December 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:3120-1: Recommended update for ispell
by maintenance＠opensuse.org 14 Dec '16

14 Dec '16

openSUSE Recommended Update: Recommended update for ispell ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3120-1 Rating: low References: #1010330 #966124 #981024 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for ispell removes a few incorrect words from the English dictionary. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1467=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1467=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ispell-3.3.02-113.1 ispell-american-3.3.02-113.1 ispell-british-3.3.02-113.1 ispell-debuginfo-3.3.02-113.1 ispell-debugsource-3.3.02-113.1 - openSUSE Leap 42.1 (i586 x86_64): ispell-3.3.02-112.1 ispell-american-3.3.02-112.1 ispell-british-3.3.02-112.1 ispell-debuginfo-3.3.02-112.1 ispell-debugsource-3.3.02-112.1 References: https://bugzilla.suse.com/1010330 https://bugzilla.suse.com/966124 https://bugzilla.suse.com/981024

1 0

openSUSE-SU-2016:3118-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 13 Dec '16

13 Dec '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3118-1 Rating: important References: #1013533 #1013604 Cross-References: CVE-2016-9576 CVE-2016-9794 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The openSUSE 13.1 kernel was updated to fix two security issues. The following security bugs were fixed: - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges (bsc#1013604). - CVE-2016-9794: A use-after-free vulnerability in the ALSA pcm layer allowed local users to cause a denial of service, memory corruption or possibly even to elevate their privileges (bsc#1013533). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2016-1454=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cloop-2.639-11.40.1 cloop-debuginfo-2.639-11.40.1 cloop-debugsource-2.639-11.40.1 cloop-kmp-default-2.639_k3.12.67_64-11.40.1 cloop-kmp-default-debuginfo-2.639_k3.12.67_64-11.40.1 cloop-kmp-desktop-2.639_k3.12.67_64-11.40.1 cloop-kmp-desktop-debuginfo-2.639_k3.12.67_64-11.40.1 cloop-kmp-xen-2.639_k3.12.67_64-11.40.1 cloop-kmp-xen-debuginfo-2.639_k3.12.67_64-11.40.1 crash-7.0.2-2.40.1 crash-debuginfo-7.0.2-2.40.1 crash-debugsource-7.0.2-2.40.1 crash-devel-7.0.2-2.40.1 crash-doc-7.0.2-2.40.1 crash-eppic-7.0.2-2.40.1 crash-eppic-debuginfo-7.0.2-2.40.1 crash-gcore-7.0.2-2.40.1 crash-gcore-debuginfo-7.0.2-2.40.1 crash-kmp-default-7.0.2_k3.12.67_64-2.40.1 crash-kmp-default-debuginfo-7.0.2_k3.12.67_64-2.40.1 crash-kmp-desktop-7.0.2_k3.12.67_64-2.40.1 crash-kmp-desktop-debuginfo-7.0.2_k3.12.67_64-2.40.1 crash-kmp-xen-7.0.2_k3.12.67_64-2.40.1 crash-kmp-xen-debuginfo-7.0.2_k3.12.67_64-2.40.1 hdjmod-debugsource-1.28-16.40.1 hdjmod-kmp-default-1.28_k3.12.67_64-16.40.1 hdjmod-kmp-default-debuginfo-1.28_k3.12.67_64-16.40.1 hdjmod-kmp-desktop-1.28_k3.12.67_64-16.40.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.12.67_64-16.40.1 hdjmod-kmp-xen-1.28_k3.12.67_64-16.40.1 hdjmod-kmp-xen-debuginfo-1.28_k3.12.67_64-16.40.1 ipset-6.21.1-2.44.1 ipset-debuginfo-6.21.1-2.44.1 ipset-debugsource-6.21.1-2.44.1 ipset-devel-6.21.1-2.44.1 ipset-kmp-default-6.21.1_k3.12.67_64-2.44.1 ipset-kmp-default-debuginfo-6.21.1_k3.12.67_64-2.44.1 ipset-kmp-desktop-6.21.1_k3.12.67_64-2.44.1 ipset-kmp-desktop-debuginfo-6.21.1_k3.12.67_64-2.44.1 ipset-kmp-xen-6.21.1_k3.12.67_64-2.44.1 ipset-kmp-xen-debuginfo-6.21.1_k3.12.67_64-2.44.1 iscsitarget-1.4.20.3-13.40.1 iscsitarget-debuginfo-1.4.20.3-13.40.1 iscsitarget-debugsource-1.4.20.3-13.40.1 iscsitarget-kmp-default-1.4.20.3_k3.12.67_64-13.40.1 iscsitarget-kmp-default-debuginfo-1.4.20.3_k3.12.67_64-13.40.1 iscsitarget-kmp-desktop-1.4.20.3_k3.12.67_64-13.40.1 iscsitarget-kmp-desktop-debuginfo-1.4.20.3_k3.12.67_64-13.40.1 iscsitarget-kmp-xen-1.4.20.3_k3.12.67_64-13.40.1 iscsitarget-kmp-xen-debuginfo-1.4.20.3_k3.12.67_64-13.40.1 kernel-default-3.12.67-64.1 kernel-default-base-3.12.67-64.1 kernel-default-base-debuginfo-3.12.67-64.1 kernel-default-debuginfo-3.12.67-64.1 kernel-default-debugsource-3.12.67-64.1 kernel-default-devel-3.12.67-64.1 kernel-syms-3.12.67-64.1 libipset3-6.21.1-2.44.1 libipset3-debuginfo-6.21.1-2.44.1 ndiswrapper-1.58-41.1 ndiswrapper-debuginfo-1.58-41.1 ndiswrapper-debugsource-1.58-41.1 ndiswrapper-kmp-default-1.58_k3.12.67_64-41.1 ndiswrapper-kmp-default-debuginfo-1.58_k3.12.67_64-41.1 ndiswrapper-kmp-desktop-1.58_k3.12.67_64-41.1 ndiswrapper-kmp-desktop-debuginfo-1.58_k3.12.67_64-41.1 openvswitch-1.11.0-0.47.1 openvswitch-controller-1.11.0-0.47.1 openvswitch-controller-debuginfo-1.11.0-0.47.1 openvswitch-debuginfo-1.11.0-0.47.1 openvswitch-debugsource-1.11.0-0.47.1 openvswitch-kmp-default-1.11.0_k3.12.67_64-0.47.1 openvswitch-kmp-default-debuginfo-1.11.0_k3.12.67_64-0.47.1 openvswitch-kmp-desktop-1.11.0_k3.12.67_64-0.47.1 openvswitch-kmp-desktop-debuginfo-1.11.0_k3.12.67_64-0.47.1 openvswitch-kmp-xen-1.11.0_k3.12.67_64-0.47.1 openvswitch-kmp-xen-debuginfo-1.11.0_k3.12.67_64-0.47.1 openvswitch-pki-1.11.0-0.47.1 openvswitch-switch-1.11.0-0.47.1 openvswitch-switch-debuginfo-1.11.0-0.47.1 openvswitch-test-1.11.0-0.47.1 pcfclock-0.44-258.41.1 pcfclock-debuginfo-0.44-258.41.1 pcfclock-debugsource-0.44-258.41.1 pcfclock-kmp-default-0.44_k3.12.67_64-258.41.1 pcfclock-kmp-default-debuginfo-0.44_k3.12.67_64-258.41.1 pcfclock-kmp-desktop-0.44_k3.12.67_64-258.41.