February 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0368-1: moderate: Security update for mariadb
by opensuse-security＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0368-1 Rating: moderate References: #937787 #957174 #958789 Cross-References: CVE-2015-4792 CVE-2015-4802 CVE-2015-4807 CVE-2015-4815 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836 CVE-2015-4858 CVE-2015-4861 CVE-2015-4870 CVE-2015-4913 CVE-2015-5969 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed: - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4913, CVE-2015-4792 - Fix information leak via mysql-systemd-helper script. (CVE-2015-5969, bsc#957174) For a comprehensive list of changes refer to the upstream Release Notes and Change Log documents: - https://kb.askmonty.org/en/mariadb-10022-release-notes/ - https://kb.askmonty.org/en/mariadb-10022-changelog/ This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-164=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysqlclient-devel-10.0.22-3.1 libmysqlclient18-10.0.22-3.1 libmysqlclient18-debuginfo-10.0.22-3.1 libmysqlclient_r18-10.0.22-3.1 libmysqld-devel-10.0.22-3.1 libmysqld18-10.0.22-3.1 libmysqld18-debuginfo-10.0.22-3.1 mariadb-10.0.22-3.1 mariadb-bench-10.0.22-3.1 mariadb-bench-debuginfo-10.0.22-3.1 mariadb-client-10.0.22-3.1 mariadb-client-debuginfo-10.0.22-3.1 mariadb-debuginfo-10.0.22-3.1 mariadb-debugsource-10.0.22-3.1 mariadb-errormessages-10.0.22-3.1 mariadb-test-10.0.22-3.1 mariadb-test-debuginfo-10.0.22-3.1 mariadb-tools-10.0.22-3.1 mariadb-tools-debuginfo-10.0.22-3.1 - openSUSE Leap 42.1 (x86_64): libmysqlclient18-32bit-10.0.22-3.1 libmysqlclient18-debuginfo-32bit-10.0.22-3.1 libmysqlclient_r18-32bit-10.0.22-3.1 References: https://www.suse.com/security/cve/CVE-2015-4792.html https://www.suse.com/security/cve/CVE-2015-4802.html https://www.suse.com/security/cve/CVE-2015-4807.html https://www.suse.com/security/cve/CVE-2015-4815.html https://www.suse.com/security/cve/CVE-2015-4826.html https://www.suse.com/security/cve/CVE-2015-4830.html https://www.suse.com/security/cve/CVE-2015-4836.html https://www.suse.com/security/cve/CVE-2015-4858.html https://www.suse.com/security/cve/CVE-2015-4861.html https://www.suse.com/security/cve/CVE-2015-4870.html https://www.suse.com/security/cve/CVE-2015-4913.html https://www.suse.com/security/cve/CVE-2015-5969.html https://bugzilla.suse.com/937787 https://bugzilla.suse.com/957174 https://bugzilla.suse.com/958789

