March 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0875-1: important: Security update for graphite2
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for graphite2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0875-1 Rating: important References: #965803 #965807 #965810 Cross-References: CVE-2016-1521 CVE-2016-1523 CVE-2016-1526 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for graphite2 fixes the following issues: - CVE-2016-1521: The directrun function in directmachine.cpp in Libgraphite did not validate a certain skip operation, which allowed remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. - CVE-2016-1523: The SillMap::readFace function in FeatureMap.cpp in Libgraphite mishandled a return value, which allowed remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font. - CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite incorrectly validated a size value, which allowed remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. This update was imported from the SUSE:SLE-12:Update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-389=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): graphite2-1.3.1-3.1 graphite2-debuginfo-1.3.1-3.1 graphite2-debugsource-1.3.1-3.1 graphite2-devel-1.3.1-3.1 libgraphite2-3-1.3.1-3.1 libgraphite2-3-debuginfo-1.3.1-3.1 - openSUSE Leap 42.1 (x86_64): libgraphite2-3-32bit-1.3.1-3.1 libgraphite2-3-debuginfo-32bit-1.3.1-3.1 References: https://www.suse.com/security/cve/CVE-2016-1521.html https://www.suse.com/security/cve/CVE-2016-1523.html https://www.suse.com/security/cve/CVE-2016-1526.html https://bugzilla.suse.com/965803 https://bugzilla.suse.com/965807 https://bugzilla.suse.com/965810

1 0

openSUSE-SU-2016:0874-1: moderate: Security update for dropbear
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0874-1 Rating: moderate References: #970633 Cross-References: CVE-2016-3116 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dropbear fixes the following issues: - dropbear was updated to upstream version 2016.72 * Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug fix release for boo#970633 - CVE-2016-3116 - dropbear was updated to upstream version 2015.71 * Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 * Fix crash on exit when -p address:port is used, broke in 2015.68 * Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev * Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert, broke in 2015.70 * Fix server race condition that could cause sessions to hang on exit, https://github.com/robotframework/SSHLibrary/issues/128 - dropbear was updated to upstream version 2015.70 * Fix server password authentication on Linux, broke in 2015.69 * Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68) * Avoid hang on session close when multiple sessions are started, affects Qt Creator Patch from Andrzej Szombierski * Reduce per-channel memory consumption in common case, increase default channel limit from 100 to 1000 which should improve SOCKS forwarding for modern webpages * Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin * Manpage improvements from Guilhem Moulin * Build fixes for Android from Mike Frysinger * Don't display the MOTD when an explicit command is run from Guilhem Moulin * Check curve25519 shared secret isn't zero - dropbear was updated to upstream version 2015.68 * Reduce local data copying for improved efficiency. Measured 30% increase in throughput for connections to localhost * Forwarded TCP ports connect asynchronously and try all available addresses (IPv4, IPv6, round robin DNS) * Fix all compile warnings, many patches from Gaël Portay Note that configure with -Werror may not be successful on some platforms (OS X) and some configuration options may still result in unused variable warnings. * Use TCP Fast Open on Linux if available. Saves a round trip at connection to hosts that have previously been connected. Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" Client side is disabled by default pending further compatibility testing with networks and systems. * Increase maximum command length to 9000 bytes * Free memory before exiting, patch from Thorsten Horstmann. Useful for Dropbear ports to embedded systems and for checking memory leaks with valgrind. Only partially implemented for dbclient. This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h * DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless there is a leading slash (~ isn't treated specially) * Fix small ECC memory leaks * Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of Matta Consulting. Odds of bad values are around 2**-512 -- improbable. * Twofish-ctr cipher is supported though disabled by default * Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks to CL Ouyang * Fix null pointer crash with restrictions in authorized_keys without a command, patch from Guilhem Moulin * Ensure authentication timeout is handled while reading the initial banner, thanks to CL Ouyang for finding it. * Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz - dropbear was updated to upstream version 2015.67 * Call fsync() after generating private keys to ensure they aren't lost if a reboot