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.12.67_64-258.41.1 python-openvswitch-1.11.0-0.47.1 python-openvswitch-test-1.11.0-0.47.1 python-virtualbox-4.2.36-2.72.1 python-virtualbox-debuginfo-4.2.36-2.72.1 vhba-kmp-debugsource-20130607-2.40.1 vhba-kmp-default-20130607_k3.12.67_64-2.40.1 vhba-kmp-default-debuginfo-20130607_k3.12.67_64-2.40.1 vhba-kmp-desktop-20130607_k3.12.67_64-2.40.1 vhba-kmp-desktop-debuginfo-20130607_k3.12.67_64-2.40.1 vhba-kmp-xen-20130607_k3.12.67_64-2.40.1 vhba-kmp-xen-debuginfo-20130607_k3.12.67_64-2.40.1 virtualbox-4.2.36-2.72.1 virtualbox-debuginfo-4.2.36-2.72.1 virtualbox-debugsource-4.2.36-2.72.1 virtualbox-devel-4.2.36-2.72.1 virtualbox-guest-kmp-default-4.2.36_k3.12.67_64-2.72.1 virtualbox-guest-kmp-default-debuginfo-4.2.36_k3.12.67_64-2.72.1 virtualbox-guest-kmp-desktop-4.2.36_k3.12.67_64-2.72.1 virtualbox-guest-kmp-desktop-debuginfo-4.2.36_k3.12.67_64-2.72.1 virtualbox-guest-tools-4.2.36-2.72.1 virtualbox-guest-tools-debuginfo-4.2.36-2.72.1 virtualbox-guest-x11-4.2.36-2.72.1 virtualbox-guest-x11-debuginfo-4.2.36-2.72.1 virtualbox-host-kmp-default-4.2.36_k3.12.67_64-2.72.1 virtualbox-host-kmp-default-debuginfo-4.2.36_k3.12.67_64-2.72.1 virtualbox-host-kmp-desktop-4.2.36_k3.12.67_64-2.72.1 virtualbox-host-kmp-desktop-debuginfo-4.2.36_k3.12.67_64-2.72.1 virtualbox-qt-4.2.36-2.72.1 virtualbox-qt-debuginfo-4.2.36-2.72.1 virtualbox-websrv-4.2.36-2.72.1 virtualbox-websrv-debuginfo-4.2.36-2.72.1 xen-debugsource-4.3.4_10-73.1 xen-devel-4.3.4_10-73.1 xen-kmp-default-4.3.4_10_k3.12.67_64-73.1 xen-kmp-default-debuginfo-4.3.4_10_k3.12.67_64-73.1 xen-kmp-desktop-4.3.4_10_k3.12.67_64-73.1 xen-kmp-desktop-debuginfo-4.3.4_10_k3.12.67_64-73.1 xen-libs-4.3.4_10-73.1 xen-libs-debuginfo-4.3.4_10-73.1 xen-tools-domU-4.3.4_10-73.1 xen-tools-domU-debuginfo-4.3.4_10-73.1 xtables-addons-2.3-2.39.1 xtables-addons-debuginfo-2.3-2.39.1 xtables-addons-debugsource-2.3-2.39.1 xtables-addons-kmp-default-2.3_k3.12.67_64-2.39.1 xtables-addons-kmp-default-debuginfo-2.3_k3.12.67_64-2.39.1 xtables-addons-kmp-desktop-2.3_k3.12.67_64-2.39.1 xtables-addons-kmp-desktop-debuginfo-2.3_k3.12.67_64-2.39.1 xtables-addons-kmp-xen-2.3_k3.12.67_64-2.39.1 xtables-addons-kmp-xen-debuginfo-2.3_k3.12.67_64-2.39.1 - openSUSE 13.1 (i686 x86_64): kernel-debug-3.12.67-64.1 kernel-debug-base-3.12.67-64.1 kernel-debug-base-debuginfo-3.12.67-64.1 kernel-debug-debuginfo-3.12.67-64.1 kernel-debug-debugsource-3.12.67-64.1 kernel-debug-devel-3.12.67-64.1 kernel-debug-devel-debuginfo-3.12.67-64.1 kernel-desktop-3.12.67-64.1 kernel-desktop-base-3.12.67-64.1 kernel-desktop-base-debuginfo-3.12.67-64.1 kernel-desktop-debuginfo-3.12.67-64.1 kernel-desktop-debugsource-3.12.67-64.1 kernel-desktop-devel-3.12.67-64.1 kernel-ec2-3.12.67-64.1 kernel-ec2-base-3.12.67-64.1 kernel-ec2-base-debuginfo-3.12.67-64.1 kernel-ec2-debuginfo-3.12.67-64.1 kernel-ec2-debugsource-3.12.67-64.1 kernel-ec2-devel-3.12.67-64.1 kernel-trace-3.12.67-64.1 kernel-trace-base-3.12.67-64.1 kernel-trace-base-debuginfo-3.12.67-64.1 kernel-trace-debuginfo-3.12.67-64.1 kernel-trace-debugsource-3.12.67-64.1 kernel-trace-devel-3.12.67-64.1 kernel-vanilla-3.12.67-64.1 kernel-vanilla-debuginfo-3.12.67-64.1 kernel-vanilla-debugsource-3.12.67-64.1 kernel-vanilla-devel-3.12.67-64.1 kernel-xen-3.12.67-64.1 kernel-xen-base-3.12.67-64.1 kernel-xen-base-debuginfo-3.12.67-64.1 kernel-xen-debuginfo-3.12.67-64.1 kernel-xen-debugsource-3.12.67-64.1 kernel-xen-devel-3.12.67-64.1 - openSUSE 13.1 (x86_64): xen-4.3.4_10-73.1 xen-doc-html-4.3.4_10-73.1 xen-libs-32bit-4.3.4_10-73.1 xen-libs-debuginfo-32bit-4.3.4_10-73.1 xen-tools-4.3.4_10-73.1 xen-tools-debuginfo-4.3.4_10-73.1 xen-xend-tools-4.3.4_10-73.1 xen-xend-tools-debuginfo-4.3.4_10-73.1 - openSUSE 13.1 (noarch): kernel-devel-3.12.67-64.1 kernel-docs-3.12.67-64.2 kernel-macros-3.12.67-64.1 kernel-source-3.12.67-64.1 kernel-source-vanilla-3.12.67-64.1 virtualbox-host-source-4.2.36-2.72.1 - openSUSE 13.1 (i686): kernel-pae-3.12.67-64.1 kernel-pae-base-3.12.67-64.1 kernel-pae-base-debuginfo-3.12.67-64.1 kernel-pae-debuginfo-3.12.67-64.1 kernel-pae-debugsource-3.12.67-64.1 kernel-pae-devel-3.12.67-64.1 - openSUSE 13.1 (i586): cloop-kmp-pae-2.639_k3.12.67_64-11.40.1 cloop-kmp-pae-debuginfo-2.639_k3.12.67_64-11.40.1 crash-kmp-pae-7.0.2_k3.12.67_64-2.40.1 crash-kmp-pae-debuginfo-7.0.2_k3.12.67_64-2.40.1 hdjmod-kmp-pae-1.28_k3.12.67_64-16.40.1 hdjmod-kmp-pae-debuginfo-1.28_k3.12.67_64-16.40.1 ipset-kmp-pae-6.21.1_k3.12.67_64-2.44.1 ipset-kmp-pae-debuginfo-6.21.1_k3.12.67_64-2.44.1 iscsitarget-kmp-pae-1.4.20.3_k3.12.67_64-13.40.1 iscsitarget-kmp-pae-debuginfo-1.4.20.3_k3.12.67_64-13.40.1 ndiswrapper-kmp-pae-1.58_k3.12.67_64-41.1 ndiswrapper-kmp-pae-debuginfo-1.58_k3.12.67_64-41.1 openvswitch-kmp-pae-1.11.0_k3.12.67_64-0.47.1 openvswitch-kmp-pae-debuginfo-1.11.0_k3.12.67_64-0.47.1 pcfclock-kmp-pae-0.44_k3.12.67_64-258.41.1 pcfclock-kmp-pae-debuginfo-0.44_k3.12.67_64-258.41.1 vhba-kmp-pae-20130607_k3.12.67_64-2.40.1 vhba-kmp-pae-debuginfo-20130607_k3.12.67_64-2.40.1 virtualbox-guest-kmp-pae-4.2.36_k3.12.67_64-2.72.1 virtualbox-guest-kmp-pae-debuginfo-4.2.36_k3.12.67_64-2.72.1 virtualbox-host-kmp-pae-4.2.36_k3.12.67_64-2.72.1 virtualbox-host-kmp-pae-debuginfo-4.2.36_k3.12.67_64-2.72.1 xen-kmp-pae-4.3.4_10_k3.12.67_64-73.1 xen-kmp-pae-debuginfo-4.3.4_10_k3.12.67_64-73.1 xtables-addons-kmp-pae-2.3_k3.12.67_64-2.39.1 xtables-addons-kmp-pae-debuginfo-2.3_k3.12.67_64-2.39.1 References: https://www.suse.com/security/cve/CVE-2016-9576.html https://www.suse.com/security/cve/CVE-2016-9794.html https://bugzilla.suse.com/1013533 https://bugzilla.suse.com/1013604

