February 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:0500-1: Recommended update for ant-contrib
by maintenance＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Recommended Update: Recommended update for ant-contrib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0500-1 Rating: low References: #922324 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ant-contrib enables the <antcontrib:for> task. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-227=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): ant-contrib-1.0b3-6.1 ant-contrib-javadoc-1.0b3-6.1 ant-contrib-manual-1.0b3-6.1 References: https://bugzilla.suse.com/922324

1 0

openSUSE-RU-2016:0499-1: moderate: Recommended update for desktop-translations
by maintenance＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Recommended Update: Recommended update for desktop-translations ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0499-1 Rating: moderate References: #964566 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update provides version 13.2 for desktop-translations: - Update translations (boo#964566). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-226=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): desktop-translations-13.2-11.9.1 References: https://bugzilla.suse.com/964566

1 0

openSUSE-RU-2016:0498-1: moderate: Recommended update for release-notes-openSUSE
by maintenance＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Recommended Update: Recommended update for release-notes-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0498-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for release-notes-openSUSE fixes the following issues: - Post-GA update (boo#967075) - Use Leap 42.1 release notes instread of those from Tumbleweed (boo#965691) - Add necessary CJK fonts to spec file (boo#965462) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-229=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): release-notes-openSUSE-42.1.20160217-9.1 References:

1 0

openSUSE-RU-2016:0497-1: moderate: Recommended update for xf86-video-intel
by maintenance＠opensuse.org 18 Feb '16

18 Feb '16

openSUSE Recommended Update: Recommended update for xf86-video-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0497-1 Rating: moderate References: #950666 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xf86-video-intel fixes the following issue: - Fix video playback using XV (boo#950666). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-228=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-228=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xf86-video-intel-2.99.917-9.1 xf86-video-intel-debuginfo-2.99.917-9.1 xf86-video-intel-debugsource-2.99.917-9.1 - openSUSE Leap 42.1 (x86_64): xf86-video-intel-32bit-2.99.917-9.1 xf86-video-intel-debuginfo-32bit-2.99.917-9.1 - openSUSE 13.2 (i586 x86_64): xf86-video-intel-2.99.916-27.1 xf86-video-intel-debuginfo-2.99.916-27.1 xf86-video-intel-debugsource-2.99.916-27.1 - openSUSE 13.2 (x86_64): xf86-video-intel-32bit-2.99.916-27.1 xf86-video-intel-debuginfo-32bit-2.99.916-27.1 References: https://bugzilla.suse.com/950666

1 0

openSUSE-SU-2016:0492-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0492-1 Rating: moderate References: #963520 #963632 #963635 Cross-References: CVE-2016-1930 CVE-2016-1935 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update Mozilla Thunderbird 38.6.0 fixes the following issues(boo#963520): - CVE-2016-1930: Miscellaneous memory safety hazards (boo#963632) - CVE-2016-1935: Buffer overflow in WebGL after out of memory allocation (boo#963635) The following upstream fixes are included: - Filters ran on a different folder than selected Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-222=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-222=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-38.6.0-10.1 MozillaThunderbird-buildsymbols-38.6.0-10.1 MozillaThunderbird-debuginfo-38.6.0-10.1 MozillaThunderbird-debugsource-38.6.0-10.1 MozillaThunderbird-devel-38.6.0-10.1 MozillaThunderbird-translations-common-38.6.0-10.1 MozillaThunderbird-translations-other-38.6.0-10.1 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-38.6.0-37.1 MozillaThunderbird-buildsymbols-38.6.0-37.1 MozillaThunderbird-debuginfo-38.6.0-37.1 MozillaThunderbird-debugsource-38.6.0-37.1 MozillaThunderbird-devel-38.6.0-37.1 MozillaThunderbird-translations-common-38.6.0-37.1 MozillaThunderbird-translations-other-38.6.0-37.1 References: https://www.suse.com/security/cve/CVE-2016-1930.html https://www.suse.com/security/cve/CVE-2016-1935.html https://bugzilla.suse.com/963520 https://bugzilla.suse.com/963632 https://bugzilla.suse.com/963635

