://bugzilla.suse.com/1005070 https://bugzilla.suse.com/1005072 https://bugzilla.suse.com/1005076 https://bugzilla.suse.com/986566 https://bugzilla.suse.com/989980 https://bugzilla.suse.com/998677

1 0

openSUSE-RU-2016:3000-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3000-1 Rating: moderate References: #1012291 Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Opera was updated to 41.0.2353.69 to fix the following issues: - Moving elements in bookmarks bar crashes Opera An appdata.xml file was added to support the App store. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2016-1399=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2016-1399=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-41.0.2353.69-6.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-41.0.2353.69-43.1 References: https://bugzilla.suse.com/1012291

1 0

openSUSE-RU-2016:2999-1: moderate: Recommended update for gramps
by maintenance＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Recommended Update: Recommended update for gramps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2999-1 Rating: moderate References: #1011888 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gramps fixes the following issues: - Update to version 4.2.4. (boo#1011888) - Fixes for the PHON, FAX, EMAIL and WWW Gedcom tags to support Gedcom v5.5.1. - Use more relative import. - Support for FTM and others Custom Gedcom Event Tags on import. - Fix '_deeprelationshippath' filter rule. - Narrativeweb: Corrected some dates in the tar archive. - Fix Gramps crashes when closed while exporting. - Some events are now shown in familymaps page. - Remove old debug bloc on place selection. - Add GUI and CLI config option to allow easy setting. - Chinese characters are now rendered properly in pdf reports. - Support for v5.5.1 OBJE/FORM/MEDI tag on embedded OBJE. - Sources on gedcom are sorted. - Change "class xxx(object)" to "class xxx". - Replaced "try: except:" with "with open". - "raise NotImplemented" was changed to "raise NotImplementedError()". - A new argument was added to IsEnclosedByRule. - Narrativeweb: place title must agree the references.place-auto configuration. - Improvements on CSV file format support. - Update of the Finnish holidays. - Some strings in tools and report dialogs will now translate. - Gedcom import improvements in media area to support v5.5.1 and FTM. - Fix trailing whitespace. - Support for Gedcom import of FTM .ged file containing _LINK tags. - Change pycairo-python3 to pycairo. - pycairo for python2 is now py2cairo. - Remove pango modules from bundle as pango no longer uses them. - Fix loss of spaces in text fields from FTM in the Gedcom import process. - Fix for Gedcom import of FTM file containing _PHOTO tags. - self.photo initializer implemented. - Fix error when attempting to select an "Available item" for the Book Report. - Fix for either valid or invalid FTM Gedcom. - Fix crash when importing a FTM file with OCCU record into Gedcom. - 'NoneType' object now has an attribute.('get_child_ref_list'). - Family Page maps are now functional in Narrative Web report. - String translated in geoplaces. - Descendant Report does now recognise auto. place title generation. - Translated text will be printed in the program. - Geography: Fix crash when attempting to print. (add parent to dialog) - GEDCOM accepts CR as a line terminator. - Corrected Numeric date format for cs_CZ locale. - Narrativeweb: consistent & complete display of place hierarchy labels. - Narratedweb: Fix surname listing for people with multiple partners. - Fix: In "Verify" people w/ death event w/o date are not thought dead. - While starting gramps, "tips of the day" screen pops up. - Fix: GEDCOM import in CLI mode with .ged file containing ANSEL encoding tries to pop up gui. - Fix merge conflict. - Use first matching name when generating place titles. - GEDCOM import with media files that have no path. - [Geography] Geoclose and mother handle. - Correct placing of the names if Gedcom ADDR record contains no street. - Tidy up place configuration options. - Use CSS to fade background colour in ValidatableMaskedEntry. - Fix crash on GEDCOM import with empty _AKA lines. - Add inclusive option to IsEnclosedBy rule. - Fix finding gender when saving/closing new person window with Alt-o. - Fix to allow deferred translation of place type. - Include all place types in place report. - Allow place selection both individually and by filter on textual report. - Expand tree in selectors automatically. - Fix Encloses gramplet to display correct place references. - Update for appdata stuff. - Fix UnboundLocalError on ODF doc backend. - Fix for wrong frame in Media Preview. - Fix signals. - Fix GEDCOM import PLAC:FORM in local mode. - Fix empty Place Alternate Names on import. - Fix "Merge unit" test for PlaceCheck. - Fix titles for GEDCOM import some Place Names &. - Fix loss of PLAC or ADDR attached Notes etc after GEDCOM import. - Gramps appearing in Gnome Software. - Fix broken GEDCOM import PLAC:FORM handling. - Fix duplicated entries while Place Alt Names. - Fix duplicate event IDs at multiple GEDCOM imports. - Fix place page in webreport. - Gallery tab of Source view displays .ods files. - Narrated Web report - Corrected individual sort order on the Surnames tab. - Specify required GtkSpell and GExiv2 version. - Fix Narrated web report link to thumbnails on certain pages. - Individual page sort order in the Narrated Web report has changed. - Gramps doens't report anymore that it can't find dictionaries. - Updated gramps.appdata.xml path. - Fix creation of the "graphic calendar report". - Fix "TypeError: 'tuple' object supports item assignment. - Fixed an unexpected error. - Fix for building narrated web site. - [NarrativeWeb report] Places index and Media index are now correctly sorted. - Fix error when trying to create narrative report. (residence event) - Fix filter set by default on selector, 'Show all' button. - Detailed Ancestors Report doesn't have ? anymore for locations when private data is excluded. - Fix age in the event family view column is wrong. - Fix crash when dragging multiple media items to clipboard. - Fix vCal Export File format. - Fix error for Complete Individual Report -- complete database - Narrated Web Site Report: places page is no longer sorted alphabetically - Narrative web: html elements emitted in different order - Narrative web: Fix error: "errno: 1, operation is not permitted" when creating archive. - Narrative Web report passes now. - Fix multiple lines for firstname on gramps XML file via import or export. - Fix scrolling