1 0

openSUSE-SU-2016:3108-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 13 Dec '16

13 Dec '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3108-1 Rating: important References: #1013236 Cross-References: CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5209 CVE-2016-5210 CVE-2016-5211 CVE-2016-5212 CVE-2016-5213 CVE-2016-5214 CVE-2016-5215 CVE-2016-5216 CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5220 CVE-2016-5221 CVE-2016-5222 CVE-2016-5223 CVE-2016-5224 CVE-2016-5225 CVE-2016-5226 CVE-2016-9650 CVE-2016-9651 CVE-2016-9652 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update to Chromium 55.0.2883.75 fixes the following vulnerabilities: - CVE-2016-9651: Private property access in V8 - CVE-2016-5208: Universal XSS in Blink - CVE-2016-5207: Universal XSS in Blink - CVE-2016-5206: Same-origin bypass in PDFium - CVE-2016-5205: Universal XSS in Blink - CVE-2016-5204: Universal XSS in Blink - CVE-2016-5209: Out of bounds write in Blink - CVE-2016-5203: Use after free in PDFium - CVE-2016-5210: Out of bounds write in PDFium - CVE-2016-5212: Local file disclosure in DevTools - CVE-2016-5211: Use after free in PDFium - CVE-2016-5213: Use after free in V8 - CVE-2016-5214: File download protection bypass - CVE-2016-5216: Use after free in PDFium - CVE-2016-5215: Use after free in Webaudio - CVE-2016-5217: Use of unvalidated data in PDFium - CVE-2016-5218: Address spoofing in Omnibox - CVE-2016-5219: Use after free in V8 - CVE-2016-5221: Integer overflow in ANGLE - CVE-2016-5220: Local file access in PDFium - CVE-2016-5222: Address spoofing in Omnibox - CVE-2016-9650: CSP Referrer disclosure - CVE-2016-5223: Integer overflow in PDFium - CVE-2016-5226: Limited XSS in Blink - CVE-2016-5225: CSP bypass in Blink - CVE-2016-5224: Same-origin bypass in SVG - CVE-2016-9652: Various fixes from internal audits, fuzzing and other initiatives The default bookmarks override was removed. The following packaging changes are included: - Switch to system libraries: harfbuzz, zlib, ffmpeg, where available. - Chromium now requires harfbuzz >= 1.3.0 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1453=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1453=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1453=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-55.0.2883.75-99.2 chromedriver-debuginfo-55.0.2883.75-99.2 chromium-55.0.2883.75-99.2 chromium-debuginfo-55.0.2883.75-99.2 chromium-debugsource-55.0.2883.75-99.2 - openSUSE Leap 42.1 (x86_64): chromedriver-55.0.2883.75-99.2 chromedriver-debuginfo-55.0.2883.75-99.2 chromium-55.0.2883.75-99.2 chromium-debuginfo-55.0.2883.75-99.2 chromium-debugsource-55.0.2883.75-99.2 - openSUSE 13.2 (i586 x86_64): chromedriver-55.0.2883.75-148.1 chromedriver-debuginfo-55.0.2883.75-148.1 chromium-55.0.2883.75-148.1 chromium-debuginfo-55.0.2883.75-148.1 chromium-debugsource-55.0.2883.75-148.1 chromium-ffmpegsumo-55.0.2883.75-148.1 chromium-ffmpegsumo-debuginfo-55.0.2883.75-148.1 References: https://www.suse.com/security/cve/CVE-2016-5203.html https://www.suse.com/security/cve/CVE-2016-5204.html https://www.suse.com/security/cve/CVE-2016-5205.html https://www.suse.com/security/cve/CVE-2016-5206.html https://www.suse.com/security/cve/CVE-2016-5207.html https://www.suse.com/security/cve/CVE-2016-5208.html https://www.suse.com/security/cve/CVE-2016-5209.html https://www.suse.com/security/cve/CVE-2016-5210.html https://www.suse.com/security/cve/CVE-2016-5211.html https://www.suse.com/security/cve/CVE-2016-5212.html https://www.suse.com/security/cve/CVE-2016-5213.html https://www.suse.com/security/cve/CVE-2016-5214.html https://www.suse.com/security/cve/CVE-2016-5215.html https://www.suse.com/security/cve/CVE-2016-5216.html https://www.suse.com/security/cve/CVE-2016-5217.html https://www.suse.com/security/cve/CVE-2016-5218.html https://www.suse.com/security/cve/CVE-2016-5219.html https://www.suse.com/security/cve/CVE-2016-5220.html https://www.suse.com/security/cve/CVE-2016-5221.html https://www.suse.com/security/cve/CVE-2016-5222.html https://www.suse.com/security/cve/CVE-2016-5223.html https://www.suse.com/security/cve/CVE-2016-5224.html https://www.suse.com/security/cve/CVE-2016-5225.html https://www.suse.com/security/cve/CVE-2016-5226.html https://www.suse.com/security/cve/CVE-2016-9650.html https://www.suse.com/security/cve/CVE-2016-9651.html https://www.suse.com/security/cve/CVE-2016-9652.html https://bugzilla.suse.com/1013236