1 0

openSUSE-SU-2016:0491-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0491-1 Rating: moderate References: #965566 #965738 #965999 #966082 Cross-References: CVE-2016-1622 CVE-2016-1623 CVE-2016-1624 CVE-2016-1625 CVE-2016-1626 CVE-2016-1627 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update to Chromium 48.0.2564.109 fixes the following issues: Security fixes (boo#965999): - CVE-2016-1622: Same-origin bypass in Extensions - CVE-2016-1623: Same-origin bypass in DOM - CVE-2016-1624: Buffer overflow in Brotli - CVE-2016-1625: Navigation bypass in Chrome Instant - CVE-2016-1626: Out-of-bounds read in PDFium - CVE-2016-1627: Various fixes from internal audits, fuzzing and other initiatives Non-security bug fixes: - boo#965738: resolve issues with specific banking websites when built against system libraries - boo#966082: chromium: sandbox related stacktrace printed - boo#965566: Drop libva support - Prevent graphical issues related to libjpeg - On KDE 5 kwallet5 is the default password store now Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-221=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-48.0.2564.109-49.1 chromedriver-debuginfo-48.0.2564.109-49.1 chromium-48.0.2564.109-49.1 chromium-debuginfo-48.0.2564.109-49.1 chromium-debugsource-48.0.2564.109-49.1 chromium-desktop-gnome-48.0.2564.109-49.1 chromium-desktop-kde-48.0.2564.109-49.1 chromium-ffmpegsumo-48.0.2564.109-49.1 chromium-ffmpegsumo-debuginfo-48.0.2564.109-49.1 References: https://www.suse.com/security/cve/CVE-2016-1622.html https://www.suse.com/security/cve/CVE-2016-1623.html https://www.suse.com/security/cve/CVE-2016-1624.html https://www.suse.com/security/cve/CVE-2016-1625.html https://www.suse.com/security/cve/CVE-2016-1626.html https://www.suse.com/security/cve/CVE-2016-1627.html https://bugzilla.suse.com/965566 https://bugzilla.suse.com/965738 https://bugzilla.suse.com/965999 https://bugzilla.suse.com/966082

1 0

openSUSE-SU-2016:0490-1: important: Security update for glibc
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0490-1 Rating: important References: #950944 #955647 #956716 #958315 #961721 #962736 #962737 #962738 #962739 Cross-References: CVE-2014-9761 CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update for glibc fixes the following security issues: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a crash or execute arbitrary code via crafted and timed DNS responses (bsc#961721) - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD environment variable allowed local attackers to bypass the pointer guarding protection of the dynamic loader on set-user-ID and set-group-ID programs (bsc#950944) - CVE-2015-8776: Out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information (bsc#962736) - CVE-2015-8778: Integer overflow in hcreate and hcreate_r could have caused an out-of-bound memory access. leading to application crashes or, potentially, arbitrary code execution (bsc#962737) - CVE-2014-9761: A stack overflow (unbounded alloca) could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code. (bsc#962738) - CVE-2015-8779: A stack overflow (unbounded alloca) in the catopen function could have caused applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. (bsc#962739) The following non-security bugs were fixed: - bsc#955647: Resource leak in resolver - bsc#956716: Don't do lock elision on an error checking mutex - bsc#958315: Reinitialize dl_load_write_lock on fork This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-224=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 i686 x86_64): glibc-2.19-19.1 glibc-debuginfo-2.19-19.1 glibc-debugsource-2.19-19.1 glibc-devel-2.19-19.1 glibc-devel-debuginfo-2.19-19.1 glibc-devel-static-2.19-19.1 glibc-locale-2.19-19.1 glibc-locale-debuginfo-2.19-19.1 glibc-profile-2.19-19.1 - openSUSE Leap 42.1 (i586 x86_64): glibc-extra-2.19-19.1 glibc-extra-debuginfo-2.19-19.1 glibc-utils-2.19-19.1 glibc-utils-debuginfo-2.19-19.1 glibc-utils-debugsource-2.19-19.1 nscd-2.19-19.1 nscd-debuginfo-2.19-19.1 - openSUSE Leap 42.1 (x86_64): glibc-32bit-2.19-19.1 glibc-debuginfo-32bit-2.19-19.1 glibc-devel-32bit-2.19-19.1 glibc-devel-debuginfo-32bit-2.19-19.1 glibc-devel-static-32bit-2.19-19.1 glibc-locale-32bit-2.19-19.1 glibc-locale-debuginfo-32bit-2.19-19.1 glibc-profile-32bit-2.19-19.1 glibc-utils-32bit-2.19-19.1 glibc-utils-debuginfo-32bit-2.19-19.1 - openSUSE Leap 42.1 (noarch): glibc-html-2.19-19.1 glibc-i18ndata-2.19-19.1 glibc-info-2.19-19.1 - openSUSE Leap 42.1 (i586): glibc-obsolete-2.19-19.1 glibc-obsolete-debuginfo-2.19-19.1 References: https://www.suse.com/security/cve/CVE-2014-9761.html https://www.suse.com/security/cve/CVE-2015-7547.html https://www.suse.com/security/cve/CVE-2015-8776.html https://www.suse.com/security/cve/CVE-2015-8777.html https://www.suse.com/security/cve/CVE-2015-8778.html https://www.suse.com/security/cve/CVE-2015-8779.html https://bugzilla.suse.com/950944 https://bugzilla.suse.com/955647 https://bugzilla.suse.com/956716 https://bugzilla.suse.com/958315 https://bugzilla.suse.com/961721 https://bugzilla.suse.com/962736 https://bugzilla.suse.com/962737 https://bugzilla.suse.com/962738 https://bugzilla.suse.com/962739