in persons view after typing some letters. - Location on geography view can now convert string to float. - setup.py: Makes typeout more accurate. - Searching in people view when surnames are collapsed. - Fix error when changing database in new locations gramplets. - Fix error loading Participants add-on in French locale. - Restores setting for the stdout encoding to sys.getdefaultencoding() for Python3. - Fix comment about getting the right encoding for stdout. - Date format matches system. - Makes US English a special-case locale, where en_GB is the default for english based locales. - Enhance the Locations gramplet. - New "Encloses" gramplet to the display places that the active place encloses. - Individuals with incomplete names get updated when name completed. - Children gramplet in Family view gets updated when birth/death events are added to a child. - Non-image media objects appear in the main window gallery. - Pressing tab doesn't stop at element in gui places anymore. - Fix exception when double-clicking on a source in the citation gramplet. - Fix crash at "Find text in record" filter. - Fix vCard Export. - Fix "Remove Unused Objects Tool", so that it doesn't find notes used in the "To Do" gramplet anymore. - Enable Unicode selection. - Enable import of gedcom generated by RootsMagic custom place details ignoring PlaceName(). - Fix people sorted by surname view. - Fix crash when getting the complete PDF report about a person. (whole database) - Update for travis. - Only consider the values of LC_ALL, LANG, and LANGUAGE (in that order), when choosing the default locale. - Implement new Icelandic date and relationships handlers. - Fix Finnish translation in keywords of desktop entry. - Updated translations. - Add webcal.py.diff: add webcal.py from master. - Provide much nicer webcalendar navigation. - Clean space up and remove obsolete spaces at end of lines. - Uncheck the "Show all" checkbox of "Select Family" window when the filter is cleared. - Show name of user defined filter. - Fix ErrorDialog and GtkDialog as they were mapped without a transient parent. - Fix 'Find' when used in the Family selector. - Fix default selection in selectors. - Comment currently-unused bogus wiki URL pointers. - Fix counter for filtered entries and indentation on TreeBaseModel. - Fix faulty headline in start up screen. - Check that gramplet is in notebook before setting tab label. - Fix creation of focus change events. - Fix error TypeError: unorderable types: str() < NoneType()" at Interactivesearch. - Put tag selection list in alphabetical order. - Remove redundant code. - Fix delete error in undoable entry widget. - Fix deprecation warning. - Re-enable selection in MultiTreeView on a grab_broken event. - Add validation to gender field. - Fix unhandled AttributeError when db.get_tag_from_handle returns "None". - Fix ReferencedBySelectionProxy forgetting some referenced tags. - Remove encoding on stdout and stderr. - Handle citation objects in glocale.trans_objclass. - Enable import of Locality data in address. - Enable download of new or updated add-ons: - Don't check SSL certs when fetching addons. - Catch urlopen TypeError when context arg isn't supported. - Fix undefined variable error. - Fix ValueError "underlying buffer has been detached". - Fix LaTeX backend crashes. - Fix performance issue due to bad initialization and performance issue when selecting the events or places views. - Narrated Web Site Report: Fix html elements emitted in different order. - Disable creation of unused *_init.jpg in the narrated website. - Enable export of some media files to the NAVWEB report. - Add author to citations in the Narrative web report. - Fix TypeError: "unorderable types: EventRef() < EventRef()", when the events list and family list differ between two reports. - Change mtime to origin instead of destination. - Add missing thumbnails html file in the narrative web. - Narrativeweb: Place title based on current date not that of the event. - Webcal: make the month name clickable in the year overview page. - Enable translation of the word 'Narrative'. - Disable usage of an hardcoded string name on "Simple Descendants" textual report by an unknown spouse. - Enable translation of Father/mother's age attributes on reports. - Improve Russian date handler and unittests. - Use Mars month instead of Marzec on Polish locale (Date Editor). - Support for Retina and HiDPI Display, added 24px icons. - Fix verification tool with "Estimate missing or inexact dates" - Fix missing link in hourglass graph report. - Sort custom place types in editors. - Allow Easter calculation with python3. - Fix crash on Descendants-detailed report. - FanChartDescendants View should at least have 2 generations. - Allow hyphenated gramps-id in Graphviz reports. - Fix Complete Individual Report. - Fix broken wiki help links. - Set TextOption widget to expand vertically. - Adapt Unused Object Dialog. - Enable Short cut keys in the 'Change Event Types' dialog. - Update some "Tips of the day". - Fix Error when extracting place names. - Fix Pedigreeview crash when selecting Compact view. - Set "visable_window" in GtkEventBox to fix transparency. - Enable faster scrolling. - Cache database access for column values. - Cache do_get_path lookups. - Speed up load access on treeviews with no filters. - Set new LRU size of 1k (was 250). - Use cache in do_get_path from siblings. - Avoid using person-centric date matching for places. - Use place title as default name in GEDCOM import. - Ensure place names are not empty after upgrade. - Fix proxy to include all referenced place objects. - Remove copy button from family tree manager. - Add consistency for name fields on Person Editor. - Place.set_name(name) requires a PlaceName(). - Fixes and improvements on place selection. - Fix limit problems with existing selection in media reference editor. - Fix color on history. - Fix countries selector for holidays. - Fix missing markups into textual reports. - All sidebars with Types now show custom types in combo list. - Added Places to CSV import/export. - Some fixes on installer (setup.py). - Various improvements on gen.plug.utils. - Fix graph reports [in Greek locale]. - Add new date handler for Hungarian locale. - Update source URL path to github. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1396=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1396=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): gramps-4.2.4-7.1 gramps-lang-4.2.4-7.1 - openSUSE Leap 42.1 (noarch): gramps-4.2.4-6.1 gramps-lang-4.2.4-6.1 References: https://bugzilla.suse.com/1011888