occurs. Thanks to Peter Korsgaard * Disable non-delayed zlib compression by default on the server. Can be enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB * Default client key path ~/.ssh/id_dropbear * Prefer stronger algorithms by default, from Fedor Brunner. AES256 over 3DES Diffie-hellman group14 over group1 * Add option to disable CBC ciphers. * Disable twofish in default options.h * Enable sha2 HMAC algorithms by default, the code was already required for ECC key exchange. sha1 is the first preference still for performance. * Fix installing dropbear.8 in a separate build directory, from Like Ma * Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe * Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea * Minor bug fixes, a few issues found by Coverity scan - dropbear was updated to upstream version 2014.66 * Use the same keepalive handling behaviour as OpenSSH. This will work better with some SSH implementations that have different behaviour with unknown message types. * Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own keepalive message * Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere * Fix wtmp which broke since 2013.62, patch from Whoopie - dropbear was updated to upstream version 2014.65 * Fix 2014.64 regression, server session hang on exit with scp (and probably others), thanks to NiLuJe for tracking it down * Fix 2014.64 regression, clock_gettime() error handling which broke on older Linux kernels, reported by NiLuJe * Fix 2014.64 regression, writev() could occassionally fail with EAGAIN which wasn't caught * Avoid error message when trying to set QoS on proxycommand or multihop pipes * Use /usr/bin/xauth, thanks to Mike Frysinger * Don't exit the client if the local user entry can't be found, thanks to iquaba - added missing systemd entries for dropbear-keygen.service - dropbear was updated to upstream version 2014.64 * Fix compiling with ECDSA and DSS disabled * Don't exit abruptly if too many outgoing packets are queued for writev(). Patch thanks to Ronny Meeus * The -K keepalive option now behaves more like OpenSSH's "ServerAliveInterval". If no response is received after 3 keepalives then the session is terminated. This will close connections faster than waiting for a TCP timeout. * Rework TCP priority setting. New settings are if (connecting || ptys || x11) tos = LOWDELAY else if (tcp_forwards) tos = 0 else tos = BULK Thanks to Catalin Patulea for the suggestion. * Improve handling of many concurrent new TCP forwarded connections, should now be able to handle as many as MAX_CHANNELS. Thanks to Eduardo Silva for reporting and investigating it. * Make sure that exit messages from the client are printed, regression in 2013.57 * Use monotonic clock where available, timeouts won't be affected by system time changes * Add -V for version - dropbear was updated regular init script to also create ECDSA keys - update to upstream version 2014.63 * Fix ~. to terminate a client interactive session after waking a laptop from sleep. * Changed port separator syntax again, now using host^port. This is because IPv6 link-local addresses use %. Reported by Gui Iribarren * Avoid constantly relinking dropbearmulti target, fix "make install" for multi target, thanks to Mike Frysinger * Avoid getting stuck in a loop writing huge key files, reported by Bruno Thomsen * Don't link dropbearkey or dropbearconvert to libz or libutil, thanks to Nicolas Boos * Fix linking -lcrypt on systems without /usr/lib, thanks to Nicolas Boos * Avoid crash on exit due to cleaned up keys before last packets are sent, debugged by Ronald Wahl * Fix a race condition in rekeying where Dropbear would exit if it received a still-in-flight packet after initiating rekeying. Reported by Oliver Metz. This is a longstanding bug but is triggered more easily since 2013.57 * [...] - dropbear was updated service files and activated building of ecdsa keys - only package the old init service in distributions without systemd - imported upstream version 2013.62 * Disable "interactive" QoS connection options when a connection doesn't have a PTY (eg scp, rsync). Thanks to Catalin Patulea for the patch. * Log when a hostkey is generated with -R, fix some bugs in handling server hostkey commandline options * Fix crash in Dropbearconvert and 521 bit key, reported by NiLuJe * Update config.guess and config.sub again * ECC (elliptic curve) support. Supports ECDSA hostkeys (requires new keys to be generated) and ECDH for setting up encryption keys (no intervention required). This is significantly faster. * curve25519-sha256(a)libssh.org support for setting up encryption keys. This is another elliptic curve mode with less potential of NSA interference in algorithm parameters. curve25519-donna code thanks to Adam Langley * -R option to automatically generate hostkeys. This is recommended for embedded platforms since it allows the system random number device /dev/urandom a longer startup time to generate a secure seed before the hostkey is required. * Compile fixes for old vendor compilers like Tru64 from Daniel Richard G. * Make authorized_keys handling more robust, don't exit encountering malformed lines. