December 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:3311-1: Recommended update for btrfsprogs
by maintenance＠opensuse.org 31 Dec '16

31 Dec '16

openSUSE Recommended Update: Recommended update for btrfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3311-1 Rating: low References: #912170 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for btrfsprogs fixes the following issues: bsc#912170: Boot may fail with BTRFS RAID1 array as /home - open ctree failed. 64-btrfs-dm.rules was moved to btrfs-udev-rules Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1532=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): btrfsprogs-3.12-4.25.1 btrfsprogs-debuginfo-3.12-4.25.1 btrfsprogs-debugsource-3.12-4.25.1 libbtrfs-devel-3.12-4.25.1 libbtrfs0-3.12-4.25.1 libbtrfs0-debuginfo-3.12-4.25.1 - openSUSE 13.1 (noarch): btrfsprogs-udev-rules-3.12-4.25.1 References: https://bugzilla.suse.com/912170

1 0

openSUSE-SU-2016:3310-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 31 Dec '16

31 Dec '16

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3310-1 Rating: important References: #1011922 #1015422 Cross-References: CVE-2016-9080 CVE-2016-9893 CVE-2016-9894 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9903 CVE-2016-9904 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities: - CVE-2016-9894: Buffer overflow in SkiaGL - CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements - CVE-2016-9895: CSP bypass using marquee tag - CVE-2016-9896: Use-after-free with WebVR - CVE-2016-9897: Memory corruption in libGLES - CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees - CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs - CVE-2016-9904: Cross-origin information leak in shared atoms - CVE-2016-9901: Data from Pocket server improperly sanitized before execution - CVE-2016-9902: Pocket extension does not validate the origin of events - CVE-2016-9903: XSS injection vulnerability in add-ons SDK - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1 - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 The following bugs were fixed: - boo#1011922: fix crash after a few seconds of usage on AArch64 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1534=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-50.1.0-134.1 MozillaFirefox-branding-upstream-50.1.0-134.1 MozillaFirefox-buildsymbols-50.1.0-134.1 MozillaFirefox-debuginfo-50.1.0-134.1 MozillaFirefox-debugsource-50.1.0-134.1 MozillaFirefox-devel-50.1.0-134.1 MozillaFirefox-translations-common-50.1.0-134.1 MozillaFirefox-translations-other-50.1.0-134.1 References: https://www.suse.com/security/cve/CVE-2016-9080.html https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9894.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9896.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9901.html https://www.suse.com/security/cve/CVE-2016-9902.html https://www.suse.com/security/cve/CVE-2016-9903.html https://www.suse.com/security/cve/CVE-2016-9904.html https://bugzilla.suse.com/1011922 https://bugzilla.suse.com/1015422

1 0

openSUSE-SU-2016:3309-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 31 Dec '16

31 Dec '16

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3309-1 Rating: important References: #1001856 #1012493 #982003 Cross-References: CVE-2016-5103 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for roundcubemail fixes the following issues: - A maliciously crafted email could cause untrusted code to be executed (cross site scripting using $lt;area href=javascript:...>) (boo#982003, CVE-2016-5103) - Avoid HTML styles that could cause potential click jacking (boo#1001856) - A maliciously crafted FROM value could cause extra parameters to be passed to the sendmail command (boo#1012493) - Avoid sending completely empty text parts for multipart/alternative messages - Don't create multipart/alternative messages with empty text/plain part - Improved validation of FROM argument when sending mails Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1533=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): roundcubemail-1.0.9-2.36.1 References: https://www.suse.com/security/cve/CVE-2016-5103.html https://bugzilla.suse.com/1001856 https://bugzilla.suse.com/1012493 https://bugzilla.suse.com/982003

1 0

openSUSE-SU-2016:3308-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 30 Dec '16

30 Dec '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3308-1 Rating: moderate References: #1015422 Cross-References: CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9904 CVE-2016-9905 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update to Mozilla Thunderbird 45.6.0 fixes security issues and bugs. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. The following vulnerabilities were fixed: (boo#1015422) - CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements - CVE-2016-9895: CSP bypass using marquee tag - CVE-2016-9897: Memory corruption in libGLES - CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees - CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs - CVE-2016-9904: Cross-origin information leak in shared atoms - CVE-2016-9905: Crash in EnumerateSubDocuments - CVE-2016-9893: Memory safety bugs fixed in Thunderbird 45.6 The following bugs were fixed: - The system integration dialog was shown every time when starting Thunderbird Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1531=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): MozillaThunderbird-45.6.0-20.1 MozillaThunderbird-debuginfo-45.6.0-20.1 MozillaThunderbird-debugsource-45.6.0-20.1 MozillaThunderbird-devel-45.6.0-20.1 MozillaThunderbird-translations-common-45.6.0-20.1 MozillaThunderbird-translations-other-45.6.0-20.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-buildsymbols-45.6.0-20.1 References: https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9904.html https://www.suse.com/security/cve/CVE-2016-9905.html https://bugzilla.suse.com/1015422

1 0

openSUSE-SU-2016:3307-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 30 Dec '16

30 Dec '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3307-1 Rating: moderate References: #1015422 Cross-References: CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9904 CVE-2016-9905 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update to Mozilla Thunderbird 45.6.0 fixes security issues and bugs. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. The following vulnerabilities were fixed: (boo#1015422) - CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements - CVE-2016-9895: CSP bypass using marquee tag - CVE-2016-9897: Memory corruption in libGLES - CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees - CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs - CVE-2016-9904: Cross-origin information leak in shared atoms - CVE-2016-9905: Crash in EnumerateSubDocuments - CVE-2016-9893: Memory safety bugs fixed in Thunderbird 45.6 The following bugs were fixed: - The system integration dialog was shown every time when starting Thunderbird Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1531=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1531=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1531=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaThunderbird-45.6.0-31.1 MozillaThunderbird-buildsymbols-45.6.0-31.1 MozillaThunderbird-debuginfo-45.6.0-31.1 MozillaThunderbird-debugsource-45.6.0-31.1 MozillaThunderbird-devel-45.6.0-31.1 MozillaThunderbird-translations-common-45.6.0-31.1 MozillaThunderbird-translations-other-45.6.0-31.1 - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-45.6.0-31.1 MozillaThunderbird-buildsymbols-45.6.0-31.1 MozillaThunderbird-debuginfo-45.6.0-31.1 MozillaThunderbird-debugsource-45.6.0-31.1 MozillaThunderbird-devel-45.6.0-31.1 MozillaThunderbird-translations-common-45.6.0-31.1 MozillaThunderbird-translations-other-45.6.0-31.1 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-45.6.0-58.1 MozillaThunderbird-buildsymbols-45.6.0-58.1 MozillaThunderbird-debuginfo-45.6.0-58.1 MozillaThunderbird-debugsource-45.6.0-58.1 MozillaThunderbird-devel-45.6.0-58.1 MozillaThunderbird-translations-common-45.6.0-58.1 MozillaThunderbird-translations-other-45.6.0-58.1 References: https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9904.html https://www.suse.com/security/cve/CVE-2016-9905.html https://bugzilla.suse.com/1015422

1 0

openSUSE-RU-2016:3302-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 30 Dec '16

30 Dec '16

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3302-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for opera fixes the following issues: - Fix a crash in KeyStorageKeyring::GetKey. - Fix a crash at opera::BookmarkMenuDelegate. - Port Chromium's fix for a content::TextInputClientObserver::GetFocusedPepperPlugin crash to desktop-stable-55-2393. - Update Chromium to version 55.0.2883.87. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2016-1530=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2016-1530=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-42.0.2393.94-12.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-42.0.2393.94-49.1 References:

1 0

openSUSE-SU-2016:3285-1: Security update for irc-otr
by opensuse-security＠opensuse.org 28 Dec '16

28 Dec '16

openSUSE Security Update: Security update for irc-otr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3285-1 Rating: low References: #1016942 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This updates irc-otr to version 1.0.2 and fixes the following issues: - Only the first line of messages transmitted via OTR sessions was a PRIVMSG and additional data was sent as a raw command to the IRC server (boo#1016942). - Detect the libotr-emitted HTML-formatted init string and replace it with a description customized for IRC and irssi-otr. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1529=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): irc-otr-debugsource-1.0.2-3.1 irssi-otr-1.0.2-3.1 irssi-otr-debuginfo-1.0.2-3.1 References: https://bugzilla.suse.com/1016942

1 0

openSUSE-RU-2016:3284-1: moderate: Recommended update for bitcoin
by maintenance＠opensuse.org 28 Dec '16

28 Dec '16

openSUSE Recommended Update: Recommended update for bitcoin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3284-1 Rating: moderate References: #1016094 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The bitcoin client was updated to version 0.13.1, to sync up with current protocol changes and bugfixes. (boo#1016094) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1528=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1528=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): bitcoin-debugsource-0.13.1-3.1 bitcoin-qt5-0.13.1-3.1 bitcoin-qt5-debuginfo-0.13.1-3.1 bitcoin-test-0.13.1-3.1 bitcoin-test-debuginfo-0.13.1-3.1 bitcoin-utils-0.13.1-3.1 bitcoin-utils-debuginfo-0.13.1-3.1 bitcoind-0.13.1-3.1 bitcoind-debuginfo-0.13.1-3.1 libbitcoinconsensus-devel-0.13.1-3.1 libbitcoinconsensus0-0.13.1-3.1 libbitcoinconsensus0-debuginfo-0.13.1-3.1 - openSUSE Leap 42.1 (i586 x86_64): bitcoin-debugsource-0.13.1-6.1 bitcoin-qt5-0.13.1-6.1 bitcoin-qt5-debuginfo-0.13.1-6.1 bitcoin-test-0.13.1-6.1 bitcoin-test-debuginfo-0.13.1-6.1 bitcoin-utils-0.13.1-6.1 bitcoin-utils-debuginfo-0.13.1-6.1 bitcoind-0.13.1-6.1 bitcoind-debuginfo-0.13.1-6.1 libbitcoinconsensus-devel-0.13.1-6.1 libbitcoinconsensus0-0.13.1-6.1 libbitcoinconsensus0-debuginfo-0.13.1-6.1 References: https://bugzilla.suse.com/1016094

1 0

openSUSE-SU-2016:3282-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 28 Dec '16

28 Dec '16

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3282-1 Rating: moderate References: #1005292 #1016343 Cross-References: CVE-2016-1254 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for tor updates to version 0.2.8.12 and fixes the following issues: - a hostile hidden service could cause tor clients to crash (boo#1016343, CVE-2016-1254) - updated fallback directory list - updated geoip and geoip6 to the December 7 2016 Maxmind GeoLite2 Country database. - When Tor leaves standby because of a new application request, open circuits as needed to serve that request - Clients now respond to new application stream requests immediately when they arrive, rather than waiting up to one second before starting to handle them Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1526=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): tor-0.2.8.12-3.1 tor-debuginfo-0.2.8.12-3.1 tor-debugsource-0.2.8.12-3.1 References: https://www.suse.com/security/cve/CVE-2016-1254.html https://bugzilla.suse.com/1005292 https://bugzilla.suse.com/1016343

1 0

openSUSE-SU-2016:3281-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 28 Dec '16

28 Dec '16

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3281-1 Rating: moderate References: #1016343 Cross-References: CVE-2016-1254 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor fixes the following issues: - a hostile hidden service could cause tor clients to crash (boo#1016343, CVE-2016-1254) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1527=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1527=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): tor-0.2.7.6-16.1 tor-debuginfo-0.2.7.6-16.1 tor-debugsource-0.2.7.6-16.1 - openSUSE 13.2 (i586 x86_64): tor-0.2.7.6-29.1 tor-debuginfo-0.2.7.6-29.1 tor-debugsource-0.2.7.6-29.1 References: https://www.suse.com/security/cve/CVE-2016-1254.html https://bugzilla.suse.com/1016343

1 0

openSUSE-SU-2016:3280-1: moderate: Security update for ntp
by opensuse-security＠opensuse.org 28 Dec '16

28 Dec '16

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3280-1 Rating: moderate References: #1009434 #1011377 #1011390 #1011395 #1011398 #1011404 #1011406 #1011411 #1011417 #943216 #956365 #981252 #988028 #992038 #992606 Cross-References: CVE-2015-5219 CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7429 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 5 fixes is now available. Description: This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed: - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: Null pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed: - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in "trap" (bsc#981252). - Reduce the number of netlink groups to listen on for changes to the local network setup (bsc#992606). - Fix segfault in "sntp -a" (bsc#1009434). - Silence an OpenSSL version warning (bsc#992038). - Make the resolver task change user and group IDs to the same values as the main task. (bsc#988028) - Simplify ntpd's search for its own executable to prevent AppArmor warnings (bsc#956365). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1525=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1525=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ntp-4.2.8p9-27.1 ntp-debuginfo-4.2.8p9-27.1 ntp-debugsource-4.2.8p9-27.1 ntp-doc-4.2.8p9-27.1 - openSUSE Leap 42.1 (i586 x86_64): ntp-4.2.8p9-27.1 ntp-debuginfo-4.2.8p9-27.1 ntp-debugsource-4.2.8p9-27.1 ntp-doc-4.2.8p9-27.1 References: https://www.suse.com/security/cve/CVE-2015-5219.html https://www.suse.com/security/cve/CVE-2016-7426.html https://www.suse.com/security/cve/CVE-2016-7427.html https://www.suse.com/security/cve/CVE-2016-7428.html https://www.suse.com/security/cve/CVE-2016-7429.html https://www.suse.com/security/cve/CVE-2016-7431.html https://www.suse.com/security/cve/CVE-2016-7433.html https://www.suse.com/security/cve/CVE-2016-7434.html https://www.suse.com/security/cve/CVE-2016-9310.html https://www.suse.com/security/cve/CVE-2016-9311.html https://bugzilla.suse.com/1009434 https://bugzilla.suse.com/1011377 https://bugzilla.suse.com/1011390 https://bugzilla.suse.com/1011395 https://bugzilla.suse.com/1011398 https://bugzilla.suse.com/1011404 https://bugzilla.suse.com/1011406 https://bugzilla.suse.com/1011411 https://bugzilla.suse.com/1011417 https://bugzilla.suse.com/943216 https://bugzilla.suse.com/956365 https://bugzilla.suse.com/981252 https://bugzilla.suse.com/988028 https://bugzilla.suse.com/992038 https://bugzilla.suse.com/992606

1 0

openSUSE-RU-2016:3279-1: Recommended update for ninja
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Recommended Update: Recommended update for ninja ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3279-1 Rating: low References: #1014177 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ninja fixes the following issues: - boo#1014177: backported rpm macros were added to the package Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1522=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1522=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ninja-1.6.0-7.1 ninja-debuginfo-1.6.0-7.1 ninja-debugsource-1.6.0-7.1 - openSUSE 13.2 (i586 x86_64): ninja-1.5.1-3.1 ninja-debuginfo-1.5.1-3.1 ninja-debugsource-1.5.1-3.1 References: https://bugzilla.suse.com/1014177

1 0

openSUSE-RU-2016:3278-1: Recommended update for ninja
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Recommended Update: Recommended update for ninja ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3278-1 Rating: low References: #1014177 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ninja fixes the following issues: - boo#1014177: backported rpm macros were added to the package Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1522=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ninja-1.7.2-7.1 ninja-debuginfo-1.7.2-7.1 ninja-debugsource-1.7.2-7.1 References: https://bugzilla.suse.com/1014177

1 0

openSUSE-OU-2016:3277-1: Initial update for docker-compose
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Optional Update: Initial update for docker-compose ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:3277-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update provides docker-compose for the SUSE Linux Enterprise Package Hub 12. Compose is a tool for defining and running complex applications with Docker. With Compose, you define a multi-container application in a single file, then spin your application up in a single command which does everything that needs to be done to get it running. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1523=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): docker-compose-1.8.1-2.1 References:

1 0

openSUSE-OU-2016:3276-1: moderate: Add a number of Ruby Gems to the SUSE Package Hub
by maintenance＠opensuse.org 27 Dec '16

27 Dec '16

openSUSE Optional Update: Add a number of Ruby Gems to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:3276-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This updates makes available the following ruby gems: - rubygem-addressable 2.4.0 - rubygem-cleanroom 1.0.0 - rubygem-diff-lcs 1.2.5 - rubygem-erubis 2.7.0 - rubygem-json 2.0.2 - rubygem-multipart-post 2.0.0 - rubygem-nio4r 1.2.1 Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1524=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ruby2.1-rubygem-addressable-2.4.0-2.1 ruby2.1-rubygem-addressable-doc-2.4.0-2.1 ruby2.1-rubygem-addressable-testsuite-2.4.0-2.1 ruby2.1-rubygem-cleanroom-1.0.0-2.1 ruby2.1-rubygem-cleanroom-doc-1.0.0-2.1 ruby2.1-rubygem-cleanroom-testsuite-1.0.0-2.1 ruby2.1-rubygem-diff-lcs-1.2.5-2.1 ruby2.1-rubygem-diff-lcs-doc-1.2.5-2.1 ruby2.1-rubygem-diff-lcs-testsuite-1.2.5-2.1 ruby2.1-rubygem-erubis-2.7.0-2.1 ruby2.1-rubygem-erubis-doc-2.7.0-2.1 ruby2.1-rubygem-erubis-testsuite-2.7.0-2.1 ruby2.1-rubygem-json-2.0.2-2.1 ruby2.1-rubygem-json-debuginfo-2.0.2-2.1 ruby2.1-rubygem-json-doc-2.0.2-2.1 ruby2.1-rubygem-multipart-post-2.0.0-2.1 ruby2.1-rubygem-multipart-post-doc-2.0.0-2.1 ruby2.1-rubygem-multipart-post-testsuite-2.0.0-2.1 ruby2.1-rubygem-nio4r-1.2.1-2.1 ruby2.1-rubygem-nio4r-debuginfo-1.2.1-2.1 ruby2.1-rubygem-nio4r-doc-1.2.1-2.1 ruby2.1-rubygem-nio4r-testsuite-1.2.1-2.1 rubygem-json-debugsource-2.0.2-2.1 rubygem-nio4r-debugsource-1.2.1-2.1 References:

1 0

openSUSE-RU-2016:3263-1: important: Recommended update for tar
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for tar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3263-1 Rating: important References: #1012633 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tar fixes the following issues: - the previous version of tar fixed a security issue "POINTYFEATHER" (CVE-2016-6321, boo#1007188). This fix introduced a regression in functionality. It was not possible any more to add files an archive that contained '..' components (boo#1012633). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1518=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tar-1.28-2.22.1 tar-backup-scripts-1.28-2.22.1 tar-debuginfo-1.28-2.22.1 tar-debugsource-1.28-2.22.1 tar-tests-1.28-2.22.1 tar-tests-debuginfo-1.28-2.22.1 - openSUSE 13.2 (noarch): tar-lang-1.28-2.22.1 References: https://bugzilla.suse.com/1012633

1 0

openSUSE-RU-2016:3262-1: moderate: Recommended update for suse-build-key
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for suse-build-key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3262-1 Rating: moderate References: #1014151 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-build-key extends the lifetime of the build(a)suse.de GPG key that is signing the SUSE Linux Enterprise 12 repositories. (bsc#1014151) UID: pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build(a)suse.de> This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1521=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1521=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): suse-build-key-12.0-10.1 - openSUSE Leap 42.1 (noarch): suse-build-key-12.0-9.1 References: https://bugzilla.suse.com/1014151

1 0

openSUSE-RU-2016:3261-1: important: Recommended update for tar
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for tar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3261-1 Rating: important References: #1012633 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tar fixes a regression caused by the previous security update (bsc#1007188), which limited append and create operations (bsc#1012633) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1517=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1517=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): tar-1.27.1-11.1 tar-backup-scripts-1.27.1-11.1 tar-debuginfo-1.27.1-11.1 tar-debugsource-1.27.1-11.1 tar-tests-1.27.1-11.1 tar-tests-debuginfo-1.27.1-11.1 - openSUSE Leap 42.2 (noarch): tar-lang-1.27.1-11.1 - openSUSE Leap 42.1 (i586 x86_64): tar-1.27.1-12.1 tar-backup-scripts-1.27.1-12.1 tar-debuginfo-1.27.1-12.1 tar-debugsource-1.27.1-12.1 tar-tests-1.27.1-12.1 tar-tests-debuginfo-1.27.1-12.1 - openSUSE Leap 42.1 (noarch): tar-lang-1.27.1-12.1 References: https://bugzilla.suse.com/1012633

1 0

openSUSE-RU-2016:3260-1: moderate: Recommended update for shim
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for shim ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3260-1 Rating: moderate References: #985568 #999818 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for shim fixes the following issues: - Update shim-install to support "--no-nvram" and improve removable media and fallback mode handling. (boo#985568, boo#999818) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1519=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): shim-0.9-13.1 shim-debuginfo-0.9-13.1 shim-debugsource-0.9-13.1 References: https://bugzilla.suse.com/985568 https://bugzilla.suse.com/999818