1 0

openSUSE-RU-2016:2998-1: important: Recommended update for fcoe-utils
by maintenance＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Recommended Update: Recommended update for fcoe-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2998-1 Rating: important References: #1006027 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fcoe-utils fixes a potential segmentation fault when running "fcoeadm -t" on systems where other fiber-channel storage devices are present. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1398=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): fcoe-utils-1.0.31-5.1 fcoe-utils-debuginfo-1.0.31-5.1 fcoe-utils-debugsource-1.0.31-5.1 References: https://bugzilla.suse.com/1006027

1 0

openSUSE-RU-2016:2997-1: moderate: Recommended update for yast2-auth-client
by maintenance＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Recommended Update: Recommended update for yast2-auth-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2997-1 Rating: moderate References: #1000749 #1004083 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-auth-client provides the following fixes: - Don't fail to start when network interface has no address assigned. (bsc#1004083) - Change dialog return value to :next so that yast2-users will reload its summary upon completion of this dialog. (bsc#1000749) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1394=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): yast2-auth-client-3.3.13-3.1 References: https://bugzilla.suse.com/1000749 https://bugzilla.suse.com/1004083

1 0

openSUSE-RU-2016:2996-1: moderate: Recommended update for ha-cluster-bootstrap
by maintenance＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Recommended Update: Recommended update for ha-cluster-bootstrap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2996-1 Rating: moderate References: #1001164 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ha-cluster-bootstrap to version 0.4+git.1475739556.1088521 fixes the following issues: - Better corosync defaults (bsc#1001164) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1397=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): ha-cluster-bootstrap-0.4+git.1475739556.1088521-3.1 References: https://bugzilla.suse.com/1001164

1 0

openSUSE-RU-2016:2995-1: moderate: Recommended update for libvirt
by maintenance＠opensuse.org 05 Dec '16

05 Dec '16

openSUSE Recommended Update: Recommended update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2995-1 Rating: moderate References: #959297 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libvirt fixes the following issues: - Package org.libvirt.api.policy polkit file (boo#959297) - Fix postun systemd services cleanup - Mark /etc/libvirt/nwfilter/*.xml files as config files Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1395=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libvirt-1.2.18.4-17.2 libvirt-client-1.2.18.4-17.2 libvirt-client-debuginfo-1.2.18.4-17.2 libvirt-daemon-1.2.18.4-17.2 libvirt-daemon-config-network-1.2.18.4-17.2 libvirt-daemon-config-nwfilter-1.2.18.4-17.2 libvirt-daemon-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-interface-1.2.18.4-17.2 libvirt-daemon-driver-interface-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-lxc-1.2.18.4-17.2 libvirt-daemon-driver-lxc-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-network-1.2.18.4-17.2 libvirt-daemon-driver-network-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-nodedev-1.2.18.4-17.2 libvirt-daemon-driver-nodedev-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-nwfilter-1.2.18.4-17.2 libvirt-daemon-driver-nwfilter-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-qemu-1.2.18.4-17.2 libvirt-daemon-driver-qemu-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-secret-1.2.18.4-17.2 libvirt-daemon-driver-secret-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-storage-1.2.18.4-17.2 libvirt-daemon-driver-storage-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-uml-1.2.18.4-17.2 libvirt-daemon-driver-uml-debuginfo-1.2.18.4-17.2 libvirt-daemon-driver-vbox-1.2.18.4-17.2 libvirt-daemon-driver-vbox-debuginfo-1.2.18.4-17.2 libvirt-daemon-lxc-1.2.18.4-17.2 libvirt-daemon-qemu-1.2.18.4-17.2 libvirt-daemon-uml-1.2.18.4-17.2 libvirt-daemon-vbox-1.2.18.4-17.2 libvirt-debugsource-1.2.18.4-17.2 libvirt-devel-1.2.18.4-17.2 libvirt-doc-1.2.18.4-17.2 libvirt-lock-sanlock-1.2.18.4-17.2 libvirt-lock-sanlock-debuginfo-1.2.18.4-17.2 libvirt-login-shell-1.2.18.4-17.2 libvirt-login-shell-debuginfo-1.2.18.4-17.2 - openSUSE Leap 42.1 (x86_64): libvirt-client-32bit-1.2.18.4-17.2 libvirt-client-debuginfo-32bit-1.2.18.4-17.2 libvirt-daemon-driver-libxl-1.2.18.4-17.2 libvirt-daemon-driver-libxl-debuginfo-1.2.18.4-17.2 libvirt-daemon-xen-1.2.18.4-17.2 libvirt-devel-32bit-1.2.18.4-17.2 References: https://bugzilla.suse.com/959297