1 0

openSUSE-RU-2016:3106-1: Recommended update for clamav-database
by maintenance＠opensuse.org 13 Dec '16

13 Dec '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:3106-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Dec 12th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1452=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1452=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201612120615-15.1 - openSUSE Leap 42.1 (noarch): clamav-database-201612120615-194.1 References:

1 0

openSUSE-SU-2016:3103-1: important: Security update for qemu
by opensuse-security＠opensuse.org 12 Dec '16

12 Dec '16

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3103-1 Rating: important References: #1000345 #1001151 #1002116 #1002550 #1002557 #1003878 #1003893 #1003894 #1004702 #1004707 #1006536 #1006538 #1007391 #1007450 #1007454 #1007493 #1007494 #1007495 #996524 #998516 #999661 Cross-References: CVE-2016-7161 CVE-2016-7170 CVE-2016-7421 CVE-2016-7466 CVE-2016-7908 CVE-2016-7909 CVE-2016-8576 CVE-2016-8577 CVE-2016-8578 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9101 CVE-2016-9102 CVE-2016-9103 CVE-2016-9104 CVE-2016-9105 CVE-2016-9106 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has two fixes is now available. Description: This update for qemu fixes the following issues: - Patch queue updated from https://gitlab.suse.de/virtualization/qemu.git SLE12-SP1 - Change package post script udevadm trigger calls to be device specific (bsc#1002116) - Address various security/stability issues * Fix OOB access in xlnx.xpx-ethernetlite emulation (CVE-2016-7161 bsc#1001151) * Fix OOB access in VMware SVGA emulation (CVE-2016-7170 bsc#998516) * Fix DOS in USB xHCI emulation (CVE-2016-7466 bsc#1000345) * Fix DOS in Vmware pv scsi interface (CVE-2016-7421 bsc#999661) * Fix DOS in ColdFire Fast Ethernet Controller emulation (CVE-2016-7908 bsc#1002550) * Fix DOS in USB xHCI emulation (CVE-2016-8576 bsc#1003878) * Fix DOS in virtio-9pfs (CVE-2016-8578 bsc#1003894) * Fix DOS in virtio-9pfs (CVE-2016-9105 bsc#1007494) * Fix DOS in virtio-9pfs (CVE-2016-8577 bsc#1003893) * Plug data leak in virtio-9pfs interface (CVE-2016-9103 bsc#1007454) * Fix DOS in virtio-9pfs interface (CVE-2016-9102 bsc#1007450) * Fix DOS in virtio-9pfs (CVE-2016-9106 bsc#1007495) * Fix DOS in 16550A UART emulation (CVE-2016-8669 bsc#1004707) * Fix DOS in PC-Net II emulation (CVE-2016-7909 bsc#1002557) * Fix DOS in PRO100 emulation (CVE-2016-9101 bsc#1007391) * Fix DOS in RTL8139 emulation (CVE-2016-8910 bsc#1006538) * Fix DOS in Intel HDA controller emulation (CVE-2016-8909 bsc#1006536) * Fix DOS in virtio-9pfs (CVE-2016-9104 bsc#1007493) * Fix DOS in JAZZ RC4030 emulation (CVE-2016-8667 bsc#1004702) - Fix case of disk corruption with migration due to improper internal state tracking (bsc#996524) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1451=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): qemu-2.3.1-22.1 qemu-arm-2.3.1-22.1 qemu-arm-debuginfo-2.3.1-22.1 qemu-block-curl-2.3.1-22.1 qemu-block-curl-debuginfo-2.3.1-22.1 qemu-debugsource-2.3.1-22.1 qemu-extra-2.3.1-22.1 qemu-extra-debuginfo-2.3.1-22.1 qemu-guest-agent-2.3.1-22.1 qemu-guest-agent-debuginfo-2.3.1-22.1 qemu-kvm-2.3.1-22.1 qemu-lang-2.3.1-22.1 qemu-linux-user-2.3.1-22.1 qemu-linux-user-debuginfo-2.3.1-22.1 qemu-linux-user-debugsource-2.3.1-22.1 qemu-ppc-2.3.1-22.1 qemu-ppc-debuginfo-2.3.1-22.1 qemu-s390-2.3.1-22.1 qemu-s390-debuginfo-2.3.1-22.1 qemu-tools-2.3.1-22.1 qemu-tools-debuginfo-2.3.1-22.1 qemu-x86-2.3.1-22.1 qemu-x86-debuginfo-2.3.1-22.1 - openSUSE Leap 42.1 (x86_64): qemu-block-rbd-2.3.1-22.1 qemu-block-rbd-debuginfo-2.3.1-22.1 qemu-testsuite-2.3.1-22.2 - openSUSE Leap 42.1 (noarch): qemu-ipxe-1.0.0-22.1 qemu-seabios-1.8.1-22.1 qemu-sgabios-8-22.1 qemu-vgabios-1.8.1-22.1 References: https://www.suse.com/security/cve/CVE-2016-7161.html https://www.suse.com/security/cve/CVE-2016-7170.html https://www.suse.com/security/cve/CVE-2016-7421.html https://www.suse.com/security/cve/CVE-2016-7466.html https://www.suse.com/security/cve/CVE-2016-7908.html https://www.suse.com/security/cve/CVE-2016-7909.html https://www.suse.com/security/cve/CVE-2016-8576.html https://www.suse.com/security/cve/CVE-2016-8577.html https://www.suse.com/security/cve/CVE-2016-8578.html https://www.suse.com/security/cve/CVE-2016-8667.html https://www.suse.com/security/cve/CVE-2016-8669.html https://www.suse.com/security/cve/CVE-2016-8909.html https://www.suse.com/security/cve/CVE-2016-8910.html https://www.suse.com/security/cve/CVE-2016-9101.html https://www.suse.com/security/cve/CVE-2016-9102.html https://www.suse.com/security/cve/CVE-2016-9103.html https://www.suse.com/security/cve/CVE-2016-9104.html https://www.suse.com/security/cve/CVE-2016-9105.html https://www.suse.com/security/cve/CVE-2016-9106.html https://bugzilla.suse.com/1000345 https://bugzilla.suse.com/1001151 https://bugzilla.suse.com/1002116 https://bugzilla.suse.com/1002550 https://bugzilla.suse.com/1002557 https://bugzilla.suse.com/1003878 https://bugzilla.suse.com/1003893 https://bugzilla.suse.com/1003894 https://bugzilla.suse.com/1004702 https://bugzilla.suse.com/1004707 https://bugzilla.suse.com/1006536 https://bugzilla.suse.com/1006538 https://bugzilla.suse.com/1007391 https://bugzilla.suse.com/1007450 https://bugzilla.suse.com/1007454 https://bugzilla.suse.com/1007493 https://bugzilla.suse.com/1007494 https://bugzilla.suse.com/1007495 https://bugzilla.suse.com/996524 https://bugzilla.suse.com/998516 https://bugzilla.suse.com/999661

1 0

openSUSE-SU-2016:3102-1: moderate: Security update for util-linux
by opensuse-security＠opensuse.org 12 Dec '16

