February 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:0611-1: Recommended update for clamav-database
by maintenance＠opensuse.org 29 Feb '16

29 Feb '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0611-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh February 29th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-286=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201602290002-56.1 References:

1 0

openSUSE-SU-2016:0610-1: moderate: Security update for dhcp
by opensuse-security＠opensuse.org 29 Feb '16

29 Feb '16

openSUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0610-1 Rating: moderate References: #880984 #936923 #956159 #960506 #961305 Cross-References: CVE-2015-8605 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for dhcp fixes the following issues: - CVE-2015-8605: A remote attacker could have used badly formed packets with an invalid IPv4 UDP length field to cause a DHCP server, client, or relay program to terminate abnormally (bsc#961305) The following bugs were fixed: - bsc#936923: Improper lease duration checking - bsc#880984: Integer overflows in the date and time handling code - bsc#956159: fixed service files to start dhcpd after slapd - bsc#960506: Improve exit reason and logging when /sbin/dhclient-script is unable to pre-init requested interface This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-284=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dhcp-4.3.3-4.1 dhcp-client-4.3.3-4.1 dhcp-client-debuginfo-4.3.3-4.1 dhcp-debuginfo-4.3.3-4.1 dhcp-debugsource-4.3.3-4.1 dhcp-devel-4.3.3-4.1 dhcp-doc-4.3.3-4.1 dhcp-relay-4.3.3-4.1 dhcp-relay-debuginfo-4.3.3-4.1 dhcp-server-4.3.3-4.1 dhcp-server-debuginfo-4.3.3-4.1 References: https://www.suse.com/security/cve/CVE-2015-8605.html https://bugzilla.suse.com/880984 https://bugzilla.suse.com/936923 https://bugzilla.suse.com/956159 https://bugzilla.suse.com/960506 https://bugzilla.suse.com/961305

1 0

openSUSE-RU-2016:0609-1: moderate: Recommended update for wicked
by maintenance＠opensuse.org 29 Feb '16

29 Feb '16

openSUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0609-1 Rating: moderate References: #959356 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for wicked fixes the following issues: - boo#959356: do not segfault on device hierarchy loops (boo#959356) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-285=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libwicked-0-6-0.6.30-30.1 libwicked-0-6-debuginfo-0.6.30-30.1 wicked-0.6.30-30.1 wicked-debuginfo-0.6.30-30.1 wicked-debugsource-0.6.30-30.1 wicked-service-0.6.30-30.1 References: https://bugzilla.suse.com/959356

1 0

openSUSE-SU-2016:0605-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 29 Feb '16

29 Feb '16

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0605-1 Rating: moderate References: #967521 Cross-References: CVE-2015-7575 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to bouncycastle 1.54 fixes the following issues: - CVE-2015-7575: add validation that signature algorithm received in DigitallySigned structures is actually one of those offered (boo#967521) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-282=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-282=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): bouncycastle-1.54-19.1 bouncycastle-javadoc-1.54-19.1 - openSUSE 13.2 (noarch): bouncycastle-1.54-13.6.1 bouncycastle-javadoc-1.54-13.6.1 References: https://www.suse.com/security/cve/CVE-2015-7575.html https://bugzilla.suse.com/967521

1 0

openSUSE-SU-2016:0604-1: moderate: Security update for nodejs
by opensuse-security＠opensuse.org 29 Feb '16

29 Feb '16

openSUSE Security Update: Security update for nodejs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0604-1 Rating: moderate References: #966076 #966077 Cross-References: CVE-2016-2086 CVE-2016-2216 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nodejs fixes the following issues: - CVE-2016-2216: Response splitting vulnerability using Unicode characters (boo#966076) - CVE-2016-2086: Request smuggling vulnerability (boo#966077) Node.js was updated to the 4.3.1 LTS version, containing all upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-283=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-283=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nodejs-4.3.1-24.1 nodejs-debuginfo-4.3.1-24.1 nodejs-debugsource-4.3.1-24.1 nodejs-devel-4.3.1-24.1 npm-4.3.1-24.1 - openSUSE Leap 42.1 (noarch): nodejs-docs-4.3.1-24.1 - openSUSE 13.2 (i586 x86_64): nodejs-4.3.1-15.1 nodejs-debuginfo-4.3.1-15.1 nodejs-debugsource-4.3.1-15.1 nodejs-devel-4.3.1-15.1 - openSUSE 13.2 (noarch): nodejs-doc-4.3.1-15.1 References: https://www.suse.com/security/cve/CVE-2016-2086.html https://www.suse.com/security/cve/CVE-2016-2216.html https://bugzilla.suse.com/966076 https://bugzilla.suse.com/966077