1 0

openSUSE-SU-2016:2994-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2994-1 Rating: important References: #1012807 #1012964 Cross-References: CVE-2016-9078 CVE-2016-9079 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: MozillaFirefox is updated to version 50.0.2 which fixes the following issues: * Firefox crashed with 3rd party Chinese IME when using IME text (fixed in version 50.0.1) * Redirection from an HTTP connection to a data: URL could inherit wrong origin after an HTTP redirect (fixed in version 50.0.1, bmo#1317641, MFSA 2016-91, boo#1012807, CVE-2016-9078) * Maliciously crafted SVG animations could cause remote code execution (fixed in version 50.0.2, bmo#1321066, MFSA 2016-92, boo##1012964, CVE-2016-9079) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1392=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1392=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1392=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-50.0.2-42.2 MozillaFirefox-branding-upstream-50.0.2-42.2 MozillaFirefox-buildsymbols-50.0.2-42.2 MozillaFirefox-debuginfo-50.0.2-42.2 MozillaFirefox-debugsource-50.0.2-42.2 MozillaFirefox-devel-50.0.2-42.2 MozillaFirefox-translations-common-50.0.2-42.2 MozillaFirefox-translations-other-50.0.2-42.2 - openSUSE Leap 42.1 (x86_64): MozillaFirefox-50.0.2-42.1 MozillaFirefox-branding-upstream-50.0.2-42.1 MozillaFirefox-buildsymbols-50.0.2-42.1 MozillaFirefox-debuginfo-50.0.2-42.1 MozillaFirefox-debugsource-50.0.2-42.1 MozillaFirefox-devel-50.0.2-42.1 MozillaFirefox-translations-common-50.0.2-42.1 MozillaFirefox-translations-other-50.0.2-42.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-50.0.2-91.1 MozillaFirefox-branding-upstream-50.0.2-91.1 MozillaFirefox-buildsymbols-50.0.2-91.1 MozillaFirefox-debuginfo-50.0.2-91.1 MozillaFirefox-debugsource-50.0.2-91.1 MozillaFirefox-devel-50.0.2-91.1 MozillaFirefox-translations-common-50.0.2-91.1 MozillaFirefox-translations-other-50.0.2-91.1 References: https://www.suse.com/security/cve/CVE-2016-9078.html https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1012807 https://bugzilla.suse.com/1012964

1 0

openSUSE-SU-2016:2993-1: important: Security update for vim
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for vim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2993-1 Rating: important References: #1010685 #988903 Cross-References: CVE-2016-1248 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for vim fixes the following security issues: - Fixed CVE-2016-1248 an arbitrary command execution vulnerability (bsc#1010685) This update for vim fixes the following issues: - Fix build with Python 3.5. (bsc#988903) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1390=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gvim-7.4.326-8.2 gvim-debuginfo-7.4.326-8.2 vim-7.4.326-8.2 vim-debuginfo-7.4.326-8.2 vim-debugsource-7.4.326-8.2 - openSUSE Leap 42.2 (noarch): vim-data-7.4.326-8.2 References: https://www.suse.com/security/cve/CVE-2016-1248.html https://bugzilla.suse.com/1010685 https://bugzilla.suse.com/988903