1 0

openSUSE-SU-2016:0367-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0367-1 Rating: important References: #957174 #959724 #962779 Cross-References: CVE-2015-5969 CVE-2015-7744 CVE-2016-0502 CVE-2016-0503 CVE-2016-0504 CVE-2016-0505 CVE-2016-0546 CVE-2016-0594 CVE-2016-0595 CVE-2016-0596 CVE-2016-0597 CVE-2016-0598 CVE-2016-0600 CVE-2016-0605 CVE-2016-0606 CVE-2016-0607 CVE-2016-0608 CVE-2016-0609 CVE-2016-0610 CVE-2016-0611 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update to MySQL 5.6.28 fixes the following issues (bsc#962779): - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack. - CVE-2016-0502: Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0503: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504. - CVE-2016-0504: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503. - CVE-2016-0505: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Options. - CVE-2016-0546: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. - CVE-2016-0594: Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0595: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0596: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0597: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2016-0598: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML. - CVE-2016-0600: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0605: Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. - CVE-2016-0606: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect integrity via unknown vectors related to encryption. - CVE-2016-0607: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication. - CVE-2016-0608: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via vectors related to UDF. - CVE-2016-0609: Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to privileges. - CVE-2016-0610: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. - CVE-2016-0611: Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. - CVE-2015-5969: Fixed information leak via mysql-systemd-helper script. (bsc#957174) - bsc#959724: Possible buffer overflow from incorrect use of strcpy() and sprintf() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-165=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-165=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysql56client18-5.6.28-13.1 libmysql56client18-debuginfo-5.6.28-13.1 libmysql56client_r18-5.6.28-13.1 mysql-community-server-5.6.28-13.1 mysql-community-server-bench-5.6.28-13.1 mysql-community-server-bench-debuginfo-5.6.28-13.1 mysql-community-server-client-5.6.28-13.1 mysql-community-server-client-debuginfo-5.6.28-13.1 mysql-community-server-debuginfo-5.6.28-13.1 mysql-community-server-debugsource-5.6.28-13.1 mysql-community-server-errormessages-5.6.28-13.1 mysql-community-server-test-5.6.28-13.1 mysql-community-server-test-debuginfo-5.6.28-13.1 mysql-community-server-tools-5.6.28-13.1 mysql-community-server-tools-debuginfo-5.6.28-13.1 - openSUSE Leap 42.1 (x86_64): libmysql56client18-32bit-5.6.28-13.1 libmysql56client18-debuginfo-32bit-5.6.28-13.1 libmysql56client_r18-32bit-5.6.28-13.1 - openSUSE 13.2 (i586 x86_64): libmysql56client18-5.6.28-2.17.1 libmysql56client18-debuginfo-5.6.28-2.17.1 libmysql56client_r18-5.6.28-2.17.1 mysql-community-server-5.6.28-2.17.1 mysql-community-server-bench-5.6.28-2.17.1 mysql-community-server-bench-debuginfo-5.6.28-2.17.1 mysql-community-server-client-5.6.28-2.17.1 mysql-community-server-client-debuginfo-5.6.28-2.17.1 mysql-community-server-debuginfo-5.6.28-2.17.1 mysql-community-server-debugsource-5.6.28-2.17.1 mysql-community-server-errormessages-5.6.28-2.17.1 mysql-community-server-test-5.6.28-2.17.1 mysql-community-server-test-debuginfo-5.6.28-2.17.1 mysql-community-server-tools-5.6.28-2.17.1 mysql-community-server-tools-debuginfo-5.6.28-2.17.1 - openSUSE 13.2 (x86_64): libmysql56client18-32bit-5.6.28-2.17.1 libmysql56client18-debuginfo-32bit-5.6.28-2.17.1 libmysql56client_r18-32bit-5.6.28-2.17.1 References: https://www.suse.com/security/cve/CVE-2015-5969.html https://www.suse.com/security/cve/CVE-2015-7744.html https://www.suse.com/security/cve/CVE-2016-0502.html https://www.suse.com/security/cve/CVE-2016-0503.html https://www.suse.com/security/cve/CVE-2016-0504.html https://www.suse.com/security/cve/CVE-2016-0505.html https://www.suse.com/security/cve/CVE-2016-0546.html https://www.suse.com/security/cve/CVE-2016-0594.html https://www.suse.com/security/cve/CVE-2016-0595.html https://www.suse.com/security/cve/CVE-2016-0596.html https://www.suse.com/security/cve/CVE-2016-0597.html https://www.suse.com/security/cve/CVE-2016-0598.html https://www.suse.com/security/cve/CVE-2016-0600.html https://www.suse.com/security/cve/CVE-2016-0605.html https://www.suse.com/security/cve/CVE-2016-0606.html https://www.suse.com/security/cve/CVE-2016-0607.html https://www.suse.com/security/cve/CVE-2016-0608.html https://www.suse.com/security/cve/CVE-2016-0609.html https://www.suse.com/security/cve/CVE-2016-0610.html https://www.suse.com/security/cve/CVE-2016-0611.html https://bugzilla.suse.com/957174 https://bugzilla.suse.com/959724 https://bugzilla.suse.com/962779

