February 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0485-1: moderate: Security update for claws-mail
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0485-1 Rating: moderate References: #959993 Cross-References: CVE-2015-8614 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for claws-mail fixes the following issues: - CVE-2015-8614: additional fixes for buffer overrun issues which allowed remote attackers to cause a crash or have unspecified further impact (boo#959993) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-219=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): claws-mail-3.11.0-3.11.1 claws-mail-debuginfo-3.11.0-3.11.1 claws-mail-debugsource-3.11.0-3.11.1 claws-mail-devel-3.11.0-3.11.1 - openSUSE 13.1 (noarch): claws-mail-lang-3.11.0-3.11.1 References: https://www.suse.com/security/cve/CVE-2015-8614.html https://bugzilla.suse.com/959993

1 0

openSUSE-RU-2016:0484-1: Recommended update for clamav-database
by maintenance＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0484-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh February 15th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-220=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201602150000-50.1 References:

1 0

openSUSE-SU-2016:0483-1: moderate: Security update for socat
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for socat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0483-1 Rating: moderate References: #938913 #964844 Cross-References: CVE-2015-4000 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for socat fixes the following issues: Changes in socat: - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (boo#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (boo#964844) - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-218=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): socat-1.7.3.1-2.6.1 socat-debuginfo-1.7.3.1-2.6.1 socat-debugsource-1.7.3.1-2.6.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/938913 https://bugzilla.suse.com/964844

1 0

openSUSE-RU-2016:0480-1: moderate: Recommended update for kactivities5
by maintenance＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Recommended Update: Recommended update for kactivities5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0480-1 Rating: moderate References: #952139 #965653 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for kactivities5 fixes the following issues: - Fixed a kactivitymanagerd crash on exit/logout (boo#965653, kde#348194) - Fixed a dolphin and desktop crash when right-clicking on a file and opening the "Activities" submenu (boo#952139, kde#351485) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-216=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kactivities5-5.16.0-8.1 kactivities5-debuginfo-5.16.0-8.1 kactivities5-debugsource-5.16.0-8.1 kactivities5-devel-5.16.0-8.1 kactivities5-imports-5.16.0-8.1 kactivities5-imports-debuginfo-5.16.0-8.1 libKF5Activities5-5.16.0-8.1 libKF5Activities5-debuginfo-5.16.0-8.1 - openSUSE Leap 42.1 (x86_64): kactivities5-devel-32bit-5.16.0-8.1 libKF5Activities5-32bit-5.16.0-8.1 libKF5Activities5-debuginfo-32bit-5.16.0-8.1 - openSUSE Leap 42.1 (noarch): libKF5Activities5-lang-5.16.0-8.1 References: https://bugzilla.suse.com/952139 https://bugzilla.suse.com/965653

1 0

openSUSE-SU-2016:0479-1: moderate: Security update for claws-mail
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Security Update: Security update for claws-mail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0479-1 Rating: moderate References: #959993 Cross-References: CVE-2015-8614 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for claws-mail fixes the following issues: - CVE-2015-8614: additional fixes for buffer overrun issues which allowed remote attackers to cause a crash or have unspecified further impact (boo#959993) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-214=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-214=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): claws-mail-3.12.0-7.1 claws-mail-debuginfo-3.12.0-7.1 claws-mail-debugsource-3.12.0-7.1 claws-mail-devel-3.12.0-7.1 - openSUSE Leap 42.1 (noarch): claws-mail-lang-3.12.0-7.1 - openSUSE 13.2 (i586 x86_64): claws-mail-3.11.0-2.10.1 claws-mail-debuginfo-3.11.0-2.10.1 claws-mail-debugsource-3.11.0-2.10.1 claws-mail-devel-3.11.0-2.10.1 - openSUSE 13.2 (noarch): claws-mail-lang-3.11.0-2.10.1 References: https://www.suse.com/security/cve/CVE-2015-8614.html https://bugzilla.suse.com/959993

1 0

openSUSE-SU-2016:0478-1: moderate: Security update for socat
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Security Update: Security update for socat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0478-1 Rating: moderate References: #938913 #964844 Cross-References: CVE-2015-4000 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for socat fixes the following issues: Changes in socat: - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (boo#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (boo#964844) - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-215=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-215=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): socat-1.7.3.1-6.1 socat-debuginfo-1.7.3.1-6.1 socat-debugsource-1.7.3.1-6.1 - openSUSE 13.2 (i586 x86_64): socat-1.7.3.1-2.3.1 socat-debuginfo-1.7.3.1-2.3.1 socat-debugsource-1.7.3.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/938913 https://bugzilla.suse.com/964844