1 0

openSUSE-SU-2016:2992-1: important: Security update for vim
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for vim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2992-1 Rating: important References: #1010685 Cross-References: CVE-2016-1248 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vim fixes the following security issues: - Fixed CVE-2016-1248 an arbitrary command execution vulnerability (bsc#1010685) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1391=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1391=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gvim-7.4.326-8.1 gvim-debuginfo-7.4.326-8.1 vim-7.4.326-8.1 vim-debuginfo-7.4.326-8.1 vim-debugsource-7.4.326-8.1 - openSUSE Leap 42.1 (noarch): vim-data-7.4.326-8.1 - openSUSE 13.2 (i586 x86_64): gvim-7.4.461.hg.6253-3.1 gvim-debuginfo-7.4.461.hg.6253-3.1 vim-7.4.461.hg.6253-3.1 vim-debuginfo-7.4.461.hg.6253-3.1 vim-debugsource-7.4.461.hg.6253-3.1 - openSUSE 13.2 (noarch): vim-data-7.4.461.hg.6253-3.1 References: https://www.suse.com/security/cve/CVE-2016-1248.html https://bugzilla.suse.com/1010685

1 0

openSUSE-SU-2016:2991-1: important: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2991-1 Rating: important References: #1012964 Cross-References: CVE-2016-9079 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update contains Mozilla Thunderbird 45.5.1 and fixes one vulnerability. In Mozilla Thunderbird, this vulnerability may be exploited when used in a browser-like context. - CVE-2016-9079: SVG Animation Remote Code Execution (MFSA 2016-92, bsc#1012964, bmo#1321066) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1393=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1393=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1393=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaThunderbird-45.5.1-28.2 MozillaThunderbird-buildsymbols-45.5.1-28.2 MozillaThunderbird-debuginfo-45.5.1-28.2 MozillaThunderbird-debugsource-45.5.1-28.2 MozillaThunderbird-devel-45.5.1-28.2 MozillaThunderbird-translations-common-45.5.1-28.2 MozillaThunderbird-translations-other-45.5.1-28.2 - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-45.5.1-28.2 MozillaThunderbird-buildsymbols-45.5.1-28.2 MozillaThunderbird-debuginfo-45.5.1-28.2 MozillaThunderbird-debugsource-45.5.1-28.2 MozillaThunderbird-devel-45.5.1-28.2 MozillaThunderbird-translations-common-45.5.1-28.2 MozillaThunderbird-translations-other-45.5.1-28.2 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-45.5.1-55.1 MozillaThunderbird-buildsymbols-45.5.1-55.1 MozillaThunderbird-debuginfo-45.5.1-55.1 MozillaThunderbird-debugsource-45.5.1-55.1 MozillaThunderbird-devel-45.5.1-55.1 MozillaThunderbird-translations-common-45.5.1-55.1 MozillaThunderbird-translations-other-45.5.1-55.1 References: https://www.suse.com/security/cve/CVE-2016-9079.html https://bugzilla.suse.com/1012964

1 0

openSUSE-SU-2016:2990-1: moderate: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 04 Dec '16