1 0

openSUSE-SU-2016:0366-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0366-1 Rating: moderate References: #949961 #962057 Cross-References: CVE-2015-7803 CVE-2016-1903 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2015-7803: Specially crafted .phar files with a crafted TAR archive entry allowed remote attackers to cause a Denial of Service (DoS) [bsc#949961] - CVE-2016-1903: Specially crafted image files could could allow remote attackers read unspecified memory when rotating images [bsc#962057] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-157=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-41.1 apache2-mod_php5-debuginfo-5.5.14-41.1 php5-5.5.14-41.1 php5-bcmath-5.5.14-41.1 php5-bcmath-debuginfo-5.5.14-41.1 php5-bz2-5.5.14-41.1 php5-bz2-debuginfo-5.5.14-41.1 php5-calendar-5.5.14-41.1 php5-calendar-debuginfo-5.5.14-41.1 php5-ctype-5.5.14-41.1 php5-ctype-debuginfo-5.5.14-41.1 php5-curl-5.5.14-41.1 php5-curl-debuginfo-5.5.14-41.1 php5-dba-5.5.14-41.1 php5-dba-debuginfo-5.5.14-41.1 php5-debuginfo-5.5.14-41.1 php5-debugsource-5.5.14-41.1 php5-devel-5.5.14-41.1 php5-dom-5.5.14-41.1 php5-dom-debuginfo-5.5.14-41.1 php5-enchant-5.5.14-41.1 php5-enchant-debuginfo-5.5.14-41.1 php5-exif-5.5.14-41.1 php5-exif-debuginfo-5.5.14-41.1 php5-fastcgi-5.5.14-41.1 php5-fastcgi-debuginfo-5.5.14-41.1 php5-fileinfo-5.5.14-41.1 php5-fileinfo-debuginfo-5.5.14-41.1 php5-firebird-5.5.14-41.1 php5-firebird-debuginfo-5.5.14-41.1 php5-fpm-5.5.14-41.1 php5-fpm-debuginfo-5.5.14-41.1 php5-ftp-5.5.14-41.1 php5-ftp-debuginfo-5.5.14-41.1 php5-gd-5.5.14-41.1 php5-gd-debuginfo-5.5.14-41.1 php5-gettext-5.5.14-41.1 php5-gettext-debuginfo-5.5.14-41.1 php5-gmp-5.5.14-41.1 php5-gmp-debuginfo-5.5.14-41.1 php5-iconv-5.5.14-41.1 php5-iconv-debuginfo-5.5.14-41.1 php5-imap-5.5.14-41.1 php5-imap-debuginfo-5.5.14-41.1 php5-intl-5.5.14-41.1 php5-intl-debuginfo-5.5.14-41.1 php5-json-5.5.14-41.1 php5-json-debuginfo-5.5.14-41.1 php5-ldap-5.5.14-41.1 php5-ldap-debuginfo-5.5.14-41.1 php5-mbstring-5.5.14-41.1 php5-mbstring-debuginfo-5.5.14-41.1 php5-mcrypt-5.5.14-41.1 php5-mcrypt-debuginfo-5.5.14-41.1 php5-mssql-5.5.14-41.1 php5-mssql-debuginfo-5.5.14-41.1 php5-mysql-5.5.14-41.1 php5-mysql-debuginfo-5.5.14-41.1 php5-odbc-5.5.14-41.1 php5-odbc-debuginfo-5.5.14-41.1 php5-opcache-5.5.14-41.1 php5-opcache-debuginfo-5.5.14-41.1 php5-openssl-5.5.14-41.1 php5-openssl-debuginfo-5.5.14-41.1 php5-pcntl-5.5.14-41.1 php5-pcntl-debuginfo-5.5.14-41.1 php5-pdo-5.5.14-41.1 php5-pdo-debuginfo-5.5.14-41.1 php5-pgsql-5.5.14-41.1 php5-pgsql-debuginfo-5.5.14-41.1 php5-phar-5.5.14-41.1 php5-phar-debuginfo-5.5.14-41.1 php5-posix-5.5.14-41.1 php5-posix-debuginfo-5.5.14-41.1 php5-pspell-5.5.14-41.1 php5-pspell-debuginfo-5.5.14-41.1 php5-readline-5.5.14-41.1 php5-readline-debuginfo-5.5.14-41.1 php5-shmop-5.5.14-41.1 php5-shmop-debuginfo-5.5.14-41.1 php5-snmp-5.5.14-41.1 php5-snmp-debuginfo-5.5.14-41.1 php5-soap-5.5.14-41.1 php5-soap-debuginfo-5.5.14-41.1 php5-sockets-5.5.14-41.1 php5-sockets-debuginfo-5.5.14-41.1 php5-sqlite-5.5.14-41.1 php5-sqlite-debuginfo-5.5.14-41.1 php5-suhosin-5.5.14-41.1 php5-suhosin-debuginfo-5.5.14-41.1 php5-sysvmsg-5.5.14-41.1 php5-sysvmsg-debuginfo-5.5.14-41.1 php5-sysvsem-5.5.14-41.1 php5-sysvsem-debuginfo-5.5.14-41.1 php5-sysvshm-5.5.14-41.1 php5-sysvshm-debuginfo-5.5.14-41.1 php5-tidy-5.5.14-41.1 php5-tidy-debuginfo-5.5.14-41.1 php5-tokenizer-5.5.14-41.1 php5-tokenizer-debuginfo-5.5.14-41.1 php5-wddx-5.5.14-41.1 php5-wddx-debuginfo-5.5.14-41.1 php5-xmlreader-5.5.14-41.1 php5-xmlreader-debuginfo-5.5.14-41.1 php5-xmlrpc-5.5.14-41.1 php5-xmlrpc-debuginfo-5.5.14-41.1 php5-xmlwriter-5.5.14-41.1 php5-xmlwriter-debuginfo-5.5.14-41.1 php5-xsl-5.5.14-41.1 php5-xsl-debuginfo-5.5.14-41.1 php5-zip-5.5.14-41.1 php5-zip-debuginfo-5.5.14-41.1 php5-zlib-5.5.14-41.1 php5-zlib-debuginfo-5.5.14-41.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-41.1 References: https://www.suse.com/security/cve/CVE-2015-7803.html https://www.suse.com/security/cve/CVE-2016-1903.html https://bugzilla.suse.com/949961 https://bugzilla.suse.com/962057