1 0

openSUSE-SU-2016:0477-1: moderate: Security update for libnettle
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0477-1 Rating: moderate References: #964845 #964847 #964849 Cross-References: CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libnettle fixes the following issues: - CVE-2015-8803: secp256 calculation bug (boo#964845) - CVE-2015-8804: Miscalculations on secp384 curve (boo#964847) - CVE-2015-8805: Fixed miscomputation bugs in secp-256r1 modulo functions. (boo#964849) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-211=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libhogweed2-2.7.1-6.5.1 libhogweed2-debuginfo-2.7.1-6.5.1 libnettle-debugsource-2.7.1-6.5.1 libnettle-devel-2.7.1-6.5.1 libnettle4-2.7.1-6.5.1 libnettle4-debuginfo-2.7.1-6.5.1 nettle-2.7.1-6.5.1 nettle-debuginfo-2.7.1-6.5.1 - openSUSE 13.2 (x86_64): libhogweed2-32bit-2.7.1-6.5.1 libhogweed2-debuginfo-32bit-2.7.1-6.5.1 libnettle-devel-32bit-2.7.1-6.5.1 libnettle4-32bit-2.7.1-6.5.1 libnettle4-debuginfo-32bit-2.7.1-6.5.1 References: https://www.suse.com/security/cve/CVE-2015-8803.html https://www.suse.com/security/cve/CVE-2015-8804.html https://www.suse.com/security/cve/CVE-2015-8805.html https://bugzilla.suse.com/964845 https://bugzilla.suse.com/964847 https://bugzilla.suse.com/964849

1 0

openSUSE-SU-2016:0476-1: important: Security update for vlc
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0476-1 Rating: important References: #965227 Cross-References: CVE-2015-5949 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vlc fixes the following issues: - CVE-2015-5949: Remote attackers could have caused a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file (boo#965227) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-213=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libvlc5-2.2.1-24.1 libvlc5-debuginfo-2.2.1-24.1 libvlccore8-2.2.1-24.1 libvlccore8-debuginfo-2.2.1-24.1 vlc-2.2.1-24.1 vlc-debuginfo-2.2.1-24.1 vlc-debugsource-2.2.1-24.1 vlc-devel-2.2.1-24.1 vlc-gnome-2.2.1-24.1 vlc-gnome-debuginfo-2.2.1-24.1 vlc-noX-2.2.1-24.1 vlc-noX-debuginfo-2.2.1-24.1 vlc-qt-2.2.1-24.1 vlc-qt-debuginfo-2.2.1-24.1 - openSUSE Leap 42.1 (noarch): vlc-noX-lang-2.2.1-24.1 References: https://www.suse.com/security/cve/CVE-2015-5949.html https://bugzilla.suse.com/965227

1 0

openSUSE-SU-2016:0475-1: moderate: Security update for libnettle
by opensuse-security＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0475-1 Rating: moderate References: #964845 #964847 #964849 Cross-References: CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libnettle fixes the following security issues: - CVE-2015-8803: Fixed miscomputation bugs in secp-256r1 modulo functions. (bsc#964845) - CVE-2015-8804: Fixed carry folding bug in x86_64 ecc_384_modp. (bsc#964847) - CVE-2015-8805: Fixed miscomputation bugs in secp-256r1 modulo functions. (bsc#964849) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-212=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libhogweed2-2.7.1-9.1 libhogweed2-debuginfo-2.7.1-9.1 libnettle-debugsource-2.7.1-9.1 libnettle-devel-2.7.1-9.1 libnettle4-2.7.1-9.1 libnettle4-debuginfo-2.7.1-9.1 nettle-2.7.1-9.1 nettle-debuginfo-2.7.1-9.1 - openSUSE Leap 42.1 (x86_64): libhogweed2-32bit-2.7.1-9.1 libhogweed2-debuginfo-32bit-2.7.1-9.1 libnettle-devel-32bit-2.7.1-9.1 libnettle4-32bit-2.7.1-9.1 libnettle4-debuginfo-32bit-2.7.1-9.1 References: https://www.suse.com/security/cve/CVE-2015-8803.html https://www.suse.com/security/cve/CVE-2015-8804.html https://www.suse.com/security/cve/CVE-2015-8805.html https://bugzilla.suse.com/964845 https://bugzilla.suse.com/964847 https://bugzilla.suse.com/964849

1 0

openSUSE-RU-2016:0466-1: moderate: Recommended update for hugin
by maintenance＠opensuse.org 16 Feb '16

16 Feb '16

openSUSE Recommended Update: Recommended update for hugin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0466-1 Rating: moderate References: #952324 #962214 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for hugin fixes the following issues: - fix appdata.xml and desktop file consistency. see boo#952324 and boo#962214 - enable hugin to provide appdata.xml and desktop files to fix installation system problems. hugin didn't provide them due to the internal dependency generator having to be disabled to deal with complex wxWidget requires. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-208=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): hugin-2015.0.0-3.1 hugin-debuginfo-2015.0.0-3.1 hugin-debugsource-2015.0.0-3.1 References: https://bugzilla.suse.com/952324 https://bugzilla.suse.com/962214

1 0