04 Dec '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2990-1 Rating: moderate References: #1005522 #1005523 #1005524 #1005525 #1005526 #1005527 #1005528 Cross-References: CVE-2016-5542 CVE-2016-5554 CVE-2016-5556 CVE-2016-5568 CVE-2016-5573 CVE-2016-5582 CVE-2016-5597 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: - Update to 2.6.8 - OpenJDK 7u121 * Security fixes + S8151921: Improved page resolution + S8155968: Update command line options + S8155973, CVE-2016-5542: Tighten jar checks (boo#1005522) + S8157176: Improved classfile parsing + S8157739, CVE-2016-5554: Classloader Consistency Checking (boo#1005523) + S8157749: Improve handling of DNS error replies + S8157753: Audio replay enhancement + S8157759: LCMS Transform Sampling Enhancement + S8157764: Better handling of interpolation plugins + S8158302: Handle contextual glyph substitutions + S8158993, CVE-2016-5568: Service Menu services (boo#1005525) + S8159495: Fix index offsets + S8159503: Amend Annotation Actions + S8159511: Stack map validation + S8159515: Improve indy validation + S8159519, CVE-2016-5573: Reformat JDWP messages (boo#1005526) + S8160090: Better signature handling in pack200 + S8160094: Improve pack200 layout + S8160098: Clean up color profiles + S8160591, CVE-2016-5582: Improve internal array handling (boo#1005527) + S8160838, CVE-2016-5597: Better HTTP service (boo#1005528) + PR3207, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read() + CVE-2016-5556 (boo#1005524) * Import of OpenJDK 7 u121 build 0 + S6624200: Regression test fails: test/closed/javax/swing/JMenuItem/4654927/bug4654927.java + S6882559: new JEditorPane("text/plain","") fails for null context class loader + S7090158: Networking Libraries don't build with javac -Werror + S7125055: ContentHandler.getContent API changed in error + S7145960: sun/security/mscapi/ShortRSAKey1024.sh failing on windows + S7187051: ShortRSAKeynnn.sh tests should do cleanup before start test + S8000626: Implement dead key detection for KeyEvent on Linux + S8003890: corelibs test scripts should pass TESTVMOPTS + S8005629: javac warnings compiling java.awt.EventDispatchThread and sun.awt.X11.XIconWindow + S8010297: Missing isLoggable() checks in logging code + S8010782: clean up source files containing carriage return characters + S8014431: cleanup warnings indicated by the -Wunused-value compiler option on linux + S8015265: revise the fix for 8007037 + S8016747: Replace deprecated PlatformLogger isLoggable(int) with isLoggable(Level) + S8020708: NLS mnemonics missing in SwingSet2/JInternalFrame demo + S8024756: method grouping tabs are not selectable + S8026741: jdk8 l10n resource file translation update 5 + S8048147: Privilege tests with JAAS Subject.doAs + S8048357: PKCS basic tests + S8049171: Additional tests for jarsigner's warnings + S8059177: jdk8u40 l10n resource file translation update 1 + S8075584: test for 8067364 depends on hardwired text advance + S8076486: [TESTBUG] javax/security/auth/Subject/doAs/NestedActions.java fails if extra VM options are given + S8077953: [TEST_BUG] com/sun/management/OperatingSystemMXBean/TestTotalSwap.java Compilation failed after JDK-8077387 + S8080628: No mnemonics on Open and Save buttons in JFileChooser + S8083601: jdk8u60 l10n resource file translation update 2 + S8140530: Creating a VolatileImage with size 0,0 results in no longer working g2d.drawString + S8142926: OutputAnalyzer's shouldXXX() calls return this + S8143134: L10n resource file translation update + S8147077: IllegalArgumentException thrown by api/java_awt/Component/FlipBufferStrategy/indexTGF_General + S8148127: IllegalArgumentException thrown by JCK test api/java_awt/Component/FlipBufferStrategy/indexTGF_General in opengl pipeline + S8150611: Security problem on sun.misc.resources.Messages* + S8157653: [Parfait] Uninitialised variable in awt_Font.cpp + S8158734: JEditorPane.createEditorKitForContentType throws NPE after 6882559 + S8159684: (tz) Support tzdata2016f + S8160934: isnan() is not available on older MSVC compilers + S8162411: Service Menu services 2 + S8162419: closed/com/oracle/jfr/runtime/TestVMInfoEvent.sh failing after JDK-8155968 + S8162511: 8u111 L10n resource file updates + S8162792: Remove constraint DSA keySize < 1024 from jdk.jar.disabledAlgorithms in jdk8 + S8164452: 8u111 L10n resource file update - msgdrop 20 + S8165816: jarsigner -verify shows jar unsigned if it was signed with a weak algorithm + S8166381: Back out changes to the java.security file to not disable MD5 * Backports + S6604109, PR3162: javax.print.PrintServiceLookup.lookupPrintServices fails SOMETIMES for Cups + S6907252, PR3162: ZipFileInputStream Not Thread-Safe + S8024046, PR3162: Test sun/security/krb5/runNameEquals.sh failed on 7u45 Embedded linux-ppc* + S8028479, PR3162: runNameEquals