February 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0518-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 20 Feb '16

20 Feb '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0518-1 Rating: moderate References: #965566 #965738 #965999 #966082 Cross-References: CVE-2016-1622 CVE-2016-1623 CVE-2016-1624 CVE-2016-1625 CVE-2016-1626 CVE-2016-1627 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update to Chromium 48.0.2564.109 fixes the following issues: Security fixes (boo#965999): - CVE-2016-1622: Same-origin bypass in Extensions - CVE-2016-1623: Same-origin bypass in DOM - CVE-2016-1624: Buffer overflow in Brotli - CVE-2016-1625: Navigation bypass in Chrome Instant - CVE-2016-1626: Out-of-bounds read in PDFium - CVE-2016-1627: Various fixes from internal audits, fuzzing and other initiatives Non-security bug fixes: - boo#965738: resolve issues with specific banking websites when built against system libraries - boo#966082: chromium: sandbox related stacktrace printed - boo#965566: Drop libva support - Prevent graphical issues related to libjpeg - On KDE 5 kwallet5 is the default password store now Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-238=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-48.0.2564.109-125.1 chromedriver-debuginfo-48.0.2564.109-125.1 chromium-48.0.2564.109-125.1 chromium-debuginfo-48.0.2564.109-125.1 chromium-debugsource-48.0.2564.109-125.1 chromium-desktop-gnome-48.0.2564.109-125.1 chromium-desktop-kde-48.0.2564.109-125.1 chromium-ffmpegsumo-48.0.2564.109-125.1 chromium-ffmpegsumo-debuginfo-48.0.2564.109-125.1 References: https://www.suse.com/security/cve/CVE-2016-1622.html https://www.suse.com/security/cve/CVE-2016-1623.html https://www.suse.com/security/cve/CVE-2016-1624.html https://www.suse.com/security/cve/CVE-2016-1625.html https://www.suse.com/security/cve/CVE-2016-1626.html https://www.suse.com/security/cve/CVE-2016-1627.html https://bugzilla.suse.com/965566 https://bugzilla.suse.com/965738 https://bugzilla.suse.com/965999 https://bugzilla.suse.com/966082

1 0

openSUSE-RU-2016:0515-1: Recommended update for emacs-vm
by maintenance＠opensuse.org 19 Feb '16

19 Feb '16

openSUSE Recommended Update: Recommended update for emacs-vm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0515-1 Rating: low References: #939497 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for emacs-vm fixes the following issues: - Require vm-reply.el from vm-compose-mail. (boo#939497, lp#913005) - Added a variable `vm-confirm-for-auto-archive' that controls the confirmation dialogue for `vm-auto-archive-messages'. (lp#793541) - Added autoload for `vm-select-recipient-from-sender'. (boo#939497, lp#907286) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-237=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-237=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): emacs-vm-8.2.0b-11.1 emacs-vm-debuginfo-8.2.0b-11.1 emacs-vm-debugsource-8.2.0b-11.1 - openSUSE 13.2 (i586 x86_64): emacs-vm-8.2.0b-2.3.1 emacs-vm-debuginfo-8.2.0b-2.3.1 emacs-vm-debugsource-8.2.0b-2.3.1 References: https://bugzilla.suse.com/939497

1 0

openSUSE-RU-2016:0514-1: Recommended update for digikam
by maintenance＠opensuse.org 19 Feb '16

19 Feb '16

openSUSE Recommended Update: Recommended update for digikam ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0514-1 Rating: low References: #965865 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for digikam fixes the following issues: - Drop the requires on digikam from the digikam-libs package. This would allow digikam-libs to replace the existing libkipi, libkexiv2, etc without pulling in digikam/kipi-plugins (boo#965865) - Make the dependency on marble-data from digikam-libs a recommends to allow more flexibility for users Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-236=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): digikam-4.14.0-11.1 digikam-debuginfo-4.14.0-11.1 digikam-debugsource-4.14.0-11.1 digikam-libs-4.14.0-11.1 digikam-libs-debuginfo-4.14.0-11.1 digikam-plugin-color-4.14.0-11.1 digikam-plugin-color-debuginfo-4.14.0-11.1 digikam-plugin-decorate-4.14.0-11.1 digikam-plugin-decorate-debuginfo-4.14.0-11.1 digikam-plugin-enhance-4.14.0-11.1 digikam-plugin-enhance-debuginfo-4.14.0-11.1 digikam-plugin-fxfilters-4.14.0-11.1 digikam-plugin-fxfilters-debuginfo-4.14.0-11.1 digikam-plugin-transform-4.14.0-11.1 digikam-plugin-transform-debuginfo-4.14.0-11.1 kipi-plugins-4.14.0-11.1 kipi-plugins-acquireimage-4.14.0-11.1 kipi-plugins-acquireimage-debuginfo-4.14.0-11.1 kipi-plugins-debuginfo-4.14.0-11.1 kipi-plugins-geolocation-4.14.0-11.1 kipi-plugins-geolocation-debuginfo-4.14.0-11.1 - openSUSE Leap 42.1 (noarch): digikam-doc-4.14.0-11.1 digikam-lang-4.14.0-11.1 kipi-plugins-lang-4.14.0-11.1 References: https://bugzilla.suse.com/965865

