March 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:0899-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0899-1 Rating: moderate References: #957291 #963441 #966869 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sssd provides the following fixes: - Add new configuration option "ldap_use_tokengroups" to control whether the Token-Groups attribute will be used when performing initgroup for users from Active Directory Server 2008 and later. By default Token-Groups usage is disabled. (bsc#963441, bsc#966869) - Resolve issues with missing groups and group attributes from Active Directory. (bsc#957291) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-408=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libipa_hbac-devel-1.11.5.1-10.1 libipa_hbac0-1.11.5.1-10.1 libipa_hbac0-debuginfo-1.11.5.1-10.1 libsss_idmap-devel-1.11.5.1-10.1 libsss_idmap0-1.11.5.1-10.1 libsss_idmap0-debuginfo-1.11.5.1-10.1 libsss_nss_idmap-devel-1.11.5.1-10.1 libsss_nss_idmap0-1.11.5.1-10.1 libsss_nss_idmap0-debuginfo-1.11.5.1-10.1 libsss_sudo-1.11.5.1-10.1 libsss_sudo-debuginfo-1.11.5.1-10.1 python-ipa_hbac-1.11.5.1-10.1 python-ipa_hbac-debuginfo-1.11.5.1-10.1 python-sss_nss_idmap-1.11.5.1-10.1 python-sss_nss_idmap-debuginfo-1.11.5.1-10.1 python-sssd-config-1.11.5.1-10.1 python-sssd-config-debuginfo-1.11.5.1-10.1 sssd-1.11.5.1-10.1 sssd-ad-1.11.5.1-10.1 sssd-ad-debuginfo-1.11.5.1-10.1 sssd-debuginfo-1.11.5.1-10.1 sssd-debugsource-1.11.5.1-10.1 sssd-ipa-1.11.5.1-10.1 sssd-ipa-debuginfo-1.11.5.1-10.1 sssd-krb5-1.11.5.1-10.1 sssd-krb5-common-1.11.5.1-10.1 sssd-krb5-common-debuginfo-1.11.5.1-10.1 sssd-krb5-debuginfo-1.11.5.1-10.1 sssd-ldap-1.11.5.1-10.1 sssd-ldap-debuginfo-1.11.5.1-10.1 sssd-proxy-1.11.5.1-10.1 sssd-proxy-debuginfo-1.11.5.1-10.1 sssd-tools-1.11.5.1-10.1 sssd-tools-debuginfo-1.11.5.1-10.1 - openSUSE Leap 42.1 (x86_64): sssd-32bit-1.11.5.1-10.1 sssd-debuginfo-32bit-1.11.5.1-10.1 References: https://bugzilla.suse.com/957291 https://bugzilla.suse.com/963441 https://bugzilla.suse.com/966869

1 0

openSUSE-RU-2016:0898-1: ocfs2console fix starting failure
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: ocfs2console fix starting failure ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0898-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: ocfs2console fix starting failure Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-407=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ocfs2-tools-1.8.4-9.1 ocfs2-tools-debuginfo-1.8.4-9.1 ocfs2-tools-debugsource-1.8.4-9.1 ocfs2-tools-devel-1.8.4-9.1 ocfs2-tools-devel-static-1.8.4-9.1 ocfs2-tools-o2cb-1.8.4-9.1 ocfs2-tools-o2cb-debuginfo-1.8.4-9.1 ocfs2console-1.8.4-9.1 ocfs2console-debuginfo-1.8.4-9.1 References:

1 0

openSUSE-SU-2016:0897-1: moderate: Security update for gdk-pixbuf
by opensuse-security＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Security Update: Security update for gdk-pixbuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0897-1 Rating: moderate References: #948790 #948791 #958963 Cross-References: CVE-2015-7552 CVE-2015-7673 CVE-2015-7674 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for gdk-pixbuf fixes the following issues: - CVE-2015-7552: Fixed various overflows in image handling (boo#958963). - CVE-2015-7673: Fixed an overflow and DoS with a TGA file (boo#948790). - CVE-2015-7674: Fixed overflow when scaling a gif (boo#948791). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-405=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gdk-pixbuf-debugsource-2.31.6-6.1 gdk-pixbuf-devel-2.31.6-6.1 gdk-pixbuf-devel-debuginfo-2.31.6-6.1 gdk-pixbuf-query-loaders-2.31.6-6.1 gdk-pixbuf-query-loaders-debuginfo-2.31.6-6.1 libgdk_pixbuf-2_0-0-2.31.6-6.1 libgdk_pixbuf-2_0-0-debuginfo-2.31.6-6.1 typelib-1_0-GdkPixbuf-2_0-2.31.6-6.1 - openSUSE 13.2 (x86_64): gdk-pixbuf-devel-32bit-2.31.6-6.1 gdk-pixbuf-devel-debuginfo-32bit-2.31.6-6.1 gdk-pixbuf-query-loaders-32bit-2.31.6-6.1 gdk-pixbuf-query-loaders-debuginfo-32bit-2.31.6-6.1 libgdk_pixbuf-2_0-0-32bit-2.31.6-6.1 libgdk_pixbuf-2_0-0-debuginfo-32bit-2.31.6-6.1 - openSUSE 13.2 (noarch): gdk-pixbuf-lang-2.31.6-6.1 References: https://www.suse.com/security/cve/CVE-2015-7552.html https://www.suse.com/security/cve/CVE-2015-7673.html https://www.suse.com/security/cve/CVE-2015-7674.html https://bugzilla.suse.com/948790 https://bugzilla.suse.com/948791 https://bugzilla.suse.com/958963