still cannot precisely detect if a usable native krb5 is available + S8034057, PR3162: Files.getFileStore and Files.isWritable do not work with SUBST'ed drives (win) + S8038491, PR3162: Improve synchronization in ZipFile.read() + S8038502, PR3162: Deflater.needsInput() should use synchronization + S8059411, PR3162: RowSetWarning does not correctly chain warnings + S8062198, PR3162: Add RowSetMetaDataImpl Tests and add column range validation to isdefinitlyWritable + S8066188, PR3162: BaseRowSet returns the wrong default value for escape processing + S8072466, PR3162: Deadlock when initializing MulticastSocket and DatagramSocket + S8075118, PR3162: JVM stuck in infinite loop during verification + S8076579, PR3162: Popping a stack frame after exception breakpoint sets last method param to exception + S8078495, PR3162: End time checking for native TGT is wrong + S8078668, PR3162: jar usage string mentions unsupported option '-n' + S8080115, PR3162: (fs) Crash in libgio when calling Files.probeContentType(path) from parallel threads + S8081794, PR3162: ParsePosition getErrorIndex returns 0 for TimeZone parsing problem + S8129957, PR3162: Deadlock in JNDI LDAP implementation when closing the LDAP context + S8130136, PR3162: Swing window sometimes fails to repaint partially when it becomes exposed + S8130274, PR3162: java/nio/file/FileStore/Basic.java fails when two successive stores in an iteration are determined to be equal + S8132551, PR3162: Initialize local variables before returning them in p11_convert.c + S8133207, PR3162: [TEST_BUG] ParallelProbes.java test fails after changes for JDK-8080115 + S8133666, PR3162: OperatingSystemMXBean reports abnormally high machine CPU consumption on Linux + S8135002, PR3162: Fix or remove broken links in objectMonitor.cpp comments + S8137121, PR3162: (fc) Infinite loop FileChannel.truncate + S8137230, PR3162: TEST_BUG: java/nio/channels/FileChannel/LoopingTruncate.java timed out + S8139373, PR3162: [TEST_BUG] java/net/MulticastSocket/MultiDead.java failed with timeout + S8140249, PR3162: JVM Crashing During startUp If Flight Recording is enabled + S8141491, PR3160, G592292: Unaligned memory access in Bits.c + S8144483, PR3162: One long Safepoint pause directly after each GC log rotation + S8149611, PR3160, G592292: Add tests for Unsafe.copySwapMemory * Bug fixes + S8078628, PR3151: Zero build fails with pre-compiled headers disabled + PR3128: pax-mark-vm script calls "exit -1" which is invalid in dash + PR3131: PaX marking fails on filesystems which don't support extended attributes + PR3135: Makefile.am rule stamps/add/tzdata-support-debug.stamp has a typo in add-tzdata dependency + PR3141: Pass $(CC) and $(CXX) to OpenJDK build + PR3166: invalid zip timestamp handling leads to error building bootstrap-javac + PR3202: Update infinality configure test + PR3212: Disable ARM32 JIT by default * CACAO + PR3136: CACAO is broken due to 2 new native methods in sun.misc.Unsafe (from S8158260) * JamVM + PR3134: JamVM is broken due to 2 new native methods in sun.misc.Unsafe (from S8158260) * AArch64 port + S8167200, PR3204: AArch64: Broken stack pointer adjustment in interpreter + S8168888: Port 8160591: Improve internal array handling to AArch64. + PR3211: AArch64 build fails with pre-compiled headers disabled - Changed patch: * java-1_7_0-openjdk-gcc6.patch + Rediff to changed context - Disable arm32 JIT, since its build broken (http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2942) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1389=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.121-24.42.1 java-1_7_0-openjdk-accessibility-1.7.0.121-24.42.1 java-1_7_0-openjdk-debuginfo-1.7.0.121-24.42.1 java-1_7_0-openjdk-debugsource-1.7.0.121-24.42.1 java-1_7_0-openjdk-demo-1.7.0.121-24.42.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.121-24.42.1 java-1_7_0-openjdk-devel-1.7.0.121-24.42.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.121-24.42.1 java-1_7_0-openjdk-headless-1.7.0.121-24.42.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.121-24.42.1 java-1_7_0-openjdk-src-1.7.0.121-24.42.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.121-24.42.1 References: https://www.suse.com/security/cve/CVE-2016-5542.html https://www.suse.com/security/cve/CVE-2016-5554.html https://www.suse.com/security/cve/CVE-2016-5556.html https://www.suse.com/security/cve/CVE-2016-5568.html https://www.suse.com/security/cve/CVE-2016-5573.html https://www.suse.com/security/cve/CVE-2016-5582.html https://www.suse.com/security/cve/CVE-2016-5597.html https://bugzilla.suse.com/1005522 https://bugzilla.suse.com/1005523 https://bugzilla.suse.com/1005524 https://bugzilla.suse.com/1005525 https://bugzilla.suse.com/1005526 https://bugzilla.suse.com/1005527 https://bugzilla.suse.com/1005528