1 0

openSUSE-RU-2016:3259-1: important: Recommended update for JHBuild
by maintenance＠opensuse.org 23 Dec '16

23 Dec '16

openSUSE Recommended Update: Recommended update for JHBuild ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3259-1 Rating: important References: #1015410 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to JHBuild fixes the following issues: - JHBuild would not work correctly with libdir being /usr/lib64 (bsc#1015410) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1520=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): jhbuild-3.16.0~20150323-7.1 jhbuild-debuginfo-3.16.0~20150323-7.1 jhbuild-debugsource-3.16.0~20150323-7.1 jhbuild-recommended-deps-3.16.0~20150323-7.1 - openSUSE Leap 42.2 (noarch): jhbuild-lang-3.16.0~20150323-7.1 References: https://bugzilla.suse.com/1015410

1 0

openSUSE-RU-2016:3240-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3240-1 Rating: moderate References: #1011158 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Update Intel PCI IDs for modesetting to include Broxton 2x6. (boo#1011158) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1506=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xorg-x11-server-7.6_1.18.3-7.1 xorg-x11-server-debuginfo-7.6_1.18.3-7.1 xorg-x11-server-debugsource-7.6_1.18.3-7.1 xorg-x11-server-extra-7.6_1.18.3-7.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-7.1 xorg-x11-server-sdk-7.6_1.18.3-7.1 xorg-x11-server-source-7.6_1.18.3-7.1 References: https://bugzilla.suse.com/1011158

1 0

openSUSE-SU-2016:3239-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3239-1 Rating: moderate References: #1015187 #1015188 #1015189 Cross-References: CVE-2016-9933 CVE-2016-9934 CVE-2016-9935 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This security update for php5 fixes the following issues: - a call to ImageFillToBorder() could cause a stack overflow leading to stack exhaustion when the image used was not truecolor (CVE-2016-9933, boo#1015187) - deserialization of a WDDX packet containing a PDORow object could crash php (CVE-2016-9934, boo#1015188) - deserialization of a WDDX packet containing an empty boolean element could crash php (CVE-2016-9935, boo#1015189) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1505=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-89.1 apache2-mod_php5-debuginfo-5.6.1-89.1 php5-5.6.1-89.1 php5-bcmath-5.6.1-89.1 php5-bcmath-debuginfo-5.6.1-89.1 php5-bz2-5.6.1-89.1 php5-bz2-debuginfo-5.6.1-89.1 php5-calendar-5.6.1-89.1 php5-calendar-debuginfo-5.6.1-89.1 php5-ctype-5.6.1-89.1 php5-ctype-debuginfo-5.6.1-89.1 php5-curl-5.6.1-89.1 php5-curl-debuginfo-5.6.1-89.1 php5-dba-5.6.1-89.1 php5-dba-debuginfo-5.6.1-89.1 php5-debuginfo-5.6.1-89.1 php5-debugsource-5.6.1-89.1 php5-devel-5.6.1-89.1 php5-dom-5.6.1-89.1 php5-dom-debuginfo-5.6.1-89.1 php5-enchant-5.6.1-89.1 php5-enchant-debuginfo-5.6.1-89.1 php5-exif-5.6.1-89.1 php5-exif-debuginfo-5.6.1-89.1 php5-fastcgi-5.6.1-89.1 php5-fastcgi-debuginfo-5.6.1-89.1 php5-fileinfo-5.6.1-89.1 php5-fileinfo-debuginfo-5.6.1-89.1 php5-firebird-5.6.1-89.1 php5-firebird-debuginfo-5.6.1-89.1 php5-fpm-5.6.1-89.1 php5-fpm-debuginfo-5.6.1-89.1 php5-ftp-5.6.1-89.1 php5-ftp-debuginfo-5.6.1-89.1 php5-gd-5.6.1-89.1 php5-gd-debuginfo-5.6.1-89.1 php5-gettext-5.6.1-89.1 php5-gettext-debuginfo-5.6.1-89.1 php5-gmp-5.6.1-89.1 php5-gmp-debuginfo-5.6.1-89.1 php5-iconv-5.6.1-89.1 php5-iconv-debuginfo-5.6.1-89.1 php5-imap-5.6.1-89.1 php5-imap-debuginfo-5.6.1-89.1 php5-intl-5.6.1-89.1 php5-intl-debuginfo-5.6.1-89.1 php5-json-5.6.1-89.1 php5-json-debuginfo-5.6.1-89.1 php5-ldap-5.6.1-89.1 php5-ldap-debuginfo-5.6.1-89.1 php5-mbstring-5.6.1-89.1 php5-mbstring-debuginfo-5.6.1-89.1 php5-mcrypt-5.6.1-89.1 php5-mcrypt-debuginfo-5.6.1-89.1 php5-mssql-5.6.1-89.1 php5-mssql-debuginfo-5.6.1-89.1 php5-mysql-5.6.1-89.1 php5-mysql-debuginfo-5.6.1-89.1 php5-odbc-5.6.1-89.1 php5-odbc-debuginfo-5.6.1-89.1 php5-opcache-5.6.1-89.1 php5-opcache-debuginfo-5.6.1-89.1 php5-openssl-5.6.1-89.1 php5-openssl-debuginfo-5.6.1-89.1 php5-pcntl-5.6.1-89.1 php5-pcntl-debuginfo-5.6.1-89.1 php5-pdo-5.6.1-89.1 php5-pdo-debuginfo-5.6.1-89.1 php5-pgsql-5.6.1-89.1 php5-pgsql-debuginfo-5.6.1-89.1 php5-phar-5.6.1-89.1 php5-phar-debuginfo-5.6.1-89.1 php5-posix-5.6.1-89.1 php5-posix-debuginfo-5.6.1-89.1 php5-pspell-5.6.1-89.1 php5-pspell-debuginfo-5.6.1-89.1 php5-readline-5.6.1-89.1 php5-readline-debuginfo-5.6.1-89.1 php5-shmop-5.6.1-89.1 php5-shmop-debuginfo-5.6.1-89.1 php5-snmp-5.6.1-89.1 php5-snmp-debuginfo-5.6.1-89.1 php5-soap-5.6.1-89.1 php5-soap-debuginfo-5.6.1-89.1 php5-sockets-5.6.1-89.1 php5-sockets-debuginfo-5.6.1-89.1 php5-sqlite-5.6.1-89.1 php5-sqlite-debuginfo-5.6.1-89.1 php5-suhosin-5.6.1-89.1 php5-suhosin-debuginfo-5.6.1-89.1 php5-sysvmsg-5.6.1-89.1 php5-sysvmsg-debuginfo-5.6.1-89.1 php5-sysvsem-5.6.1-89.1 php5-sysvsem-debuginfo-5.6.1-89.1 php5-sysvshm-5.6.1-89.1 php5-sysvshm-debuginfo-5.6.1-89.1 php5-tidy-5.6.1-89.1 php5-tidy-debuginfo-5.6.1-89.1 php5-tokenizer-5.6.1-89.1 php5-tokenizer-debuginfo-5.6.1-89.1 php5-wddx-5.6.1-89.1 php5-wddx-debuginfo-5.6.1-89.1 php5-xmlreader-5.6.1-89.1 php5-xmlreader-debuginfo-5.6.1-89.1 php5-xmlrpc-5.6.1-89.1 php5-xmlrpc-debuginfo-5.6.1-89.1 php5-xmlwriter-5.6.1-89.1 php5-xmlwriter-debuginfo-5.6.1-89.1 php5-xsl-5.6.1-89.1 php5-xsl-debuginfo-5.6.1-89.1 php5-zip-5.6.1-89.1 php5-zip-debuginfo-5.6.1-89.1 php5-zlib-5.6.1-89.1 php5-zlib-debuginfo-5.6.1-89.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-89.1 References: https://www.suse.com/security/cve/CVE-2016-9933.html https://www.suse.com/security/cve/CVE-2016-9934.html https://www.suse.com/security/cve/CVE-2016-9935.html https://bugzilla.suse.com/1015187 https://bugzilla.suse.com/1015188 https://bugzilla.suse.com/1015189

1 0

openSUSE-SU-2016:3238-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3238-1 Rating: moderate References: #1009318 #1013640 Cross-References: CVE-2016-8866 CVE-2016-9830 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This security update for GraphicsMagick fixes the following issues: - a memory allocation failure was fixed (CVE-2016-8866, boo#1009318) - maliciously crafted jng files could crash the identify utility (CVE-2016-9830, boo#1013640) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1511=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1511=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1511=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-6.1 GraphicsMagick-debuginfo-1.3.25-6.1 GraphicsMagick-debugsource-1.3.25-6.1 GraphicsMagick-devel-1.3.25-6.1 libGraphicsMagick++-Q16-12-1.3.25-6.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-6.1 libGraphicsMagick++-devel-1.3.25-6.1 libGraphicsMagick-Q16-3-1.3.25-6.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-6.1 libGraphicsMagick3-config-1.3.25-6.1 libGraphicsMagickWand-Q16-2-1.3.25-6.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-6.1 perl-GraphicsMagick-1.3.25-6.1 perl-GraphicsMagick-debuginfo-1.3.25-6.1 - openSUSE Leap 42.1 (i586 x86_64): GraphicsMagick-1.3.21-23.1 GraphicsMagick-debuginfo-1.3.21-23.1 GraphicsMagick-debugsource-1.3.21-23.1 GraphicsMagick-devel-1.3.21-23.1 libGraphicsMagick++-Q16-11-1.3.21-23.1 libGraphicsMagick++-Q16-11-debuginfo-1.3.21-23.1 libGraphicsMagick++-devel-1.3.21-23.1 libGraphicsMagick-Q16-3-1.3.21-23.1 libGraphicsMagick-Q16-3-debuginfo-1.3.21-23.1 libGraphicsMagick3-config-1.3.21-23.1 libGraphicsMagickWand-Q16-2-1.3.21-23.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.21-23.1 perl-GraphicsMagick-1.3.21-23.1 perl-GraphicsMagick-debuginfo-1.3.21-23.1 - openSUSE 13.2 (i586 x86_64): GraphicsMagick-1.3.20-21.1 GraphicsMagick-debuginfo-1.3.20-21.1 GraphicsMagick-debugsource-1.3.20-21.1 GraphicsMagick-devel-1.3.20-21.1 libGraphicsMagick++-Q16-3-1.3.20-21.1 libGraphicsMagick++-Q16-3-debuginfo-1.3.20-21.1 libGraphicsMagick++-devel-1.3.20-21.1 libGraphicsMagick-Q16-3-1.3.20-21.1 libGraphicsMagick-Q16-3-debuginfo-1.3.20-21.1 libGraphicsMagick3-config-1.3.20-21.1 libGraphicsMagickWand-Q16-2-1.3.20-21.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.20-21.1 perl-GraphicsMagick-1.3.20-21.1 perl-GraphicsMagick-debuginfo-1.3.20-21.1 References: https://www.suse.com/security/cve/CVE-2016-8866.html https://www.suse.com/security/cve/CVE-2016-9830.html https://bugzilla.suse.com/1009318 https://bugzilla.suse.com/1013640

1 0

openSUSE-SU-2016:3237-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3237-1 Rating: moderate References: #1000345 #1000346 #1001151 #1002116 #1002549 #1002550 #1002557 #1003612 #1003613 #1003878 #1003893 #1003894 #1004702 #1004706 #1004707 #1005353 #1005374 #1006536 #1006538 #1007391 #1007493 #1007494 #1007495 #1007769 #1008148 #998516 Cross-References: CVE-2016-7161 CVE-2016-7170 CVE-2016-7422 CVE-2016-7466 CVE-2016-7907 CVE-2016-7908 CVE-2016-7909 CVE-2016-7994 CVE-2016-7995 CVE-2016-8576 CVE-2016-8577 CVE-2016-8578 CVE-2016-8667 CVE-2016-8668 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9101 CVE-2016-9104 CVE-2016-9105 CVE-2016-9106 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 21 vulnerabilities and has 5 fixes is now available. Description: This update for qemu to version 2.6.2 fixes the several issues. These security issues were fixed: - CVE-2016-7161: Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allowed attackers to execute arbitrary code on the QEMU host via a large ethlite packet (bsc#1001151). - CVE-2016-7170: OOB stack memory access when processing svga command (bsc#998516). - CVE-2016-7466: xhci memory leakage during device unplug (bsc#1000345). - CVE-2016-7422: NULL pointer dereference in virtqueu_map_desc (bsc#1000346). - CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1002550). - CVE-2016-7995: Memory leak in ehci_process_itd (bsc#1003612). - CVE-2016-8576: The xhci_ring_fetch function in hw/usb/hcd-xhci.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process (bsc#1003878). - CVE-2016-8578: The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c allowed local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation (bsc#1003894). - CVE-2016-9105: Memory leakage in v9fs_link (bsc#1007494). - CVE-2016-8577: Memory leak in the v9fs_read function in hw/9pfs/9p.c allowed local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation (bsc#1003893). - CVE-2016-9106: Memory leakage in v9fs_write (bsc#1007495). - CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1004707). - CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1002557). - CVE-2016-9101: eepro100 memory leakage whern unplugging a device (bsc#1007391). - CVE-2016-8668: The rocker_io_writel function in hw/net/rocker/rocker.c allowed local guest OS administrators to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging failure to limit DMA buffer size (bsc#1004706). - CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1006538). - CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1006536). - CVE-2016-7994: Memory leak in virtio_gpu_resource_create_2d (bsc#1003613). - CVE-2016-9104: Integer overflow leading to OOB access in 9pfs (bsc#1007493). - CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1004702). - CVE-2016-7907: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1002549). These non-security issues were fixed: - Change kvm-supported.txt to be per-architecture documentation, stored in the package documentation directory of each per-arch package (bsc#1005353). - Update support doc to include current ARM64 (AArch64) support stance (bsc#1005374). - Fix migration failure when snapshot also has been done (bsc#1008148). - Change package post script udevadm trigger calls to be device specific (bsc#1002116). - Add qmp-commands.txt documentation file back in. It was inadvertently dropped. - Add an x86 cpu option (l3-cache) to specify that an L3 cache is present and another option (cpuid-0xb) to enable the cpuid 0xb leaf (bsc#1007769). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1504=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): qemu-2.6.2-23.1 qemu-arm-2.6.2-23.1 qemu-arm-debuginfo-2.6.2-23.1 qemu-block-curl-2.6.2-23.1 qemu-block-curl-debuginfo-2.6.2-23.1 qemu-block-dmg-2.6.2-23.1 qemu-block-dmg-debuginfo-2.6.2-23.1 qemu-block-iscsi-2.6.2-23.1 qemu-block-iscsi-debuginfo-2.6.2-23.1 qemu-block-ssh-2.6.2-23.1 qemu-block-ssh-debuginfo-2.6.2-23.1 qemu-debugsource-2.6.2-23.1 qemu-extra-2.6.2-23.1 qemu-extra-debuginfo-2.6.2-23.1 qemu-guest-agent-2.6.2-23.1 qemu-guest-agent-debuginfo-2.6.2-23.1 qemu-kvm-2.6.2-23.1 qemu-lang-2.6.2-23.1 qemu-linux-user-2.6.2-23.1 qemu-linux-user-debuginfo-2.6.2-23.1 qemu-linux-user-debugsource-2.6.2-23.1 qemu-ppc-2.6.2-23.1 qemu-ppc-debuginfo-2.6.2-23.1 qemu-s390-2.6.2-23.1 qemu-s390-debuginfo-2.6.2-23.1 qemu-testsuite-2.6.2-23.1 qemu-tools-2.6.2-23.1 qemu-tools-debuginfo-2.6.2-23.1 qemu-x86-2.6.2-23.1 qemu-x86-debuginfo-2.6.2-23.1 - openSUSE Leap 42.2 (x86_64): qemu-block-rbd-2.6.2-23.1 qemu-block-rbd-debuginfo-2.6.2-23.1 - openSUSE Leap 42.2 (noarch): qemu-ipxe-1.0.0-23.1 qemu-seabios-1.9.1-23.1 qemu-sgabios-8-23.1 qemu-vgabios-1.9.1-23.1 References: https://www.suse.com/security/cve/CVE-2016-7161.html https://www.suse.com/security/cve/CVE-2016-7170.html https://www.suse.com/security/cve/CVE-2016-7422.html https://www.suse.com/security/cve/CVE-2016-7466.html https://www.suse.com/security/cve/CVE-2016-7907.html https://www.suse.com/security/cve/CVE-2016-7908.html https://www.suse.com/security/cve/CVE-2016-7909.html https://www.suse.com/security/cve/CVE-2016-7994.html https://www.suse.com/security/cve/CVE-2016-7995.html https://www.suse.com/security/cve/CVE-2016-8576.html https://www.suse.com/security/cve/CVE-2016-8577.html https://www.suse.com/security/cve/CVE-2016-8578.html https://www.suse.com/security/cve/CVE-2016-8667.html https://www.suse.com/security/cve/CVE-2016-8668.html https://www.suse.com/security/cve/CVE-2016-8669.html https://www.suse.com/security/cve/CVE-2016-8909.html https://www.suse.com/security/cve/CVE-2016-8910.html https://www.suse.com/security/cve/CVE-2016-9101.html https://www.suse.com/security/cve/CVE-2016-9104.html https://www.suse.com/security/cve/CVE-2016-9105.html https://www.suse.com/security/cve/CVE-2016-9106.html https://bugzilla.suse.com/1000345 https://bugzilla.suse.com/1000346 https://bugzilla.suse.com/1001151 https://bugzilla.suse.com/1002116 https://bugzilla.suse.com/1002549 https://bugzilla.suse.com/1002550 https://bugzilla.suse.com/1002557 https://bugzilla.suse.com/1003612 https://bugzilla.suse.com/1003613 https://bugzilla.suse.com/1003878 https://bugzilla.suse.com/1003893 https://bugzilla.suse.com/1003894 https://bugzilla.suse.com/1004702 https://bugzilla.suse.com/1004706 https://bugzilla.suse.com/1004707 https://bugzilla.suse.com/1005353 https://bugzilla.suse.com/1005374 https://bugzilla.suse.com/1006536 https://bugzilla.suse.com/1006538 https://bugzilla.suse.com/1007391 https://bugzilla.suse.com/1007493 https://bugzilla.suse.com/1007494 https://bugzilla.suse.com/1007495 https://bugzilla.suse.com/1007769 https://bugzilla.suse.com/1008148 https://bugzilla.suse.com/998516

1 0

openSUSE-RU-2016:3236-1: moderate: Recommended update for kwalletmanager5
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for kwalletmanager5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3236-1 Rating: moderate References: #1015772 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kwalletmanager5 fixes the following issues: - Fix "Export to XML..." creating an empty file. (boo#1015772, kde#368314) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1509=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kwalletmanager5-16.08.2-3.1 kwalletmanager5-debuginfo-16.08.2-3.1 kwalletmanager5-debugsource-16.08.2-3.1 References: https://bugzilla.suse.com/1015772

1 0

openSUSE-RU-2016:3235-1: moderate: Recommended update for release-notes-openSUSE
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for release-notes-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3235-1 Rating: moderate References: #1009123 #1009275 #1009493 #1010575 #1014686 #995062 #998663 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for release-notes-openSUSE fixes the following issues: - 42.2.20161212 (tracked in boo#1009123) - Added note on Dolphin and extended permission bits (boo#1009275) - Added note on AArch64 Page Size (boo#998663) - Added note on GNOME Shell not locking without GDM (boo#995062) - Added note on Mount by Label installer crash (boo#1009493) - Added warning to section about Btrfs disk space leak (boo#1010575) - Added nodejs to list of renamed packages - Removed Seamonkey from list of replaced packages (boo#1014686) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1514=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): release-notes-openSUSE-42.2.20161212-3.1 References: https://bugzilla.suse.com/1009123 https://bugzilla.suse.com/1009275 https://bugzilla.suse.com/1009493 https://bugzilla.suse.com/1010575 https://bugzilla.suse.com/1014686 https://bugzilla.suse.com/995062 https://bugzilla.suse.com/998663

1 0

openSUSE-SU-2016:3233-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3233-1 Rating: important References: #1009318 #1013376 #1014159 Cross-References: CVE-2016-8707 CVE-2016-8862 CVE-2016-8866 CVE-2016-9556 CVE-2016-9773 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This security update for ImageMagick fixes the following issues: - a maliciously crafted compressed TIFF image could cause code remote code execution in the convert utility in particular circumstances (CVE-2016-8707, boo#1014159) - a memory allocation failure was fixed (CVE-2016-8866, boo#1009318, follow up on CVE-2016-8862) - the identify utility could crash on maliciously crafted images (CVE-2016-9773, boo#1013376, follow up on CVE-2016-9556) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1512=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ImageMagick-6.8.9.8-45.1 ImageMagick-debuginfo-6.8.9.8-45.1 ImageMagick-debugsource-6.8.9.8-45.1 ImageMagick-devel-6.8.9.8-45.1 ImageMagick-extra-6.8.9.8-45.1 ImageMagick-extra-debuginfo-6.8.9.8-45.1 libMagick++-6_Q16-5-6.8.9.8-45.1 libMagick++-6_Q16-5-debuginfo-6.8.9.8-45.1 libMagick++-devel-6.8.9.8-45.1 libMagickCore-6_Q16-2-6.8.9.8-45.1 libMagickCore-6_Q16-2-debuginfo-6.8.9.8-45.1 libMagickWand-6_Q16-2-6.8.9.8-45.1 libMagickWand-6_Q16-2-debuginfo-6.8.9.8-45.1 perl-PerlMagick-6.8.9.8-45.1 perl-PerlMagick-debuginfo-6.8.9.8-45.1 - openSUSE 13.2 (x86_64): ImageMagick-devel-32bit-6.8.9.8-45.1 libMagick++-6_Q16-5-32bit-6.8.9.8-45.1 libMagick++-6_Q16-5-debuginfo-32bit-6.8.9.8-45.1 libMagick++-devel-32bit-6.8.9.8-45.1 libMagickCore-6_Q16-2-32bit-6.8.9.8-45.1 libMagickCore-6_Q16-2-debuginfo-32bit-6.8.9.8-45.1 libMagickWand-6_Q16-2-32bit-6.8.9.8-45.1 libMagickWand-6_Q16-2-debuginfo-32bit-6.8.9.8-45.1 - openSUSE 13.2 (noarch): ImageMagick-doc-6.8.9.8-45.1 References: https://www.suse.com/security/cve/CVE-2016-8707.html https://www.suse.com/security/cve/CVE-2016-8862.html https://www.suse.com/security/cve/CVE-2016-8866.html https://www.suse.com/security/cve/CVE-2016-9556.html https://www.suse.com/security/cve/CVE-2016-9773.html https://bugzilla.suse.com/1009318 https://bugzilla.suse.com/1013376 https://bugzilla.suse.com/1014159

1 0

openSUSE-RU-2016:3232-1: moderate: Recommended update for dtb-source
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for dtb-source ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3232-1 Rating: moderate References: #1012094 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dtb-source fixes the following issues: - enable more armv7l boards now that the kernel is fixed, including RPi2 (boo#1012094) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1516=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dtb-source-4.4.36-11.1 References: https://bugzilla.suse.com/1012094

1 0

openSUSE-RU-2016:3231-1: moderate: Recommended update for Mesa
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for Mesa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3231-1 Rating: moderate References: #1015012 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Mesa provides the following fixes: - Fix hangs with Radeon due to a use-after-free bug in Gallium. (bsc#1015012) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1513=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1513=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1513=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): Mesa-11.2.2-162.1 Mesa-debuginfo-11.2.2-162.1 Mesa-debugsource-11.2.2-162.1 Mesa-devel-11.2.2-162.1 Mesa-dri-devel-11.2.2-162.1 Mesa-dri-nouveau-11.2.2-162.1 Mesa-libEGL-devel-11.2.2-162.1 Mesa-libEGL1-11.2.2-162.1 Mesa-libEGL1-debuginfo-11.2.2-162.1 Mesa-libGL-devel-11.2.2-162.1 Mesa-libGL1-11.2.2-162.1 Mesa-libGL1-debuginfo-11.2.2-162.1 Mesa-libGLESv1_CM-devel-11.2.2-162.1 Mesa-libGLESv1_CM1-11.2.2-162.1 Mesa-libGLESv1_CM1-debuginfo-11.2.2-162.1 Mesa-libGLESv2-2-11.2.2-162.1 Mesa-libGLESv2-2-debuginfo-11.2.2-162.1 Mesa-libGLESv2-devel-11.2.2-162.1 Mesa-libGLESv3-devel-11.2.2-162.1 Mesa-libOpenCL-11.2.2-162.1 Mesa-libOpenCL-debuginfo-11.2.2-162.1 Mesa-libd3d-11.2.2-162.1 Mesa-libd3d-debuginfo-11.2.2-162.1 Mesa-libd3d-devel-11.2.2-162.1 Mesa-libglapi-devel-11.2.2-162.1 Mesa-libglapi0-11.2.2-162.1 Mesa-libglapi0-debuginfo-11.2.2-162.1 Mesa-libva-11.2.2-162.1 Mesa-libva-debuginfo-11.2.2-162.1 libOSMesa-devel-11.2.2-162.1 libOSMesa9-11.2.2-162.1 libOSMesa9-debuginfo-11.2.2-162.1 libXvMC_nouveau-11.2.2-162.1 libXvMC_nouveau-debuginfo-11.2.2-162.1 libXvMC_r600-11.2.2-162.1 libXvMC_r600-debuginfo-11.2.2-162.1 libgbm-devel-11.2.2-162.1 libgbm1-11.2.2-162.1 libgbm1-debuginfo-11.2.2-162.1 libvdpau_nouveau-11.2.2-162.1 libvdpau_nouveau-debuginfo-11.2.2-162.1 libvdpau_r300-11.2.2-162.1 libvdpau_r300-debuginfo-11.2.2-162.1 libvdpau_r600-11.2.2-162.1 libvdpau_r600-debuginfo-11.2.2-162.1 libvdpau_radeonsi-11.2.2-162.1 libvdpau_radeonsi-debuginfo-11.2.2-162.1 libwayland-egl-devel-11.2.2-162.1 libwayland-egl1-11.2.2-162.1 libwayland-egl1-debuginfo-11.2.2-162.1 libxatracker-devel-1.0.0-162.1 libxatracker2-1.0.0-162.1 libxatracker2-debuginfo-1.0.0-162.1 - openSUSE Leap 42.2 (x86_64): Mesa-32bit-11.2.2-162.1 Mesa-debuginfo-32bit-11.2.2-162.1 Mesa-dri-nouveau-32bit-11.2.2-162.1 Mesa-libEGL-devel-32bit-11.2.2-162.1 Mesa-libEGL1-32bit-11.2.2-162.1 Mesa-libEGL1-debuginfo-32bit-11.2.2-162.1 Mesa-libGL-devel-32bit-11.2.2-162.1 Mesa-libGL1-32bit-11.2.2-162.1 Mesa-libGL1-debuginfo-32bit-11.2.2-162.1 Mesa-libGLESv1_CM-devel-32bit-11.2.2-162.1 Mesa-libGLESv1_CM1-32bit-11.2.2-162.1 Mesa-libGLESv1_CM1-debuginfo-32bit-11.2.2-162.1 Mesa-libGLESv2-2-32bit-11.2.2-162.1 Mesa-libGLESv2-2-debuginfo-32bit-11.2.2-162.1 Mesa-libGLESv2-devel-32bit-11.2.2-162.1 Mesa-libOpenCL-32bit-11.2.2-162.1 Mesa-libOpenCL-debuginfo-32bit-11.2.2-162.1 Mesa-libd3d-32bit-11.2.2-162.1 Mesa-libd3d-debuginfo-32bit-11.2.2-162.1 Mesa-libd3d-devel-32bit-11.2.2-162.1 Mesa-libglapi-devel-32bit-11.2.2-162.1 Mesa-libglapi0-32bit-11.2.2-162.1 Mesa-libglapi0-debuginfo-32bit-11.2.2-162.1 libOSMesa-devel-32bit-11.2.2-162.1 libOSMesa9-32bit-11.2.2-162.1 libOSMesa9-debuginfo-32bit-11.2.2-162.1 libXvMC_nouveau-32bit-11.2.2-162.1 libXvMC_nouveau-debuginfo-32bit-11.2.2-162.1 libXvMC_r600-32bit-11.2.2-162.1 libXvMC_r600-debuginfo-32bit-11.2.2-162.1 libgbm-devel-32bit-11.2.2-162.1 libgbm1-32bit-11.2.2-162.1 libgbm1-debuginfo-32bit-11.2.2-162.1 libvdpau_nouveau-32bit-11.2.2-162.1 libvdpau_nouveau-debuginfo-32bit-11.2.2-162.1 libvdpau_r300-32bit-11.2.2-162.1 libvdpau_r300-debuginfo-32bit-11.2.2-162.1 libvdpau_r600-32bit-11.2.2-162.1 libvdpau_r600-debuginfo-32bit-11.2.2-162.1 libvdpau_radeonsi-32bit-11.2.2-162.1 libvdpau_radeonsi-debuginfo-32bit-11.2.2-162.1 libwayland-egl-devel-32bit-11.2.2-162.1 libwayland-egl1-32bit-11.2.2-162.1 libwayland-egl1-debuginfo-32bit-11.2.2-162.1 - openSUSE Leap 42.1 (i586 x86_64): Mesa-11.0.8-154.2 Mesa-debuginfo-11.0.8-154.2 Mesa-debugsource-11.0.8-154.2 Mesa-devel-11.0.8-154.2 Mesa-dri-devel-11.0.8-154.2 Mesa-libEGL-devel-11.0.8-154.2 Mesa-libEGL1-11.0.8-154.2 Mesa-libEGL1-debuginfo-11.0.8-154.2 Mesa-libGL-devel-11.0.8-154.2 Mesa-libGL1-11.0.8-154.2 Mesa-libGL1-debuginfo-11.0.8-154.2 Mesa-libGLESv1_CM-devel-11.0.8-154.2 Mesa-libGLESv1_CM1-11.0.8-154.2 Mesa-libGLESv1_CM1-debuginfo-11.0.8-154.2 Mesa-libGLESv2-2-11.0.8-154.2 Mesa-libGLESv2-2-debuginfo-11.0.8-154.2 Mesa-libGLESv2-devel-11.0.8-154.2 Mesa-libGLESv3-devel-11.0.8-154.2 Mesa-libd3d-11.0.8-154.2 Mesa-libd3d-debuginfo-11.0.8-154.2 Mesa-libd3d-devel-11.0.8-154.2 Mesa-libglapi-devel-11.0.8-154.2 Mesa-libglapi0-11.0.8-154.2 Mesa-libglapi0-debuginfo-11.0.8-154.2 libOSMesa-devel-11.0.8-154.2 libOSMesa9-11.0.8-154.2 libOSMesa9-debuginfo-11.0.8-154.2 libXvMC_nouveau-11.0.8-154.2 libXvMC_nouveau-debuginfo-11.0.8-154.2 libXvMC_r600-11.0.8-154.2 libgbm-devel-11.0.8-154.2 libgbm1-11.0.8-154.2 libgbm1-debuginfo-11.0.8-154.2 libvdpau_nouveau-11.0.8-154.2 libvdpau_nouveau-debuginfo-11.0.8-154.2 libvdpau_r300-11.0.8-154.2 libvdpau_r600-11.0.8-154.2 libvdpau_radeonsi-11.0.8-154.2 libwayland-egl-devel-11.0.8-154.2 libwayland-egl1-11.0.8-154.2 libwayland-egl1-debuginfo-11.0.8-154.2 libxatracker-devel-1.0.0-154.2 libxatracker2-1.0.0-154.2 libxatracker2-debuginfo-1.0.0-154.2 - openSUSE Leap 42.1 (x86_64): Mesa-32bit-11.0.8-154.2 Mesa-debuginfo-32bit-11.0.8-154.2 Mesa-libEGL-devel-32bit-11.0.8-154.2 Mesa-libEGL1-32bit-11.0.8-154.2 Mesa-libEGL1-debuginfo-32bit-11.0.8-154.2 Mesa-libGL-devel-32bit-11.0.8-154.2 Mesa-libGL1-32bit-11.0.8-154.2 Mesa-libGL1-debuginfo-32bit-11.0.8-154.2 Mesa-libGLESv1_CM-devel-32bit-11.0.8-154.2 Mesa-libGLESv1_CM1-32bit-11.0.8-154.2 Mesa-libGLESv1_CM1-debuginfo-32bit-11.0.8-154.2 Mesa-libGLESv2-2-32bit-11.0.8-154.2 Mesa-libGLESv2-2-debuginfo-32bit-11.0.8-154.2 Mesa-libGLESv2-devel-32bit-11.0.8-154.2 Mesa-libd3d-32bit-11.0.8-154.2 Mesa-libd3d-debuginfo-32bit-11.0.8-154.2 Mesa-libd3d-devel-32bit-11.0.8-154.2 Mesa-libglapi-devel-32bit-11.0.8-154.2 Mesa-libglapi0-32bit-11.0.8-154.2 Mesa-libglapi0-debuginfo-32bit-11.0.8-154.2 libOSMesa-devel-32bit-11.0.8-154.2 libOSMesa9-32bit-11.0.8-154.2 libOSMesa9-debuginfo-32bit-11.0.8-154.2 libXvMC_nouveau-32bit-11.0.8-154.2 libXvMC_nouveau-debuginfo-32bit-11.0.8-154.2 libXvMC_r600-32bit-11.0.8-154.2 libgbm-devel-32bit-11.0.8-154.2 libgbm1-32bit-11.0.8-154.2 libgbm1-debuginfo-32bit-11.0.8-154.2 libvdpau_nouveau-32bit-11.0.8-154.2 libvdpau_nouveau-debuginfo-32bit-11.0.8-154.2 libvdpau_r300-32bit-11.0.8-154.2 libvdpau_r600-32bit-11.0.8-154.2 libvdpau_radeonsi-32bit-11.0.8-154.2 libwayland-egl-devel-32bit-11.0.8-154.2 libwayland-egl1-32bit-11.0.8-154.2 libwayland-egl1-debuginfo-32bit-11.0.8-154.2 - openSUSE 13.2 (i586 x86_64): Mesa-10.3.7-91.24.2 Mesa-debuginfo-10.3.7-91.24.2 Mesa-debugsource-10.3.7-91.24.2 Mesa-devel-10.3.7-91.24.2 Mesa-libEGL-devel-10.3.7-91.24.2 Mesa-libEGL1-10.3.7-91.24.2 Mesa-libEGL1-debuginfo-10.3.7-91.24.2 Mesa-libGL-devel-10.3.7-91.24.2 Mesa-libGL1-10.3.7-91.24.2 Mesa-libGL1-debuginfo-10.3.7-91.24.2 Mesa-libGLESv1_CM-devel-10.3.7-91.24.2 Mesa-libGLESv1_CM1-10.3.7-91.24.2 Mesa-libGLESv1_CM1-debuginfo-10.3.7-91.24.2 Mesa-libGLESv2-2-10.3.7-91.24.2 Mesa-libGLESv2-2-debuginfo-10.3.7-91.24.2 Mesa-libGLESv2-devel-10.3.7-91.24.2 Mesa-libGLESv3-devel-10.3.7-91.24.2 Mesa-libglapi-devel-10.3.7-91.24.2 Mesa-libglapi0-10.3.7-91.24.2 Mesa-libglapi0-debuginfo-10.3.7-91.24.2 libOSMesa-devel-10.3.7-91.24.2 libOSMesa9-10.3.7-91.24.2 libOSMesa9-debuginfo-10.3.7-91.24.2 libXvMC_nouveau-10.3.7-91.24.2 libXvMC_nouveau-debuginfo-10.3.7-91.24.2 libXvMC_r600-10.3.7-91.24.2 libgbm-devel-10.3.7-91.24.2 libgbm1-10.3.7-91.24.2 libgbm1-debuginfo-10.3.7-91.24.2 libvdpau_nouveau-10.3.7-91.24.2 libvdpau_nouveau-debuginfo-10.3.7-91.24.2 libvdpau_r600-10.3.7-91.24.2 libvdpau_radeonsi-10.3.7-91.24.2 libwayland-egl-devel-10.3.7-91.24.2 libwayland-egl1-10.3.7-91.24.2 libwayland-egl1-debuginfo-10.3.7-91.24.2 libxatracker-devel-1.0.0-91.24.2 libxatracker2-1.0.0-91.24.2 libxatracker2-debuginfo-1.0.0-91.24.2 - openSUSE 13.2 (x86_64): Mesa-32bit-10.3.7-91.24.2 Mesa-debuginfo-32bit-10.3.7-91.24.2 Mesa-libEGL-devel-32bit-10.3.7-91.24.2 Mesa-libEGL1-32bit-10.3.7-91.24.2 Mesa-libEGL1-debuginfo-32bit-10.3.7-91.24.2 Mesa-libGL-devel-32bit-10.3.7-91.24.2 Mesa-libGL1-32bit-10.3.7-91.24.2 Mesa-libGL1-debuginfo-32bit-10.3.7-91.24.2 Mesa-libGLESv1_CM-devel-32bit-10.3.7-91.24.2 Mesa-libGLESv1_CM1-32bit-10.3.7-91.24.2 Mesa-libGLESv1_CM1-debuginfo-32bit-10.3.7-91.24.2 Mesa-libGLESv2-2-32bit-10.3.7-91.24.2 Mesa-libGLESv2-2-debuginfo-32bit-10.3.7-91.24.2 Mesa-libGLESv2-devel-32bit-10.3.7-91.24.2 Mesa-libglapi-devel-32bit-10.3.7-91.24.2 Mesa-libglapi0-32bit-10.3.7-91.24.2 Mesa-libglapi0-debuginfo-32bit-10.3.7-91.24.2 libOSMesa-devel-32bit-10.3.7-91.24.2 libOSMesa9-32bit-10.3.7-91.24.2 libOSMesa9-debuginfo-32bit-10.3.7-91.24.2 libXvMC_nouveau-32bit-10.3.7-91.24.2 libXvMC_nouveau-debuginfo-32bit-10.3.7-91.24.2 libXvMC_r600-32bit-10.3.7-91.24.2 libgbm-devel-32bit-10.3.7-91.24.2 libgbm1-32bit-10.3.7-91.24.2 libgbm1-debuginfo-32bit-10.3.7-91.24.2 libvdpau_nouveau-32bit-10.3.7-91.24.2 libvdpau_nouveau-debuginfo-32bit-10.3.7-91.24.2 libvdpau_r600-32bit-10.3.7-91.24.2 libvdpau_radeonsi-32bit-10.3.7-91.24.2 libwayland-egl-devel-32bit-10.3.7-91.24.2 libwayland-egl1-32bit-10.3.7-91.24.2 libwayland-egl1-debuginfo-32bit-10.3.7-91.24.2 References: https://bugzilla.suse.com/1015012

1 0

openSUSE-RU-2016:3230-1: moderate: Recommended update for mupdf
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3230-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for mupdf fixes the following issues: - Update to version 1.10 * FictionBook (FB2) e-book support. * Simple SVG parser (a small subset of SVG only). * mutool convert: a new document conversion tool and interface. * Updated base 14 fonts from URW. * New CJK font with language specific variants. * Hyperlink support in EPUB. * Improved PDF annotation editing interface (still a work in progress). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1515=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): mupdf-1.10-3.1 mupdf-devel-static-1.10-3.1 References:

1 0

openSUSE-SU-2016:3228-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3228-1 Rating: moderate References: #1015187 Cross-References: CVE-2016-9933 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update for gd fixes the following issues: - a call to gdImageFillToBorder() could cause a stack overflow leading to stack exhaustion when the image used was not truecolor (CVE-2016-9933 ,boo#1015187) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1510=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gd-2.1.0-7.22.1 gd-debuginfo-2.1.0-7.22.1 gd-debugsource-2.1.0-7.22.1 gd-devel-2.1.0-7.22.1 libgd3-2.1.0-7.22.1 libgd3-debuginfo-2.1.0-7.22.1 - openSUSE 13.2 (x86_64): libgd3-32bit-2.1.0-7.22.1 libgd3-debuginfo-32bit-2.1.0-7.22.1 References: https://www.suse.com/security/cve/CVE-2016-9933.html https://bugzilla.suse.com/1015187

1 0

openSUSE-RU-2016:3227-1: moderate: Recommended update for python-Pygments
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for python-Pygments ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3227-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides version 2.1.3 of python-Pygments and brings many fixes and improvements. For a detailed description, please refer to the changelog or to http://pygments.org/docs/changelog/. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1507=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1507=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1507=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): python-Pygments-2.1.3-11.1 - openSUSE Leap 42.1 (noarch): python-Pygments-2.1.3-10.1 - openSUSE 13.2 (noarch): python-Pygments-2.1.3-7.3.1 References:

1 0

openSUSE-RU-2016:3226-1: Recommended update for gnome-software
by maintenance＠opensuse.org 22 Dec '16

22 Dec '16

openSUSE Recommended Update: Recommended update for gnome-software ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3226-1 Rating: low References: #1015623 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-software fixes the following issues: - Ensure reviews are shown in the correct order. - Fix icon loading for remote icons that have the filename set. - Fix launching various KDE4 applications. - Make review text selectable. - Only show the external installed notification on success. - Use the ORDS server hosted by GNOME. - Updated translations. - Don't show an error for newer, stricter GTK versions. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1508=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): gnome-software-3.20.5-3.1 gnome-software-debuginfo-3.20.5-3.1 gnome-software-debugsource-3.20.5-3.1 - openSUSE Leap 42.2 (noarch): gnome-software-lang-3.20.5-3.1 References: https://bugzilla.suse.com/1015623

1 0

openSUSE-RU-2016:3220-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 21 Dec '16

21 Dec '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3220-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - database refresh Dec 19th This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1503=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1503=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201612190005-18.1 - openSUSE Leap 42.1 (noarch): clamav-database-201612190005-197.1 References:

1 0

openSUSE-SU-2016:3218-1: moderate: Security update for mcabber
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

openSUSE Security Update: Security update for mcabber ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3218-1 Rating: moderate References: #1014976 Cross-References: CVE-2015-8688 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mcabber fixes the following issues: - Update to version 1.0.4 (changes since 1.0.2): * Check the origin of roster pushes (boo#1014976, CVE-2015-8688 (Gajim), https://gultsch.de/gajim_roster_push_and_message_interception.html) * Link with the tinfo library. * Fix default modules directory on OpenBSD. * Create the history log directory if it doesn't exist. * [OTR] Do not send empty subjects. * [UI] /set does not display password values anymore. * [MUC] Use nick to set the role. * Misc help/documentation updates. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1502=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): mcabber-1.0.4-3.1 mcabber-debuginfo-1.0.4-3.1 mcabber-debugsource-1.0.4-3.1 mcabber-devel-1.0.4-3.1 References: https://www.suse.com/security/cve/CVE-2015-8688.html https://bugzilla.suse.com/1014976

1 0

openSUSE-SU-2016:3215-1: moderate: Security update for shellinabox
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

openSUSE Security Update: Security update for shellinabox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3215-1 Rating: moderate References: #957748 Cross-References: CVE-2015-8400 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: shellinabox was updated to version 2.20 to fix the following security issues: - It was possible to fallback to the HTTP protocol even when configured for HTTPS. (CVE-2015-8400, boo#957748) - Disable secure client-initiated renegotiation - Set SSL options for increased security (disable SSLv2, SSLv3) - Protection against large HTTP requests non security fixes: - Includes some MSIE and iOS rendering fixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1501=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1501=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1501=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): shellinabox-2.20-12.1 shellinabox-debuginfo-2.20-12.1 shellinabox-debugsource-2.20-12.1 - openSUSE Leap 42.1 (i586 x86_64): shellinabox-2.20-11.1 shellinabox-debuginfo-2.20-11.1 shellinabox-debugsource-2.20-11.1 - openSUSE 13.2 (i586 x86_64): shellinabox-2.20-5.3.1 shellinabox-debuginfo-2.20-5.3.1 shellinabox-debugsource-2.20-5.3.1 References: https://www.suse.com/security/cve/CVE-2015-8400.html https://bugzilla.suse.com/957748

1 0

openSUSE-SU-2016:3202-1: moderate: Security update for zlib
by opensuse-security＠opensuse.org 20 Dec '16

20 Dec '16

openSUSE Security Update: Security update for zlib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3202-1 Rating: moderate References: #1003577 #1003579 #1003580 #1013882 Cross-References: CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for zlib fixes the following issues: - Remove incompatible declarations of 'struct internal_state' (boo#1003577) - Avoid out-of-bounds pointer arithmetic in inftrees.c (boo#1003579, CVE-2016-9840, CVE-2016-9841) - Avoid left-shift with negative number (boo#1003580, CVE-2016-9842) - Avoid undefined behaviour in pointer arithmetic on powerpc (boo#1013882, CVE-2016-9843) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1499=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libminizip1-1.2.8-5.8.1 libminizip1-debuginfo-1.2.8-5.8.1 libz1-1.2.8-5.8.1 libz1-debuginfo-1.2.8-5.8.1 minizip-devel-1.2.8-5.8.1 zlib-debugsource-1.2.8-5.8.1 zlib-devel-1.2.8-5.8.1 zlib-devel-static-1.2.8-5.8.1 - openSUSE 13.2 (x86_64): libz1-32bit-1.2.8-5.8.1 libz1-debuginfo-32bit-1.2.8-5.8.1 zlib-devel-32bit-1.2.8-5.8.1 zlib-devel-static-32bit-1.2.8-5.8.1 References: https://www.suse.com/security/cve/CVE-2016-9840.html https://www.suse.com/security/cve/CVE-2016-9841.html https://www.suse.com/security/cve/CVE-2016-9842.html https://www.suse.com/security/cve/CVE-2016-9843.html https://bugzilla.suse.com/1003577 https://bugzilla.suse.com/1003579 https://bugzilla.suse.com/1003580 https://bugzilla.suse.com/1013882

1 0

openSUSE-SU-2016:3201-1: moderate: Security update for ceph
by opensuse-security＠opensuse.org 20 Dec '16

20 Dec '16

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3201-1 Rating: moderate References: #1005179 #1007216 #1008501 #1008894 #1014338 #977940 #982141 #985232 #987144 #990438 #999688 Cross-References: CVE-2016-5009 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has 10 fixes is now available. Description: ceph was updated to version 10.2.4 and fixes the following issues: - A moncommand with empty prefix could crash the monitor (boo#987144, CVE-2016-5009) - Detect crc32 extension support from assembler on AArch64 (boo#999688) - Failing file operations on kernel based cephfs mount point could leave unaccessible file behind on hammer 0.94.7 (boo#985232) - Fixed boo#1008501 + ceph_volume_client: fix _recover_auth_meta() method + ceph_volume_client: check if volume metadata is empty + ceph_volume_client: fix partial auth recovery - Avoid ~100% CPU load after OSD creation / first OSD start (boo#1014338) - Fixed boo#990438: civetweb HTTPS support not working - Avoid systemd limiting OSDs (boo#1007216) - Fix "make check" when building unit tests with --with-xio (boo#977940) - Fix build for ppc64le (boo#982141) - Including performance fix for linux dcache hash algorithm (boo#1005179) - Fix invalid command in SOC7 (boo#1008894) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1500=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): ceph-10.2.4+git.1481215985.12b091b-4.1 ceph-base-10.2.4+git.1481215985.12b091b-4.1 ceph-base-debuginfo-10.2.4+git.1481215985.12b091b-4.1 ceph-common-10.2.4+git.1481215985.12b091b-4.1 ceph-common-debuginfo-10.2.4+git.1481215985.12b091b-4.1 ceph-fuse-10.2.4+git.1481215985.12b091b-4.1 ceph-fuse-debuginfo-10.2.4+git.1481215985.12b091b-4.1 ceph-mds-10.2.4+git.1481215985.12b091b-4.1 ceph-mds-debuginfo-10.2.4+git.1481215985.12b091b-4.1 ceph-mon-10.2.4+git.1481215985.12b091b-4.1 ceph-mon-debuginfo-10.2.4+git.1481215985.12b091b-4.1 ceph-osd-10.2.4+git.1481215985.12b091b-4.1 ceph-osd-debuginfo-10.2.4+git.1481215985.12b091b-4.1 ceph-radosgw-10.2.4+git.1481215985.12b091b-4.1 ceph-radosgw-debuginfo-10.2.4+git.1481215985.12b091b-4.1 ceph-resource-agents-10.2.4+git.1481215985.12b091b-4.1 ceph-test-10.2.4+git.1481215985.12b091b-4.1 ceph-test-debuginfo-10.2.4+git.1481215985.12b091b-4.1 libcephfs-devel-10.2.4+git.1481215985.12b091b-4.1 libcephfs1-10.2.4+git.1481215985.12b091b-4.1 libcephfs1-debuginfo-10.2.4+git.1481215985.12b091b-4.1 librados-devel-10.2.4+git.1481215985.12b091b-4.1 librados-devel-debuginfo-10.2.4+git.1481215985.12b091b-4.1 librados2-10.2.4+git.1481215985.12b091b-4.1 librados2-debuginfo-10.2.4+git.1481215985.12b091b-4.1 libradosstriper-devel-10.2.4+git.1481215985.12b091b-4.1 libradosstriper1-10.2.4+git.1481215985.12b091b-4.1 libradosstriper1-debuginfo-10.2.4+git.1481215985.12b091b-4.1 librbd-devel-10.2.4+git.1481215985.12b091b-4.1 librbd1-10.2.4+git.1481215985.12b091b-4.1 librbd1-debuginfo-10.2.4+git.1481215985.12b091b-4.1 librgw-devel-10.2.4+git.1481215985.12b091b-4.1 librgw2-10.2.4+git.1481215985.12b091b-4.1 librgw2-debuginfo-10.2.4+git.1481215985.12b091b-4.1 python-ceph-compat-10.2.4+git.1481215985.12b091b-4.1 python-cephfs-10.2.4+git.1481215985.12b091b-4.1 python-cephfs-debuginfo-10.2.4+git.1481215985.12b091b-4.1 python-rados-10.2.4+git.1481215985.12b091b-4.1 python-rados-debuginfo-10.2.4+git.1481215985.12b091b-4.1 python-rbd-10.2.4+git.1481215985.12b091b-4.1 python-rbd-debuginfo-10.2.4+git.1481215985.12b091b-4.1 rbd-fuse-10.2.4+git.1481215985.12b091b-4.1 rbd-fuse-debuginfo-10.2.4+git.1481215985.12b091b-4.1 rbd-mirror-10.2.4+git.1481215985.12b091b-4.1 rbd-mirror-debuginfo-10.2.4+git.1481215985.12b091b-4.1 rbd-nbd-10.2.4+git.1481215985.12b091b-4.1 rbd-nbd-debuginfo-10.2.4+git.1481215985.12b091b-4.1 References: https://www.suse.com/security/cve/CVE-2016-5009.html https://bugzilla.suse.com/1005179 https://bugzilla.suse.com/1007216 https://bugzilla.suse.com/1008501 https://bugzilla.suse.com/1008894 https://bugzilla.suse.com/1014338 https://bugzilla.suse.com/977940 https://bugzilla.suse.com/982141 https://bugzilla.suse.com/985232 https://bugzilla.suse.com/987144 https://bugzilla.suse.com/990438 https://bugzilla.suse.com/999688