1 0

openSUSE-FU-2016:0513-1: moderate: Add Erlang to SLE 12 Backports
by maintenance＠opensuse.org 19 Feb '16

19 Feb '16

openSUSE Feature Update: Add Erlang to SLE 12 Backports ______________________________________________________________________________ Announcement ID: openSUSE-FU-2016:0513-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update adds Erlang to the SLE 12 Backports project. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-235=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): erlang-18.2.2-2.1 erlang-debugger-18.2.2-2.1 erlang-debugger-src-18.2.2-2.1 erlang-dialyzer-18.2.2-2.1 erlang-dialyzer-src-18.2.2-2.1 erlang-doc-18.2.2-2.1 erlang-epmd-18.2.2-2.1 erlang-et-18.2.2-2.1 erlang-et-src-18.2.2-2.1 erlang-gs-18.2.2-2.1 erlang-gs-src-18.2.2-2.1 erlang-jinterface-18.2.2-2.1 erlang-jinterface-src-18.2.2-2.1 erlang-observer-18.2.2-2.1 erlang-observer-src-18.2.2-2.1 erlang-reltool-18.2.2-2.1 erlang-reltool-src-18.2.2-2.1 erlang-src-18.2.2-2.1 erlang-wx-18.2.2-2.1 erlang-wx-src-18.2.2-2.1 References:

1 0

openSUSE-SU-2016:0512-1: critical: Security update for glibc
by opensuse-security＠opensuse.org 19 Feb '16

19 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0512-1 Rating: critical References: Cross-References: CVE-2015-7547 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following security issues: * fix stack overflow in the glibc libresolv DNS resolver function getaddrinfo(), known as CVE-2015-7547. It is a client side networked/remote vulnerability. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): glibc-2.18-4.41.2 glibc-debuginfo-2.18-4.41.2 glibc-debugsource-2.18-4.41.2 glibc-devel-2.18-4.41.2 glibc-devel-debuginfo-2.18-4.41.2 glibc-devel-static-2.18-4.41.2 glibc-extra-2.18-4.41.2 glibc-extra-debuginfo-2.18-4.41.2 glibc-locale-2.18-4.41.2 glibc-locale-debuginfo-2.18-4.41.2 glibc-profile-2.18-4.41.2 glibc-utils-2.18-4.41.4 glibc-utils-debuginfo-2.18-4.41.4 glibc-utils-debugsource-2.18-4.41.4 nscd-2.18-4.41.2 nscd-debuginfo-2.18-4.41.2 - openSUSE 13.1 (x86_64): glibc-32bit-2.18-4.41.1 glibc-debuginfo-32bit-2.18-4.41.1 glibc-devel-32bit-2.18-4.41.1 glibc-devel-debuginfo-32bit-2.18-4.41.1 glibc-devel-static-32bit-2.18-4.41.1 glibc-locale-32bit-2.18-4.41.1 glibc-locale-debuginfo-32bit-2.18-4.41.1 glibc-profile-32bit-2.18-4.41.1 glibc-utils-32bit-2.18-4.41.4 glibc-utils-debuginfo-32bit-2.18-4.41.4 - openSUSE 13.1 (noarch): glibc-html-2.18-4.41.2 glibc-i18ndata-2.18-4.41.1 glibc-i18ndata-2.18-4.41.2 glibc-info-2.18-4.41.1 glibc-info-2.18-4.41.2 - openSUSE 13.1 (i686): glibc-2.18-4.41.1 glibc-debuginfo-2.18-4.41.1 glibc-debugsource-2.18-4.41.1 glibc-devel-2.18-4.41.1 glibc-devel-debuginfo-2.18-4.41.1 glibc-devel-static-2.18-4.41.1 glibc-extra-2.18-4.41.1 glibc-extra-debuginfo-2.18-4.41.1 glibc-locale-2.18-4.41.1 glibc-locale-debuginfo-2.18-4.41.1 glibc-obsolete-2.18-4.41.1 glibc-obsolete-debuginfo-2.18-4.41.1 glibc-profile-2.18-4.41.1 nscd-2.18-4.41.1 nscd-debuginfo-2.18-4.41.1 - openSUSE 13.1 (i586): glibc-obsolete-2.18-4.41.2 glibc-obsolete-debuginfo-2.18-4.41.2 References: https://www.suse.com/security/cve/CVE-2015-7547.html