12 Dec '16

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3102-1 Rating: moderate References: #947494 #966891 #982331 #987176 #988361 #990531 #994399 Cross-References: CVE-2016-5011 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for util-linux fixes the following issues: - Consider redundant slashes when comparing paths (bsc#982331, util-linux-libmount-ignore-redundant-slashes.patch, affects backport of util-linux-libmount-cifs-is_mounted.patch). - Use upstream compatibility patches for --show-pt-geometry with obsolescence and deprecation warning (bsc#990531) - Replace cifs mount detection patch with upstream one that covers all cases (bsc#987176). - Reuse existing loop device to prevent possible data corruption when multiple -o loop are used to mount a single file (bsc#947494) - Safe loop re-use in libmount, mount and losetup (bsc#947494) - UPSTREAM DIVERGENCE!!! losetup -L continues to use SLE12 SP1 and SP2 specific meaning --logical-blocksize instead of upstream --nooverlap (bsc#966891). - Make release-dependent conflict with old sysvinit-tools SLE specific, as it is required only for SLE 11 upgrade, and breaks openSUSE staging builds (bsc#994399). - Extended partition loop in MBR partition table leads to DoS (bsc#988361, CVE-2016-5011) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1446=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libblkid-devel-2.28-7.1 libblkid-devel-static-2.28-7.1 libblkid1-2.28-7.1 libblkid1-debuginfo-2.28-7.1 libfdisk-devel-2.28-7.1 libfdisk-devel-static-2.28-7.1 libfdisk1-2.28-7.1 libfdisk1-debuginfo-2.28-7.1 libmount-devel-2.28-7.1 libmount-devel-static-2.28-7.1 libmount1-2.28-7.1 libmount1-debuginfo-2.28-7.1 libsmartcols-devel-2.28-7.1 libsmartcols-devel-static-2.28-7.1 libsmartcols1-2.28-7.1 libsmartcols1-debuginfo-2.28-7.1 libuuid-devel-2.28-7.1 libuuid-devel-static-2.28-7.1 libuuid1-2.28-7.1 libuuid1-debuginfo-2.28-7.1 python-libmount-2.28-7.2 python-libmount-debuginfo-2.28-7.2 python-libmount-debugsource-2.28-7.2 util-linux-2.28-7.1 util-linux-debuginfo-2.28-7.1 util-linux-debugsource-2.28-7.1 util-linux-systemd-2.28-7.1 util-linux-systemd-debuginfo-2.28-7.1 util-linux-systemd-debugsource-2.28-7.1 uuidd-2.28-7.1 uuidd-debuginfo-2.28-7.1 - openSUSE Leap 42.2 (noarch): util-linux-lang-2.28-7.1 - openSUSE Leap 42.2 (x86_64): libblkid-devel-32bit-2.28-7.1 libblkid1-32bit-2.28-7.1 libblkid1-debuginfo-32bit-2.28-7.1 libmount-devel-32bit-2.28-7.1 libmount1-32bit-2.28-7.1 libmount1-debuginfo-32bit-2.28-7.1 libuuid-devel-32bit-2.28-7.1 libuuid1-32bit-2.28-7.1 libuuid1-debuginfo-32bit-2.28-7.1 References: https://www.suse.com/security/cve/CVE-2016-5011.html https://bugzilla.suse.com/947494 https://bugzilla.suse.com/966891 https://bugzilla.suse.com/982331 https://bugzilla.suse.com/987176 https://bugzilla.suse.com/988361 https://bugzilla.suse.com/990531 https://bugzilla.suse.com/994399

1 0

openSUSE-SU-2016:3101-1: moderate: Security update for pacemaker
by opensuse-security＠opensuse.org 12 Dec '16

12 Dec '16

openSUSE Security Update: Security update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3101-1 Rating: moderate References: #1000743 #1002767 #1003565 #1007433 #1009076 #967388 #986644 #987348 #995365 Cross-References: CVE-2016-7035 CVE-2016-7797 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for pacemaker fixes the following issues: - remote: Allow cluster and remote LRM API versions to diverge (bsc#1009076) - libcrmcommon: fix CVE-2016-7035 (improper IPC guarding) (bsc#1007433) - sysconfig: minor tweaks (typo, wording) - spec: more robust check for systemd being in use - spec: defines instead of some globals + error suppression - various: issues discovered via valgrind and coverity - attrd_updater: fix usage of HAVE_ATOMIC_ATTRD - crmd: cl#5185 - Record pending operations in the CIB before they are performed (bsc#1003565) - ClusterMon: fix to avoid matching other process with the same PID - mcp: improve comments for sysconfig options - remove openssl-devel and libselinux-devel as build dependencies - tools: crm_standby --version/--help should work without cluster - libpengine: only log startup-fencing warning once - pacemaker.service: do not mistakenly suggest killing fenced - libcrmcommon: report errors consistently when waiting for data on connection (bsc#986644) - remote: Correctly calculate the remaining timeouts when receiving messages (bsc#986644) - libfencing: report added node ID correctly - crm_mon: Do not call setenv with null value - pengine: Do not fence a maintenance node if it shuts down cleanly (bsc#1000743) - ping: Avoid temporary files for fping check (bsc#987348) - all: clarify licensing and copyrights - crmd: Resend the shutdown request if the DC forgets - ping: Avoid temp files in fping_check (bsc#987348) - crmd: Ensure the R_SHUTDOWN is set whenever we ask the DC to shut us down - crmd: clear remote node operation history only when it comes up - libcib,libfencing,libtransition: handle memory allocation errors without CRM_CHECK() - tools: make crm_mon XML schema handle resources with multiple active - pengine: set OCF_RESKEY_CRM_meta_notify_active_* for multistate resources - pengine: avoid null dereference in new same-node ordering option - lrmd,libcluster: ensure g_hash_table_foreach() is never passed a null table - crmd: don't log warning if abort_unless_down() can't find down event - lib: Correction of the deletion of the notice registration. - stonithd: Correction of the wrong connection process name. - crmd: Keep a state of LRMD in the DC node latest. - pengine: avoid transition loop for start-then-stop + unfencing - libpengine: allow pe_order_same_node option for constraints - cts: Restart systemd-journald with "systemctl restart systemd-journald.socket" (bsc#995365) - libcrmcommon: properly handle XML comments when comparing v2 patchset diffs - crmd: don't abort transitions for CIB comment changes - libcrmcommon: log XML comments correctly - libcrmcommon: remove extraneous format specifier from log message - remote: cl#5269 - Notify other clients of a new connection only if the handshake has completed (bsc#967388, bsc#1002767, CVE-2016-7797) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1447=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libpacemaker-devel-1.1.13-23.2 libpacemaker3-1.1.13-23.2 libpacemaker3-debuginfo-1.1.13-23.2 pacemaker-1.1.13-23.2 pacemaker-cli-1.1.13-23.2 pacemaker-cli-debuginfo-1.1.13-23.2 pacemaker-cts-1.1.13-23.2 pacemaker-cts-debuginfo-1.1.13-23.2 pacemaker-debuginfo-1.1.13-23.2 pacemaker-debugsource-1.1.13-23.2 pacemaker-remote-1.1.13-23.2 pacemaker-remote-debuginfo-1.1.13-23.2 References: https://www.suse.com/security/cve/CVE-2016-7035.html https://www.suse.com/security/cve/CVE-2016-7797.html https://bugzilla.suse.com/1000743 https://bugzilla.suse.com/1002767 https://bugzilla.suse.com/1003565 https://bugzilla.suse.com/1007433 https://bugzilla.suse.com/1009076 https://bugzilla.suse.com/967388 https://bugzilla.suse.com/986644 https://bugzilla.suse.com/987348 https://bugzilla.suse.com/995365