1 0

openSUSE-SU-2016:0489-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0489-1 Rating: moderate References: #966438 Cross-References: CVE-2016-1949 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaFirefox fixes the following issues: - update to Firefox 44.0.2 * MFSA 2016-13/CVE-2016-1949 (bmo#1245724, boo#966438) Same-origin-policy violation using Service Workers with plugins * Fix issue which could lead to the removal of stored passwords under certain circumstances (bmo#1242176) * Allows spaces in cookie names (bmo#1244505) * Disable opus/vorbis audio with H.264 (bmo#1245696) * Fix for graphics startup crash (GNU/Linux) (bmo#1222171) * Fix a crash in cache networking (bmo#1244076) * Fix using WebSockets in service worker controlled pages (bmo#1243942) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-223=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-223=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-44.0.2-15.2 MozillaFirefox-branding-upstream-44.0.2-15.2 MozillaFirefox-buildsymbols-44.0.2-15.2 MozillaFirefox-debuginfo-44.0.2-15.2 MozillaFirefox-debugsource-44.0.2-15.2 MozillaFirefox-devel-44.0.2-15.2 MozillaFirefox-translations-common-44.0.2-15.2 MozillaFirefox-translations-other-44.0.2-15.2 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-44.0.2-62.1 MozillaFirefox-branding-upstream-44.0.2-62.1 MozillaFirefox-buildsymbols-44.0.2-62.1 MozillaFirefox-debuginfo-44.0.2-62.1 MozillaFirefox-debugsource-44.0.2-62.1 MozillaFirefox-devel-44.0.2-62.1 MozillaFirefox-translations-common-44.0.2-62.1 MozillaFirefox-translations-other-44.0.2-62.1 References: https://www.suse.com/security/cve/CVE-2016-1949.html https://bugzilla.suse.com/966438

1 0

openSUSE-SU-2016:0488-1: moderate: Security update for Thunderbird
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0488-1 Rating: moderate References: #963520 Cross-References: CVE-2015-7575 CVE-2016-1930 CVE-2016-1935 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to 38.6.0 fixes the following issues: * MFSA 2016-01/CVE-2016-1930 Miscellaneous memory safety hazards * MFSA 2016-03/CVE-2016-1935 (bmo#1220450) Buffer overflow in WebGL after out of memory allocation Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-225=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-38.6.0-70.74.1 MozillaThunderbird-buildsymbols-38.6.0-70.74.1 MozillaThunderbird-debuginfo-38.6.0-70.74.1 MozillaThunderbird-debugsource-38.6.0-70.74.1 MozillaThunderbird-devel-38.6.0-70.74.1 MozillaThunderbird-translations-common-38.6.0-70.74.1 MozillaThunderbird-translations-other-38.6.0-70.74.1 References: https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2016-1930.html https://www.suse.com/security/cve/CVE-2016-1935.html https://bugzilla.suse.com/963520

1 0

openSUSE-SU-2016:0486-1: moderate: Security update for libnettle
by opensuse-security＠opensuse.org 17 Feb '16

17 Feb '16

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0486-1 Rating: moderate References: #964845 #964847 #964849 Cross-References: CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libnettle fixes the following issues: - CVE-2015-8803: secp256 calculation bug (boo#964845) - CVE-2015-8804: Miscalculations on secp384 curve (boo#964847) - CVE-2015-8805: Fixed miscomputation bugs in secp-256r1 modulo functions. (boo#964849) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-217=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libhogweed2-2.7.1-2.3.1 libhogweed2-debuginfo-2.7.1-2.3.1 libnettle-debugsource-2.7.1-2.3.1 libnettle-devel-2.7.1-2.3.1 libnettle4-2.7.1-2.3.1 libnettle4-debuginfo-2.7.1-2.3.1 nettle-2.7.1-2.3.1 nettle-debuginfo-2.7.1-2.3.1 - openSUSE 13.1 (x86_64): libhogweed2-32bit-2.7.1-2.3.1 libhogweed2-debuginfo-32bit-2.7.1-2.3.1 libnettle-devel-32bit-2.7.1-2.3.1 libnettle4-32bit-2.7.1-2.3.1 libnettle4-debuginfo-32bit-2.7.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-8803.html https://www.suse.com/security/cve/CVE-2015-8804.html https://www.suse.com/security/cve/CVE-2015-8805.html https://bugzilla.suse.com/964845 https://bugzilla.suse.com/964847 https://bugzilla.suse.com/964849

1 0