1 0

openSUSE-SU-2016:0511-1: critical: Security update for glibc
by opensuse-security＠opensuse.org 19 Feb '16

19 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0511-1 Rating: critical References: Cross-References: CVE-2015-7547 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following security issues: * fix stack overflow in the glibc libresolv DNS resolver function getaddrinfo(), known as CVE-2015-7547. It is a client side networked/remote vulnerability. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): glibc-2.11.3-69.2 glibc-debuginfo-2.11.3-69.2 glibc-debugsource-2.11.3-69.2 glibc-devel-2.11.3-69.2 glibc-devel-debuginfo-2.11.3-69.2 glibc-html-2.11.3-69.2 glibc-i18ndata-2.11.3-69.2 glibc-info-2.11.3-69.2 glibc-locale-2.11.3-69.2 glibc-locale-debuginfo-2.11.3-69.2 glibc-obsolete-2.11.3-69.2 glibc-profile-2.11.3-69.2 nscd-2.11.3-69.2 nscd-debuginfo-2.11.3-69.2 - openSUSE Evergreen 11.4 (x86_64): glibc-32bit-2.11.3-69.1 glibc-debuginfo-32bit-2.11.3-69.1 glibc-devel-32bit-2.11.3-69.1 glibc-devel-debuginfo-32bit-2.11.3-69.1 glibc-locale-32bit-2.11.3-69.1 glibc-locale-debuginfo-32bit-2.11.3-69.1 glibc-profile-32bit-2.11.3-69.1 - openSUSE Evergreen 11.4 (ia64): glibc-debuginfo-x86-2.11.3-69.1 glibc-devel-debuginfo-x86-2.11.3-69.1 glibc-locale-debuginfo-x86-2.11.3-69.1 glibc-locale-x86-2.11.3-69.1 glibc-profile-x86-2.11.3-69.1 glibc-x86-2.11.3-69.1 - openSUSE Evergreen 11.4 (i686): glibc-2.11.3-69.1 glibc-debuginfo-2.11.3-69.1 glibc-debugsource-2.11.3-69.1 glibc-devel-2.11.3-69.1 glibc-devel-debuginfo-2.11.3-69.1 glibc-html-2.11.3-69.1 glibc-i18ndata-2.11.3-69.1 glibc-info-2.11.3-69.1 glibc-locale-2.11.3-69.1 glibc-locale-debuginfo-2.11.3-69.1 glibc-obsolete-2.11.3-69.1 glibc-obsolete-debuginfo-2.11.3-69.1 glibc-profile-2.11.3-69.1 nscd-2.11.3-69.1 nscd-debuginfo-2.11.3-69.1 - openSUSE Evergreen 11.4 (i586): glibc-obsolete-debuginfo-2.11.3-69.2 References: https://www.suse.com/security/cve/CVE-2015-7547.html

1 0

openSUSE-SU-2016:0510-1: important: Security update for glibc
by opensuse-security＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0510-1 Rating: important References: #956716 #958315 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8778 CVE-2015-8779 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: This update for glibc fixes the following issues: - errorcheck-mutex-no-elision.patch: Don't do lock elision on an error checking mutex (boo#956716, BZ #17514) - reinitialize-dl_load_write_lock.patch: Reinitialize dl_load_write_lock on fork (boo#958315, BZ #19282) - send-dg-buffer-overflow.patch: Fix getaddrinfo stack-based buffer overflow (CVE-2015-7547, boo#961721, BZ #18665) - strftime-range-check.patch: Add range check on time fields (CVE-2015-8776, boo#962736, BZ #18985) - hcreate-overflow-check.patch: Handle overflow in hcreate (CVE-2015-8778, boo#962737, BZ #18240) - refactor-nan-parsing.patch: Refactor strtod parsing of NaN payloads (CVE-2014-9761, boo#962738, BZ #16962) - catopen-unbound-alloca.patch: Fix unbound alloca in catopen (CVE-2015-8779, boo#962739, BZ #17905) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-233=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 i686 x86_64): glibc-2.19-16.22.2 glibc-debuginfo-2.19-16.22.2 glibc-debugsource-2.19-16.22.2 glibc-devel-2.19-16.22.2 glibc-devel-debuginfo-2.19-16.22.2 glibc-devel-static-2.19-16.22.2 glibc-locale-2.19-16.22.2 glibc-locale-debuginfo-2.19-16.22.2 glibc-profile-2.19-16.22.2 - openSUSE 13.2 (i586 x86_64): glibc-extra-2.19-16.22.2 glibc-extra-debuginfo-2.19-16.22.2 glibc-utils-2.19-16.22.2 glibc-utils-debuginfo-2.19-16.22.2 glibc-utils-debugsource-2.19-16.22.2 nscd-2.19-16.22.2 nscd-debuginfo-2.19-16.22.2 - openSUSE 13.2 (x86_64): glibc-32bit-2.19-16.22.2 glibc-debuginfo-32bit-2.19-16.22.2 glibc-devel-32bit-2.19-16.22.2 glibc-devel-debuginfo-32bit-2.19-16.22.2 glibc-devel-static-32bit-2.19-16.22.2 glibc-locale-32bit-2.19-16.22.2 glibc-locale-debuginfo-32bit-2.19-16.22.2 glibc-profile-32bit-2.19-16.22.2 glibc-utils-32bit-2.19-16.22.2 glibc-utils-debuginfo-32bit-2.19-16.22.2 - openSUSE 13.2 (noarch): glibc-html-2.19-16.22.2 glibc-i18ndata-2.19-16.22.2 glibc-info-2.19-16.22.2 - openSUSE 13.2 (i586): glibc-obsolete-2.19-16.22.2 glibc-obsolete-debuginfo-2.19-16.22.2 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/956716 https://bugzilla.suse.com/958315 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739

1 0

openSUSE-RU-2016:0503-1: moderate: Recommended update for btrfsprogs
by maintenance＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Recommended Update: Recommended update for btrfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0503-1 Rating: moderate References: #956819 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for btrfsprogs fixes a mkfs failure on architectures with sectorsize greater than 4 kbytes. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-232=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): btrfsprogs-4.1.2-10.1 btrfsprogs-debuginfo-4.1.2-10.1 btrfsprogs-debugsource-4.1.2-10.1 libbtrfs-devel-4.1.2-10.1 libbtrfs0-4.1.2-10.1 libbtrfs0-debuginfo-4.1.2-10.1 References: https://bugzilla.suse.com/956819

1 0

openSUSE-RU-2016:0502-1: moderate: Recommended update for squashfs
by maintenance＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Recommended Update: Recommended update for squashfs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0502-1 Rating: moderate References: #953723 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for squashfs fixes a file corruption issue caused by a rare race condition. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-231=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): squashfs-4.3-6.1 squashfs-debuginfo-4.3-6.1 squashfs-debugsource-4.3-6.1 References: https://bugzilla.suse.com/953723

1 0

openSUSE-SU-2016:0501-1: moderate: Security update for krb5
by opensuse-security＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0501-1 Rating: moderate References: #963964 #963968 #963975 Cross-References: CVE-2015-8629 CVE-2015-8630 CVE-2015-8631 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for krb5 fixes the following issues: - CVE-2015-8629: Information leak authenticated attackers with permissions to modify the database (bsc#963968) - CVE-2015-8630: An authenticated attacker with permission to modify a principal entry may have caused kadmind to crash (bsc#963964) - CVE-2015-8631: An authenticated attacker could have caused a memory leak in auditd by supplying a null principal name in request (bsc#963975) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-230=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): krb5-1.12.1-27.1 krb5-client-1.12.1-27.1 krb5-client-debuginfo-1.12.1-27.1 krb5-debuginfo-1.12.1-27.1 krb5-debugsource-1.12.1-27.1 krb5-devel-1.12.1-27.1 krb5-doc-1.12.1-27.1 krb5-mini-1.12.1-27.1 krb5-mini-debuginfo-1.12.1-27.1 krb5-mini-debugsource-1.12.1-27.1 krb5-mini-devel-1.12.1-27.1 krb5-plugin-kdb-ldap-1.12.1-27.1 krb5-plugin-kdb-ldap-debuginfo-1.12.1-27.1 krb5-plugin-preauth-otp-1.12.1-27.1 krb5-plugin-preauth-otp-debuginfo-1.12.1-27.1 krb5-plugin-preauth-pkinit-1.12.1-27.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.1-27.1 krb5-server-1.12.1-27.1 krb5-server-debuginfo-1.12.1-27.1 - openSUSE Leap 42.1 (x86_64): krb5-32bit-1.12.1-27.1 krb5-debuginfo-32bit-1.12.1-27.1 krb5-devel-32bit-1.12.1-27.1 References: https://www.suse.com/security/cve/CVE-2015-8629.html https://www.suse.com/security/cve/CVE-2015-8630.html https://www.suse.com/security/cve/CVE-2015-8631.html https://bugzilla.suse.com/963964 https://bugzilla.suse.com/963968 https://bugzilla.suse.com/963975

1 0