1 0

openSUSE-SU-2016:3099-1: moderate: Security update for pcre
by opensuse-security＠opensuse.org 12 Dec '16

12 Dec '16

openSUSE Security Update: Security update for pcre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3099-1 Rating: moderate References: #906574 #924960 #933288 #933878 #936227 #942865 #957566 #957567 #957598 #957600 #960837 #971741 #972127 Cross-References: CVE-2014-8964 CVE-2015-2325 CVE-2015-2327 CVE-2015-2328 CVE-2015-3210 CVE-2015-3217 CVE-2015-5073 CVE-2015-8380 CVE-2015-8381 CVE-2015-8382 CVE-2015-8383 CVE-2015-8384 CVE-2015-8385 CVE-2015-8386 CVE-2015-8387 CVE-2015-8388 CVE-2015-8389 CVE-2015-8390 CVE-2015-8391 CVE-2015-8392 CVE-2015-8393 CVE-2015-8394 CVE-2015-8395 CVE-2016-1283 CVE-2016-3191 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This update for pcre to version 8.39 (bsc#972127) fixes several issues. If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version. This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed: - CVE-2014-8964: Heap-based buffer overflow in PCRE allowed remote attackers to cause a denial of service (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that allows zero repeats (bsc#906574). - CVE-2015-2325: Heap buffer overflow in compile_branch() (bsc#924960). - CVE-2015-3210: Heap buffer overflow in pcre_compile2() / compile_regex() (bsc#933288) - CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match() (bsc#933878). - CVE-2015-5073: Library Heap Overflow Vulnerability in find_fixedlength() (bsc#936227). - bsc#942865: heap overflow in compile_regex() - CVE-2015-8380: The pcre_exec function in pcre_exec.c mishandled a // pattern with a \01 string, which allowed remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror (bsc#957566). - CVE-2015-2327: PCRE mishandled certain patterns with internal recursive back references, which allowed remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror (bsc#957567). - bsc#957598: Various security issues - CVE-2015-8381: Heap Overflow in compile_regex() (bsc#957598). - CVE-2015-8382: Regular Expression Uninitialized Pointer Information Disclosure Vulnerability (ZDI-CAN-2547)(bsc#957598). - CVE-2015-8383: Buffer overflow caused by repeated conditional group(bsc#957598). - CVE-2015-8384: Buffer overflow caused by recursive back reference by name within certain group(bsc#957598). - CVE-2015-8385: Buffer overflow caused by forward reference by name to certain group(bsc#957598). - CVE-2015-8386: Buffer overflow caused by lookbehind assertion(bsc#957598). - CVE-2015-8387: Integer overflow in subroutine calls(bsc#957598). - CVE-2015-8388: Buffer overflow caused by certain patterns with an unmatched closing parenthesis(bsc#957598). - CVE-2015-8389: Infinite recursion in JIT compiler when processing certain patterns(bsc#957598). - CVE-2015-8390: Reading from uninitialized memory when processing certain patterns(bsc#957598). - CVE-2015-8391: Some pathological patterns causes pcre_compile() to run for a very long time(bsc#957598). - CVE-2015-8392: Buffer overflow caused by certain patterns with duplicated named groups(bsc#957598). - CVE-2015-8393: Information leak when running pcgrep -q on crafted binary(bsc#957598). - CVE-2015-8394: Integer overflow caused by missing check for certain conditions(bsc#957598). - CVE-2015-8395: Buffer overflow caused by certain references(bsc#957598). - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allowed remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression (bsc#957600). - CVE-2016-1283: The pcre_compile2 function in pcre_compile.c in PCRE mishandled certain patterns with named subgroups, which allowed remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression (bsc#960837). - CVE-2016-3191: The compile_branch function in pcre_compile.c in pcre2_compile.c mishandled patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allowed remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression (bsc#971741). These non-security issues were fixed: - JIT compiler improvements - performance improvements - The Unicode data tables have been updated to Unicode 7.0.0. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1448=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1448=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libpcre1-8.39-6.1 libpcre1-debuginfo-8.39-6.1 libpcre16-0-8.39-6.1 libpcre16-0-debuginfo-8.39-6.1 libpcrecpp0-8.39-6.1 libpcrecpp0-debuginfo-8.39-6.1 libpcreposix0-8.39-6.1 libpcreposix0-debuginfo-8.39-6.1 pcre-debugsource-8.39-6.1 pcre-devel-8.39-6.1 pcre-devel-static-8.39-6.1 pcre-tools-8.39-6.1 pcre-tools-debuginfo-8.39-6.1 - openSUSE Leap 42.2 (x86_64): libpcre1-32bit-8.39-6.1 libpcre1-debuginfo-32bit-8.39-6.1 libpcre16-0-32bit-8.39-6.1 libpcre16-0-debuginfo-32bit-8.39-6.1 libpcrecpp0-32bit-8.39-6.1 libpcrecpp0-debuginfo-32bit-8.39-6.1 libpcreposix0-32bit-8.39-6.1 libpcreposix0-debuginfo-32bit-8.39-6.1 - openSUSE Leap 42.2 (noarch): pcre-doc-8.39-6.1 - openSUSE Leap 42.1 (i586 x86_64): libpcre1-8.39-5.1 libpcre1-debuginfo-8.39-5.1 libpcre16-0-8.39-5.1 libpcre16-0-debuginfo-8.39-5.1 libpcrecpp0-8.39-5.1 libpcrecpp0-debuginfo-8.39-5.1 libpcreposix0-8.39-5.1 libpcreposix0-debuginfo-8.39-5.1 pcre-debugsource-8.39-5.1 pcre-devel-8.39-5.1 pcre-devel-static-8.39-5.1 pcre-tools-8.39-5.1 pcre-tools-debuginfo-8.39-5.1 - openSUSE Leap 42.1 (x86_64): libpcre1-32bit-8.39-5.1 libpcre1-debuginfo-32bit-8.39-5.1 libpcre16-0-32bit-8.39-5.1 libpcre16-0-debuginfo-32bit-8.39-5.1 libpcrecpp0-32bit-8.39-5.1 libpcrecpp0-debuginfo-32bit-8.39-5.1 libpcreposix0-32bit-8.39-5.1 libpcreposix0-debuginfo-32bit-8.39-5.1 - openSUSE Leap 42.1 (noarch): pcre-doc-8.39-5.1 References: https://www.suse.com/security/cve/CVE-2014-8964.html https://www.suse.com/security/cve/CVE-2015-2325.html https://www.suse.com/security/cve/CVE-2015-2327.html https://www.suse.com/security/cve/CVE-2015-2328.html https://www.suse.com/security/cve/CVE-2015-3210.html https://www.suse.com/security/cve/CVE-2015-3217.html https://www.suse.com/security/cve/CVE-2015-5073.html https://www.suse.com/security/cve/CVE-2015-8380.html https://www.suse.com/security/cve/CVE-2015-8381.html https://www.suse.com/security/cve/CVE-2015-8382.html https://www.suse.com/security/cve/CVE-2015-8383.html https://www.suse.com/security/cve/CVE-2015-8384.html https://www.suse.com/security/cve/CVE-2015-8385.html https://www.suse.com/security/cve/CVE-2015-8386.html https://www.suse.com/security/cve/CVE-2015-8387.html https://www.suse.com/security/cve/CVE-2015-8388.html https://www.suse.com/security/cve/CVE-2015-8389.html https://www.suse.com/security/cve/CVE-2015-8390.html https://www.suse.com/security/cve/CVE-2015-8391.html https://www.suse.com/security/cve/CVE-2015-8392.html https://www.suse.com/security/cve/CVE-2015-8393.html https://www.suse.com/security/cve/CVE-2015-8394.html https://www.suse.com/security/cve/CVE-2015-8395.html https://www.suse.com/security/cve/CVE-2016-1283.html https://www.suse.com/security/cve/CVE-2016-3191.html https://bugzilla.suse.com/906574 https://bugzilla.suse.com/924960 https://bugzilla.suse.com/933288 https://bugzilla.suse.com/933878 https://bugzilla.suse.com/936227 https://bugzilla.suse.com/942865 https://bugzilla.suse.com/957566 https://bugzilla.suse.com/957567 https://bugzilla.suse.com/957598 https://bugzilla.suse.com/957600 https://bugzilla.suse.com/960837 https://bugzilla.suse.com/971741 https://bugzilla.suse.com/972127