1 0

openSUSE-RU-2016:3198-1: moderate: Recommended update for twinkle
by maintenance＠opensuse.org 20 Dec '16

20 Dec '16

openSUSE Recommended Update: Recommended update for twinkle ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3198-1 Rating: moderate References: #1012778 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to twinkle 1.10.1 fixes the following issues: - twinkle freezes during the call transfer - twinkle hangs when it receives REFER and pops up transfer window - --call/show/hide may invoke GUI methods in the wrong thread Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1498=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): twinkle-1.10.1-4.1 twinkle-debuginfo-1.10.1-4.1 twinkle-debugsource-1.10.1-4.1 References: https://bugzilla.suse.com/1012778

1 0

openSUSE-RU-2016:3191-1: Recommended update for rkhunter
by maintenance＠opensuse.org 19 Dec '16

19 Dec '16

openSUSE Recommended Update: Recommended update for rkhunter ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3191-1 Rating: low References: #1006382 #968578 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for rkhunter fixes the following issues: - do not use /etc/SuSE-release anymore, fallback to generic /etc/os-release (boo#1006382) - fix "too many arguments" warning (boo#968578) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1497=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1497=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): rkhunter-1.4.2-8.1 - openSUSE Leap 42.1 (i586 x86_64): rkhunter-1.4.2-7.1 References: https://bugzilla.suse.com/1006382 https://bugzilla.suse.com/968578

1 0

openSUSE-RU-2016:3186-1: moderate: Recommended update for julia
by maintenance＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Recommended Update: Recommended update for julia ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3186-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides the latest bugfix release for julia. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1493=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1493=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): julia-0.4.7-3.1 julia-compat-0.4.7-3.1 julia-compat-debuginfo-0.4.7-3.1 julia-compat-debugsource-0.4.7-3.1 julia-compat-devel-0.4.7-3.1 julia-compat-devel-debuginfo-0.4.7-3.1 julia-debuginfo-0.4.7-3.1 julia-debugsource-0.4.7-3.1 julia-devel-0.4.7-3.1 julia-devel-debuginfo-0.4.7-3.1 - openSUSE Leap 42.2 (noarch): julia-doc-0.4.7-3.1 julia-examples-0.4.7-3.1 - openSUSE Leap 42.1 (i586 x86_64): julia-0.4.7-10.2 julia-debuginfo-0.4.7-10.2 julia-debugsource-0.4.7-10.2 julia-devel-0.4.7-10.2 julia-devel-debuginfo-0.4.7-10.2 - openSUSE Leap 42.1 (noarch): julia-doc-0.4.7-10.2 julia-examples-0.4.7-10.2 - openSUSE Leap 42.1 (x86_64): julia-compat-0.4.7-10.2 julia-compat-debuginfo-0.4.7-10.2 julia-compat-debugsource-0.4.7-10.2 julia-compat-devel-0.4.7-10.2 julia-compat-devel-debuginfo-0.4.7-10.2 References:

1 0

openSUSE-OU-2016:3185-1: moderate: Add sshpass to the SUSE Package Hub
by maintenance＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Optional Update: Add sshpass to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:3185-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update add sshpass to the SUSE Package Hub. Sshpass is a tool for non-interactively performing password authentication with SSH's so called "interactive keyboard password authentication". This is an alternative to the more secure public key authentication method. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1495=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): sshpass-1.06-2.1 References:

1 0

openSUSE-SU-2016:3184-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3184-1 Rating: important References: #1011922 #1015422 Cross-References: CVE-2016-9080 CVE-2016-9893 CVE-2016-9894 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9903 CVE-2016-9904 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities: - CVE-2016-9894: Buffer overflow in SkiaGL - CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements - CVE-2016-9895: CSP bypass using marquee tag - CVE-2016-9896: Use-after-free with WebVR - CVE-2016-9897: Memory corruption in libGLES - CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees - CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs - CVE-2016-9904: Cross-origin information leak in shared atoms - CVE-2016-9901: Data from Pocket server improperly sanitized before execution - CVE-2016-9902: Pocket extension does not validate the origin of events - CVE-2016-9903: XSS injection vulnerability in add-ons SDK - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1 - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 The following bugs were fixed: - boo#1011922: fix crash after a few seconds of usage on AArch64 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1490=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1490=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1490=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-50.1.0-45.1 MozillaFirefox-branding-upstream-50.1.0-45.1 MozillaFirefox-buildsymbols-50.1.0-45.1 MozillaFirefox-debuginfo-50.1.0-45.1 MozillaFirefox-debugsource-50.1.0-45.1 MozillaFirefox-devel-50.1.0-45.1 MozillaFirefox-translations-common-50.1.0-45.1 MozillaFirefox-translations-other-50.1.0-45.1 - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-50.1.0-45.1 MozillaFirefox-branding-upstream-50.1.0-45.1 MozillaFirefox-buildsymbols-50.1.0-45.1 MozillaFirefox-debuginfo-50.1.0-45.1 MozillaFirefox-debugsource-50.1.0-45.1 MozillaFirefox-devel-50.1.0-45.1 MozillaFirefox-translations-common-50.1.0-45.1 MozillaFirefox-translations-other-50.1.0-45.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-50.1.0-94.1 MozillaFirefox-branding-upstream-50.1.0-94.1 MozillaFirefox-buildsymbols-50.1.0-94.1 MozillaFirefox-debuginfo-50.1.0-94.1 MozillaFirefox-debugsource-50.1.0-94.1 MozillaFirefox-devel-50.1.0-94.1 MozillaFirefox-translations-common-50.1.0-94.1 MozillaFirefox-translations-other-50.1.0-94.1 References: https://www.suse.com/security/cve/CVE-2016-9080.html https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9894.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9896.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9901.html https://www.suse.com/security/cve/CVE-2016-9902.html https://www.suse.com/security/cve/CVE-2016-9903.html https://www.suse.com/security/cve/CVE-2016-9904.html https://bugzilla.suse.com/1011922 https://bugzilla.suse.com/1015422

1 0

openSUSE-RU-2016:3182-1: moderate: Recommended update for haproxy
by maintenance＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Recommended Update: Recommended update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3182-1 Rating: moderate References: #1003264 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides haproxy version 1.6.9, which brings fixes and enhancements: - Properly mark the server address as unset on connect retry. - Fix possible crash when using sc_trackers with wrong table. - Fix random problems with the "sni" directive. - Initialize avail_in/next_in even during flush. - Fix listening IP address storage for frontends. - Fix breakage of "reqdeny" causing random crashes. - Use asynchronous signal delivery and do not unblock undesired signals. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1491=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): haproxy-1.6.9-3.1 haproxy-debuginfo-1.6.9-3.1 haproxy-debugsource-1.6.9-3.1 References: https://bugzilla.suse.com/1003264

1 0

openSUSE-RU-2016:3181-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3181-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: Opera was updated to version 42.0.2393.85 to deliver a number of upstream improvements: - built-in currency converter - improved start-up performance - improved news feed handling Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2016-1494=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2016-1494=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-42.0.2393.85-9.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-42.0.2393.85-46.1 References:

1 0

openSUSE-RU-2016:3180-1: Recommended update for ninja
by maintenance＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Recommended Update: Recommended update for ninja ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3180-1 Rating: low References: #1014177 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ninja fixes the following issues: - Add macros.ninja (bsc#1014177) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1489=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ninja-1.6.0-9.1 ninja-debuginfo-1.6.0-9.1 ninja-debugsource-1.6.0-9.1 References: https://bugzilla.suse.com/1014177

1 0

openSUSE-SU-2016:3179-1: important: Security update for lxc
by opensuse-security＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Security Update: Security update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3179-1 Rating: important References: #1010933 Cross-References: CVE-2016-8649 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lxc fixes the following issue: - CVE-2016-8649: guest escape via ptrace of lxc-attach (boo#1010933). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1488=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1488=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1488=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): lxc-1.1.2-10.1 lxc-debuginfo-1.1.2-10.1 lxc-debugsource-1.1.2-10.1 lxc-devel-1.1.2-10.1 - openSUSE Leap 42.1 (i586 x86_64): lxc-1.1.2-9.1 lxc-debuginfo-1.1.2-9.1 lxc-debugsource-1.1.2-9.1 lxc-devel-1.1.2-9.1 - openSUSE 13.2 (i586 x86_64): lxc-1.0.6-12.1 lxc-debuginfo-1.0.6-12.1 lxc-debugsource-1.0.6-12.1 lxc-devel-1.0.6-12.1 References: https://www.suse.com/security/cve/CVE-2016-8649.html https://bugzilla.suse.com/1010933

1 0

openSUSE-RU-2016:3178-1: moderate: Recommended update for xdg-utils
by maintenance＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Recommended Update: Recommended update for xdg-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3178-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for xdg-utils fixes the following issue: - Fix upstream typo in xdg-open-no-extra-slash.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1492=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): xdg-utils-20150119-9.1 References:

1 0

openSUSE-SU-2016:3177-1: moderate: Security update for gc
by opensuse-security＠opensuse.org 16 Dec '16

16 Dec '16

openSUSE Security Update: Security update for gc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3177-1 Rating: moderate References: #1011276 Cross-References: CVE-2016-9427 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gc fixes the following issues: - integer overflow in GC_MALLOC_ATOMIC() (CVE-2016-9427, bsc#1011276) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1487=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gc-debugsource-7.2d-4.3.1 gc-devel-7.2d-4.3.1 libgc1-7.2d-4.3.1 libgc1-debuginfo-7.2d-4.3.1 References: https://www.suse.com/security/cve/CVE-2016-9427.html https://bugzilla.suse.com/1011276

1 0

openSUSE-RU-2016:3164-1: moderate: Recommended update for python-Twisted
by maintenance＠opensuse.org 15 Dec '16

15 Dec '16

openSUSE Recommended Update: Recommended update for python-Twisted ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3164-1 Rating: moderate References: #1001523 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-Twisted fixes the following issues: - alternative twistd could not be master (bnc #1001523) python-Twisted was updated to 16.4.0, including all upstream improvements and bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1485=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): python-Twisted-16.4.0-4.1 python-Twisted-debuginfo-16.4.0-4.1 python-Twisted-debugsource-16.4.0-4.1 python-Twisted-doc-16.4.0-4.1 References: https://bugzilla.suse.com/1001523

1 0