1 0

openSUSE-RU-2016:0603-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 27 Feb '16

27 Feb '16

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0603-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update contains Opera 35.0.2066.82, fixing the following issues: * New window was not fully opened after previous was minimised. * Fix issues with Netflix * various fixes for crashes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2016-281=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1:NonFree (x86_64): opera-35.0.2066.82-4.1 References:

1 0

openSUSE-RU-2016:0602-1: moderate: Recommended update for obs-service-source_validator
by maintenance＠opensuse.org 26 Feb '16

26 Feb '16

openSUSE Recommended Update: Recommended update for obs-service-source_validator ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0602-1 Rating: moderate References: #967610 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update contains a fix for a regression in a previously released update: * boo#967610: several occurrences of uninitialized value warning Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-280=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-280=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): obs-service-source_validator-0.6+git20160222.62c56d3-8.1 - openSUSE 13.2 (noarch): obs-service-source_validator-0.6+git20160222.62c56d3-6.1 References: https://bugzilla.suse.com/967610

1 0

openSUSE-SU-2016:0601-1: moderate: Security update for dhcp
by opensuse-security＠opensuse.org 26 Feb '16

26 Feb '16

openSUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0601-1 Rating: moderate References: #880984 #910686 #912098 #919959 #926159 #928390 #936923 #947780 #956159 #960506 #961305 Cross-References: CVE-2015-8605 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has 10 fixes is now available. Description: This update for dhcp fixes the following issues: - CVE-2015-8605: A remote attacker could have used badly formed packets with an invalid IPv4 UDP length field to cause a DHCP server, client, or relay program to terminate abnormally (boo#961305) The following bugs were fixed: - boo#936923: Improper lease duration checking - boo#880984: Integer overflows in the date and time handling code - boo#956159: fixed service files to start dhcpd after slapd - boo#960506: Improve exit reason and logging when /sbin/dhclient-script is unable to pre-init requested interface - boo#947780: DHCP server could abort with "Unable to set up timer: out of range" on very long or infinite timer intervals / lease lifetimes - boo#912098: dhclient could pretend to run while silently declining leases - boo#919959: server: Do not log success report before send reported success - boo#928390: dhclient dit not expose next-server DHCPv4 option to script - boo#926159: DHCP preferrend and valid lifetime would be logged incorrectly - boo#910686: Prevent a dependency conflict of dhcp-devel with bind-devel package Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-279=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): dhcp-4.2.6-9.16.1 dhcp-client-4.2.6-9.16.1 dhcp-client-debuginfo-4.2.6-9.16.1 dhcp-debuginfo-4.2.6-9.16.1 dhcp-debugsource-4.2.6-9.16.1 dhcp-devel-4.2.6-9.16.1 dhcp-doc-4.2.6-9.16.1 dhcp-relay-4.2.6-9.16.1 dhcp-relay-debuginfo-4.2.6-9.16.1 dhcp-server-4.2.6-9.16.1 dhcp-server-debuginfo-4.2.6-9.16.1 References: https://www.suse.com/security/cve/CVE-2015-8605.html https://bugzilla.suse.com/880984 https://bugzilla.suse.com/910686 https://bugzilla.suse.com/912098 https://bugzilla.suse.com/919959 https://bugzilla.suse.com/926159 https://bugzilla.suse.com/928390 https://bugzilla.suse.com/936923 https://bugzilla.suse.com/947780 https://bugzilla.suse.com/956159 https://bugzilla.suse.com/960506 https://bugzilla.suse.com/961305

1 0

openSUSE-RU-2016:0593-1: Recommended update to FATE
by maintenance＠opensuse.org 26 Feb '16

26 Feb '16

openSUSE Recommended Update: Recommended update to FATE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0593-1 Rating: low References: #966821 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update contains the current stable version 1.5.5.3 of FATE, the KDE client for the SUSE Feature Management system. Fixes the following issue: - boo#966821 (rebuild problems) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-278=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): fate-1.5.5.3-6.1 fate-debuginfo-1.5.5.3-6.1 fate-debugsource-1.5.5.3-6.1 References: https://bugzilla.suse.com/966821

1 0

openSUSE-RU-2016:0592-1: Recommended update for libspectre
by maintenance＠opensuse.org 26 Feb '16

26 Feb '16

openSUSE Recommended Update: Recommended update for libspectre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0592-1 Rating: low References: #898327 #958630 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libspectre fixes rotation of Postscript documents. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-275=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libspectre-debugsource-0.2.7-10.1 libspectre-devel-0.2.7-10.1 libspectre1-0.2.7-10.1 libspectre1-debuginfo-0.2.7-10.1 References: https://bugzilla.suse.com/898327 https://bugzilla.suse.com/958630

1 0