1 0

openSUSE-SU-2016:3097-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 12 Dec '16

12 Dec '16

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3097-1 Rating: moderate References: #1003810 Cross-References: CVE-2016-8568 CVE-2016-8569 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libgit2 was updated to fix two security issues. These security issues were fixed: - CVE-2016-8568: Read out-of-bounds in git_oid_nfmt (bsc#1003810). - CVE-2016-8569: DoS caused by a NULL pointer dereference in git_commit_message (bsc#1003810). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1450=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libgit2-24-0.24.1-3.1 libgit2-24-debuginfo-0.24.1-3.1 libgit2-debugsource-0.24.1-3.1 libgit2-devel-0.24.1-3.1 - openSUSE Leap 42.2 (x86_64): libgit2-24-32bit-0.24.1-3.1 libgit2-24-debuginfo-32bit-0.24.1-3.1 References: https://www.suse.com/security/cve/CVE-2016-8568.html https://www.suse.com/security/cve/CVE-2016-8569.html https://bugzilla.suse.com/1003810

1 0

openSUSE-SU-2016:3095-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 12 Dec '16

12 Dec '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:3095-1 Rating: moderate References: #1008029 #986247 Cross-References: CVE-2016-5773 CVE-2016-9137 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2016-9137: Use After Free in unserialize() (bsc#1008029) - CVE-2016-5773: ZipArchive class Use After Free Vulnerability in PHP's GC (bsc#986247) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2016-1449=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1449=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_php5-5.5.14-69.1 apache2-mod_php5-debuginfo-5.5.14-69.1 php5-5.5.14-69.1 php5-bcmath-5.5.14-69.1 php5-bcmath-debuginfo-5.5.14-69.1 php5-bz2-5.5.14-69.1 php5-bz2-debuginfo-5.5.14-69.1 php5-calendar-5.5.14-69.1 php5-calendar-debuginfo-5.5.14-69.1 php5-ctype-5.5.14-69.1 php5-ctype-debuginfo-5.5.14-69.1 php5-curl-5.5.14-69.1 php5-curl-debuginfo-5.5.14-69.1 php5-dba-5.5.14-69.1 php5-dba-debuginfo-5.5.14-69.1 php5-debuginfo-5.5.14-69.1 php5-debugsource-5.5.14-69.1 php5-devel-5.5.14-69.1 php5-dom-5.5.14-69.1 php5-dom-debuginfo-5.5.14-69.1 php5-enchant-5.5.14-69.1 php5-enchant-debuginfo-5.5.14-69.1 php5-exif-5.5.14-69.1 php5-exif-debuginfo-5.5.14-69.1 php5-fastcgi-5.5.14-69.1 php5-fastcgi-debuginfo-5.5.14-69.1 php5-fileinfo-5.5.14-69.1 php5-fileinfo-debuginfo-5.5.14-69.1 php5-firebird-5.5.14-69.1 php5-firebird-debuginfo-5.5.14-69.1 php5-fpm-5.5.14-69.1 php5-fpm-debuginfo-5.5.14-69.1 php5-ftp-5.5.14-69.1 php5-ftp-debuginfo-5.5.14-69.1 php5-gd-5.5.14-69.1 php5-gd-debuginfo-5.5.14-69.1 php5-gettext-5.5.14-69.1 php5-gettext-debuginfo-5.5.14-69.1 php5-gmp-5.5.14-69.1 php5-gmp-debuginfo-5.5.14-69.1 php5-iconv-5.5.14-69.1 php5-iconv-debuginfo-5.5.14-69.1 php5-imap-5.5.14-69.1 php5-imap-debuginfo-5.5.14-69.1 php5-intl-5.5.14-69.1 php5-intl-debuginfo-5.5.14-69.1 php5-json-5.5.14-69.1 php5-json-debuginfo-5.5.14-69.1 php5-ldap-5.5.14-69.1 php5-ldap-debuginfo-5.5.14-69.1 php5-mbstring-5.5.14-69.1 php5-mbstring-debuginfo-5.5.14-69.1 php5-mcrypt-5.5.14-69.1 php5-mcrypt-debuginfo-5.5.14-69.1 php5-mssql-5.5.14-69.1 php5-mssql-debuginfo-5.5.14-69.1 php5-mysql-5.5.14-69.1 php5-mysql-debuginfo-5.5.14-69.1 php5-odbc-5.5.14-69.1 php5-odbc-debuginfo-5.5.14-69.1 php5-opcache-5.5.14-69.1 php5-opcache-debuginfo-5.5.14-69.1 php5-openssl-5.5.14-69.1 php5-openssl-debuginfo-5.5.14-69.1 php5-pcntl-5.5.14-69.1 php5-pcntl-debuginfo-5.5.14-69.1 php5-pdo-5.5.14-69.1 php5-pdo-debuginfo-5.5.14-69.1 php5-pgsql-5.5.14-69.1 php5-pgsql-debuginfo-5.5.14-69.1 php5-phar-5.5.14-69.1 php5-phar-debuginfo-5.5.14-69.1 php5-posix-5.5.14-69.1 php5-posix-debuginfo-5.5.14-69.1 php5-pspell-5.5.14-69.1 php5-pspell-debuginfo-5.5.14-69.1 php5-readline-5.5.14-69.1 php5-readline-debuginfo-5.5.14-69.1 php5-shmop-5.5.14-69.1 php5-shmop-debuginfo-5.5.14-69.1 php5-snmp-5.5.14-69.1 php5-snmp-debuginfo-5.5.14-69.1 php5-soap-5.5.14-69.1 php5-soap-debuginfo-5.5.14-69.1 php5-sockets-5.5.14-69.1 php5-sockets-debuginfo-5.5.14-69.1 php5-sqlite-5.5.14-69.1 php5-sqlite-debuginfo-5.5.14-69.1 php5-suhosin-5.5.14-69.1 php5-suhosin-debuginfo-5.5.14-69.1 php5-sysvmsg-5.5.14-69.1 php5-sysvmsg-debuginfo-5.5.14-69.1 