1 0

openSUSE-RU-2016:2989-1: Recommended update for clamav-database
by maintenance＠opensuse.org 03 Dec '16

03 Dec '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2989-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Nov. 28th 2016. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1388=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1388=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201611280004-9.1 - openSUSE Leap 42.1 (noarch): clamav-database-201611280004-188.1 References:

1 0

openSUSE-RU-2016:2986-1: moderate: Recommended update for gcc48
by maintenance＠opensuse.org 02 Dec '16

02 Dec '16

openSUSE Recommended Update: Recommended update for gcc48 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2986-1 Rating: moderate References: #988274 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: gcc48 was updated to fix the following issues: - gcc issues with armv7l (boo#988274) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1387=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cpp48-4.8.3+r212056-2.4.4 cpp48-debuginfo-4.8.3+r212056-2.4.4 gcc48-4.8.3+r212056-2.4.4 gcc48-ada-4.8.3+r212056-2.4.4 gcc48-ada-debuginfo-4.8.3+r212056-2.4.4 gcc48-c++-4.8.3+r212056-2.4.4 gcc48-c++-debuginfo-4.8.3+r212056-2.4.4 gcc48-debuginfo-4.8.3+r212056-2.4.4 gcc48-debugsource-4.8.3+r212056-2.4.4 gcc48-fortran-4.8.3+r212056-2.4.4 gcc48-fortran-debuginfo-4.8.3+r212056-2.4.4 gcc48-gij-4.8.3+r212056-2.4.4 gcc48-gij-debuginfo-4.8.3+r212056-2.4.4 gcc48-java-4.8.3+r212056-2.4.4 gcc48-java-debuginfo-4.8.3+r212056-2.4.4 gcc48-locale-4.8.3+r212056-2.4.4 gcc48-obj-c++-4.8.3+r212056-2.4.4 gcc48-obj-c++-debuginfo-4.8.3+r212056-2.4.4 gcc48-objc-4.8.3+r212056-2.4.4 gcc48-objc-debuginfo-4.8.3+r212056-2.4.4 libada48-4.8.3+r212056-2.4.4 libada48-debuginfo-4.8.3+r212056-2.4.4 libasan0-4.8.3+r212056-2.4.4 libasan0-debuginfo-4.8.3+r212056-2.4.4 libatomic1-4.8.3+r212056-2.4.4 libatomic1-debuginfo-4.8.3+r212056-2.4.4 libffi4-4.8.3+r212056-2.4.4 libffi4-debuginfo-4.8.3+r212056-2.4.4 libffi48-debugsource-4.8.3+r212056-2.4.4 libffi48-devel-4.8.3+r212056-2.4.4 libgcc_s1-4.8.3+r212056-2.4.4 libgcc_s1-debuginfo-4.8.3+r212056-2.4.4 libgcj48-4.8.3+r212056-2.4.4 libgcj48-debuginfo-4.8.3+r212056-2.4.4 libgcj48-debugsource-4.8.3+r212056-2.4.4 libgcj48-devel-4.8.3+r212056-2.4.4 libgcj48-devel-debuginfo-4.8.3+r212056-2.4.4 libgcj48-jar-4.8.3+r212056-2.4.4 libgcj_bc1-4.8.3+r212056-2.4.4 libgfortran3-4.8.3+r212056-2.4.4 libgfortran3-debuginfo-4.8.3+r212056-2.4.4 libgomp1-4.8.3+r212056-2.4.4 libgomp1-debuginfo-4.8.3+r212056-2.4.4 libitm1-4.8.3+r212056-2.4.4 libitm1-debuginfo-4.8.3+r212056-2.4.4 libobjc4-4.8.3+r212056-2.4.4 libobjc4-debuginfo-4.8.3+r212056-2.4.4 libquadmath0-4.8.3+r212056-2.4.4 libquadmath0-debuginfo-4.8.3+r212056-2.4.4 libstdc++48-devel-4.8.3+r212056-2.4.4 libstdc++6-4.8.3+r212056-2.4.4 libstdc++6-debuginfo-4.8.3+r212056-2.4.4 libstdc++6-locale-4.8.3+r212056-2.4.4 - openSUSE 13.2 (noarch): gcc48-info-4.8.3+r212056-2.4.4 libstdc++48-doc-4.8.3+r212056-2.4.4 - openSUSE 13.2 (x86_64): cross-aarch64-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-armv6hl-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-armv7hl-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-hppa-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-i386-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-ia64-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-ppc-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-ppc64-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-ppc64le-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-s390-gcc48-icecream-backend-4.8.3+r212056-2.4.4 cross-s390x-gcc48-icecream-backend-4.8.3+r212056-2.4.4 gcc48-32bit-4.8.3+r212056-2.4.4 gcc48-ada-32bit-4.8.3+r212056-2.4.4 gcc48-fortran-32bit-4.8.3+r212056-2.4.4 gcc48-gij-32bit-4.8.3+r212056-2.4.4 gcc48-gij-debuginfo-32bit-4.8.3+r212056-2.4.4 gcc48-objc-32bit-4.8.3+r212056-2.4.4 libada48-32bit-4.8.3+r212056-2.4.4 libada48-32bit-debuginfo-4.8.3+r212056-2.4.4 libasan0-32bit-4.8.3+r212056-2.4.4 libasan0-32bit-debuginfo-4.8.3+r212056-2.4.4 libatomic1-32bit-4.8.3+r212056-2.4.4 libatomic1-32bit-debuginfo-4.8.3+r212056-2.4.4 libffi4-32bit-4.8.3+r212056-2.4.4 libffi4-32bit-debuginfo-4.8.3+r212056-2.4.4 libffi48-devel-32bit-4.8.3+r212056-2.4.4 libgcc_s1-32bit-4.8.3+r212056-2.4.4 libgcc_s1-32bit-debuginfo-4.8.3+r212056-2.4.4 libgcj48-32bit-4.8.3+r212056-2.4.4 libgcj48-debuginfo-32bit-4.8.3+r212056-2.4.4 libgcj48-devel-32bit-4.8.3+r212056-2.4.4 libgcj48-devel-debuginfo-32bit-4.8.3+r212056-2.4.4 libgfortran3-32bit-4.8.3+r212056-2.4.4 libgfortran3-32bit-debuginfo-4.8.3+r212056-2.4.4 libgomp1-32bit-4.8.3+r212056-2.4.4 libgomp1-32bit-debuginfo-4.8.3+r212056-2.4.4 libitm1-32bit-4.8.3+r212056-2.4.4 libitm1-32bit-debuginfo-4.8.3+r212056-2.4.4 libobjc4-32bit-4.8.3+r212056-2.4.4 libobjc4-32bit-debuginfo-4.8.3+r212056-2.4.4 libquadmath0-32bit-4.8.3+r212056-2.4.4 libquadmath0-32bit-debuginfo-4.8.3+r212056-2.4.4 libstdc++48-devel-32bit-4.8.3+r212056-2.4.4 libstdc++6-32bit-4.8.3+r212056-2.4.4 libstdc++6-32bit-debuginfo-4.8.3+r212056-2.4.4 libtsan0-4.8.3+r212056-2.4.4 libtsan0-debuginfo-4.8.3+r212056-2.4.4 References: https://bugzilla.suse.com/988274

1 0