1 0

openSUSE-RU-2016:0365-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0365-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update provides version 0.7.5 for spec-cleaner: - Version update to 0.7.5: * Replace jobs in install section too * Do not curlify gconf_schemas * Work with defines in sections not just as global declarations * Quote optflags properly when replacing RPM_OPT_FLAGS * Do not add empty line after oneline scriptlet - Version bump to 0.7.4: * Use license digger from format_spec_file * Provide optional subpkg providing format_spec_file OBS bindings Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-163=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): spec-cleaner-0.7.5-25.1 spec-cleaner-format_spec_file-0.7.5-25.1 References:

1 0

openSUSE-RU-2016:0364-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0364-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update provides version 0.7.5 for spec-cleaner: - Version update to 0.7.5: * Replace jobs in install section too * Do not curlify gconf_schemas * Work with defines in sections not just as global declarations * Quote optflags properly when replacing RPM_OPT_FLAGS * Do not add empty line after oneline scriptlet Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-162=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): spec-cleaner-0.7.5-3.1 spec-cleaner-format_spec_file-0.7.5-3.1 References:

1 0

openSUSE-SU-2016:0363-1: moderate: Security update for rubygem-actionpack-3_2, rubygem-activesupport-3_2
by opensuse-security＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Security Update: Security update for rubygem-actionpack-3_2, rubygem-activesupport-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0363-1 Rating: moderate References: #963329 #963330 #963331 #963332 Cross-References: CVE-2015-7576 CVE-2015-7577 CVE-2016-0751 CVE-2016-0752 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for rubygem-actionpack-3_2, rubygem-activesupport-3_2 fixes the following issues: - CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (boo#963329) - CVE-2016-0752: directory traversal and information leak in Action View (boo#963332) - CVE-2016-0751: rubygem-actionpack: Object Leak DoS (boo#963331) - CVE-2015-7577: Nested attributes rejection proc bypass (boo#963330) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-160=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-actionpack-3_2-3.2.17-3.7.1 rubygem-actionpack-3_2-doc-3.2.17-3.7.1 rubygem-activerecord-3_2-3.2.17-3.3.1 rubygem-activerecord-3_2-doc-3.2.17-3.3.1 rubygem-activesupport-3_2-3.2.17-2.6.1 rubygem-activesupport-3_2-doc-3.2.17-2.6.1 References: https://www.suse.com/security/cve/CVE-2015-7576.html https://www.suse.com/security/cve/CVE-2015-7577.html https://www.suse.com/security/cve/CVE-2016-0751.html https://www.suse.com/security/cve/CVE-2016-0752.html https://bugzilla.suse.com/963329 https://bugzilla.suse.com/963330 https://bugzilla.suse.com/963331 https://bugzilla.suse.com/963332