php5-sysvsem-5.5.14-69.1 php5-sysvsem-debuginfo-5.5.14-69.1 php5-sysvshm-5.5.14-69.1 php5-sysvshm-debuginfo-5.5.14-69.1 php5-tidy-5.5.14-69.1 php5-tidy-debuginfo-5.5.14-69.1 php5-tokenizer-5.5.14-69.1 php5-tokenizer-debuginfo-5.5.14-69.1 php5-wddx-5.5.14-69.1 php5-wddx-debuginfo-5.5.14-69.1 php5-xmlreader-5.5.14-69.1 php5-xmlreader-debuginfo-5.5.14-69.1 php5-xmlrpc-5.5.14-69.1 php5-xmlrpc-debuginfo-5.5.14-69.1 php5-xmlwriter-5.5.14-69.1 php5-xmlwriter-debuginfo-5.5.14-69.1 php5-xsl-5.5.14-69.1 php5-xsl-debuginfo-5.5.14-69.1 php5-zip-5.5.14-69.1 php5-zip-debuginfo-5.5.14-69.1 php5-zlib-5.5.14-69.1 php5-zlib-debuginfo-5.5.14-69.1 - openSUSE Leap 42.2 (noarch): php5-pear-5.5.14-69.1 - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-68.3 apache2-mod_php5-debuginfo-5.5.14-68.3 php5-5.5.14-68.3 php5-bcmath-5.5.14-68.3 php5-bcmath-debuginfo-5.5.14-68.3 php5-bz2-5.5.14-68.3 php5-bz2-debuginfo-5.5.14-68.3 php5-calendar-5.5.14-68.3 php5-calendar-debuginfo-5.5.14-68.3 php5-ctype-5.5.14-68.3 php5-ctype-debuginfo-5.5.14-68.3 php5-curl-5.5.14-68.3 php5-curl-debuginfo-5.5.14-68.3 php5-dba-5.5.14-68.3 php5-dba-debuginfo-5.5.14-68.3 php5-debuginfo-5.5.14-68.3 php5-debugsource-5.5.14-68.3 php5-devel-5.5.14-68.3 php5-dom-5.5.14-68.3 php5-dom-debuginfo-5.5.14-68.3 php5-enchant-5.5.14-68.3 php5-enchant-debuginfo-5.5.14-68.3 php5-exif-5.5.14-68.3 php5-exif-debuginfo-5.5.14-68.3 php5-fastcgi-5.5.14-68.3 php5-fastcgi-debuginfo-5.5.14-68.3 php5-fileinfo-5.5.14-68.3 php5-fileinfo-debuginfo-5.5.14-68.3 php5-firebird-5.5.14-68.3 php5-firebird-debuginfo-5.5.14-68.3 php5-fpm-5.5.14-68.3 php5-fpm-debuginfo-5.5.14-68.3 php5-ftp-5.5.14-68.3 php5-ftp-debuginfo-5.5.14-68.3 php5-gd-5.5.14-68.3 php5-gd-debuginfo-5.5.14-68.3 php5-gettext-5.5.14-68.3 php5-gettext-debuginfo-5.5.14-68.3 php5-gmp-5.5.14-68.3 php5-gmp-debuginfo-5.5.14-68.3 php5-iconv-5.5.14-68.3 php5-iconv-debuginfo-5.5.14-68.3 php5-imap-5.5.14-68.3 php5-imap-debuginfo-5.5.14-68.3 php5-intl-5.5.14-68.3 php5-intl-debuginfo-5.5.14-68.3 php5-json-5.5.14-68.3 php5-json-debuginfo-5.5.14-68.3 php5-ldap-5.5.14-68.3 php5-ldap-debuginfo-5.5.14-68.3 php5-mbstring-5.5.14-68.3 php5-mbstring-debuginfo-5.5.14-68.3 php5-mcrypt-5.5.14-68.3 php5-mcrypt-debuginfo-5.5.14-68.3 php5-mssql-5.5.14-68.3 php5-mssql-debuginfo-5.5.14-68.3 php5-mysql-5.5.14-68.3 php5-mysql-debuginfo-5.5.14-68.3 php5-odbc-5.5.14-68.3 php5-odbc-debuginfo-5.5.14-68.3 php5-opcache-5.5.14-68.3 php5-opcache-debuginfo-5.5.14-68.3 php5-openssl-5.5.14-68.3 php5-openssl-debuginfo-5.5.14-68.3 php5-pcntl-5.5.14-68.3 php5-pcntl-debuginfo-5.5.14-68.3 php5-pdo-5.5.14-68.3 php5-pdo-debuginfo-5.5.14-68.3 php5-pgsql-5.5.14-68.3 php5-pgsql-debuginfo-5.5.14-68.3 php5-phar-5.5.14-68.3 php5-phar-debuginfo-5.5.14-68.3 php5-posix-5.5.14-68.3 php5-posix-debuginfo-5.5.14-68.3 php5-pspell-5.5.14-68.3 php5-pspell-debuginfo-5.5.14-68.3 php5-readline-5.5.14-68.3 php5-readline-debuginfo-5.5.14-68.3 php5-shmop-5.5.14-68.3 php5-shmop-debuginfo-5.5.14-68.3 php5-snmp-5.5.14-68.3 php5-snmp-debuginfo-5.5.14-68.3 php5-soap-5.5.14-68.3 php5-soap-debuginfo-5.5.14-68.3 php5-sockets-5.5.14-68.3 php5-sockets-debuginfo-5.5.14-68.3 php5-sqlite-5.5.14-68.3 php5-sqlite-debuginfo-5.5.14-68.3 php5-suhosin-5.5.14-68.3 php5-suhosin-debuginfo-5.5.14-68.3 php5-sysvmsg-5.5.14-68.3 php5-sysvmsg-debuginfo-5.5.14-68.3 php5-sysvsem-5.5.14-68.3 php5-sysvsem-debuginfo-5.5.14-68.3 php5-sysvshm-5.5.14-68.3 php5-sysvshm-debuginfo-5.5.14-68.3 php5-tidy-5.5.14-68.3 php5-tidy-debuginfo-5.5.14-68.3 php5-tokenizer-5.5.14-68.3 php5-tokenizer-debuginfo-5.5.14-68.3 php5-wddx-5.5.14-68.3 php5-wddx-debuginfo-5.5.14-68.3 php5-xmlreader-5.5.14-68.3 php5-xmlreader-debuginfo-5.5.14-68.3 php5-xmlrpc-5.5.14-68.3 php5-xmlrpc-debuginfo-5.5.14-68.3 php5-xmlwriter-5.5.14-68.3 php5-xmlwriter-debuginfo-5.5.14-68.3 php5-xsl-5.5.14-68.3 php5-xsl-debuginfo-5.5.14-68.3 php5-zip-5.5.14-68.3 php5-zip-debuginfo-5.5.14-68.3 php5-zlib-5.5.14-68.3 php5-zlib-debuginfo-5.5.14-68.3 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-68.3 References: https://www.suse.com/security/cve/CVE-2016-5773.html https://www.suse.com/security/cve/CVE-2016-9137.html https://bugzilla.suse.com/1008029 https://bugzilla.suse.com/986247

1 0