1 0

openSUSE-FU-2016:0896-1: moderate: Add Mozilla Thunderbird to SLE 12 Backports
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Feature Update: Add Mozilla Thunderbird to SLE 12 Backports ______________________________________________________________________________ Announcement ID: openSUSE-FU-2016:0896-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update adds Mozilla Thunderbird 38.7.0 to the SLE 12 Backports project. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-404=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-38.7.0-2.1 MozillaThunderbird-buildsymbols-38.7.0-2.1 MozillaThunderbird-devel-38.7.0-2.1 MozillaThunderbird-translations-common-38.7.0-2.1 MozillaThunderbird-translations-other-38.7.0-2.1 References:

1 0

openSUSE-RU-2016:0895-1: Recommended update for timezone
by maintenance＠opensuse.org 26 Mar '16

26 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0895-1 Rating: low References: #971377 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016b) for your system, including the following changes: - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-403=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): timezone-2016b-46.1 timezone-debuginfo-2016b-46.1 timezone-debugsource-2016b-46.1 - openSUSE 13.1 (noarch): timezone-java-2016b-46.1 References: https://bugzilla.suse.com/971377

1 0

openSUSE-SU-2016:0894-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Mar '16

26 Mar '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0894-1 Rating: important References: #969894 Cross-References: CVE-2015-4477 CVE-2015-7207 CVE-2016-1952 CVE-2016-1954 CVE-2016-1957 CVE-2016-1958 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: MozillaThunderbird was updated to 38.7.0 to fix the following issues: * Update to Thunderbird 38.7.0 (boo#969894) * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-136/CVE-2015-7207 (bmo#1185256) Same-origin policy violation using performance.getEntries and history navigation * MFSA 2016-16/CVE-2016-1952 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-402=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-38.7.0-70.80.1 MozillaThunderbird-buildsymbols-38.7.0-70.80.1 MozillaThunderbird-debuginfo-38.7.0-70.80.1 MozillaThunderbird-debugsource-38.7.0-70.80.1 MozillaThunderbird-devel-38.7.0-70.80.1 MozillaThunderbird-translations-common-38.7.0-70.80.1 MozillaThunderbird-translations-other-38.7.0-70.80.1 References: https://www.suse.com/security/cve/CVE-2015-4477.html https://www.suse.com/security/cve/CVE-2015-7207.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894

1 0

openSUSE-RU-2016:0893-1: Recommended update for timezone
by maintenance＠opensuse.org 25 Mar '16

25 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0893-1 Rating: low References: #972433 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016c) for your system, including the following changes: - Azerbaijan no longer observes DST (Asia/Baku) - Chile reverts from permanent to seasonal DST This release also includes changes affecting past time stamps and documentation. For a comprehensive list, please refer to the release announcement from ICANN: http://mm.icann.org/pipermail/tz-announce/2016-March/000037.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 4886=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016c-0.11.1 timezone-debuginfo-2016c-0.11.1 timezone-debugsource-2016c-0.11.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016c-0.11.1 References: https://bugzilla.suse.com/972433

1 0

openSUSE-RU-2016:0892-1: Recommended update for timezone
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0892-1 Rating: low References: #971377 #972433 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides the latest timezone information (2016c) for your system, including the following changes: - Azerbaijan no longer observes DST. - Chile reverts from permanent to seasonal DST. - Correct past timestamps for Europe/Kaliningrad, Europe/Vilnius, Europe/Volgograd 1989-1991 - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-401=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2016c-38.1 timezone-debuginfo-2016c-38.1 timezone-debugsource-2016c-38.1 - openSUSE 13.2 (noarch): timezone-java-2016c-38.1 References: https://bugzilla.suse.com/971377 https://bugzilla.suse.com/972433

1 0

openSUSE-RU-2016:0891-1: Recommended update for timezone
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0891-1 Rating: low References: #971377 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016b) for your system, including the following changes: - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-400=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016b-0.8.1 timezone-debuginfo-2016b-0.8.1 timezone-debugsource-2016b-0.8.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016b-0.8.1 References: https://bugzilla.suse.com/971377

1 0

openSUSE-SU-2016:0888-1: moderate: Security update for quagga
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0888-1 Rating: moderate References: #970952 Cross-References: CVE-2016-2342 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following security issue: - CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-396=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quagga-0.99.24.1-5.1 quagga-debuginfo-0.99.24.1-5.1 quagga-debugsource-0.99.24.1-5.1 quagga-devel-0.99.24.1-5.1 References: https://www.suse.com/security/cve/CVE-2016-2342.html https://bugzilla.suse.com/970952

1 0