1 0

openSUSE-SU-2016:0362-1: Security update for openssl
by opensuse-security＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0362-1 Rating: low References: #963415 Cross-References: CVE-2015-3197 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl fixes the following issues: - CVE-2015-3197: A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via SSL_OP_NO_SSLv2. (boo#963415) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-154=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.30.1 libopenssl1_0_0-1.0.1k-2.30.1 libopenssl1_0_0-debuginfo-1.0.1k-2.30.1 libopenssl1_0_0-hmac-1.0.1k-2.30.1 openssl-1.0.1k-2.30.1 openssl-debuginfo-1.0.1k-2.30.1 openssl-debugsource-1.0.1k-2.30.1 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.30.1 libopenssl1_0_0-32bit-1.0.1k-2.30.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.30.1 libopenssl1_0_0-hmac-32bit-1.0.1k-2.30.1 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.30.1 References: https://www.suse.com/security/cve/CVE-2015-3197.html https://bugzilla.suse.com/963415

1 0

openSUSE-RU-2016:0361-1: moderate: Recommended update for xf86-input-wacom
by maintenance＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Recommended Update: Recommended update for xf86-input-wacom ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0361-1 Rating: moderate References: #912589 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xf86-input-wacom fixes the following issues: - Add workaround for a Wacom Bamboo Pad (model CTH-300, usb vendor:product 056a:0319). This requires the option usbhid.quirks=0x056a:0x0319:0x40000000 on the kernel command line (boo#912589). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-155=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xf86-input-wacom-0.24.0-2.3.1 xf86-input-wacom-debuginfo-0.24.0-2.3.1 xf86-input-wacom-debugsource-0.24.0-2.3.1 xf86-input-wacom-devel-0.24.0-2.3.1 xf86-input-wacom-devel-debuginfo-0.24.0-2.3.1 References: https://bugzilla.suse.com/912589

1 0

openSUSE-SU-2016:0360-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0360-1 Rating: moderate References: #934333 #936676 #962983 #962996 Cross-References: CVE-2016-0755 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for curl fixes the following issues: - CVE-2016-0755: libcurl would reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer (bsc#962983) The following non-security bugs were fixed: - boo#936676: secure_getenv or __secure_getenv may not be detected correctly at build time The following tracked bugs only affect the test suite: - boo#962996: Expired cookie in test 46 caused test failures - boo#934333: Curl test suite was not run, is now enabled during build This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-152=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): curl-7.37.0-7.1 curl-debuginfo-7.37.0-7.1 curl-debugsource-7.37.0-7.1 libcurl-devel-7.37.0-7.1 libcurl4-7.37.0-7.1 libcurl4-debuginfo-7.37.0-7.1 - openSUSE Leap 42.1 (x86_64): libcurl-devel-32bit-7.37.0-7.1 libcurl4-32bit-7.37.0-7.1 libcurl4-debuginfo-32bit-7.37.0-7.1 References: https://www.suse.com/security/cve/CVE-2016-0755.html https://bugzilla.suse.com/934333 https://bugzilla.suse.com/936676 https://bugzilla.suse.com/962983 https://bugzilla.suse.com/962996

1 0

openSUSE-FU-2016:0359-1: moderate: Add nginx to SLE 12 Backports
by maintenance＠opensuse.org 07 Feb '16

07 Feb '16

openSUSE Feature Update: Add nginx to SLE 12 Backports ______________________________________________________________________________ Announcement ID: openSUSE-FU-2016:0359-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update provides the nginx webserver 1.8.1 to the SUSE Linux Enterprise 12 Backports repository. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-150=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): nginx-1.8.1-4.1 nginx-debuginfo-1.8.1-4.1 nginx-debugsource-1.8.1-4.1 References:

1 0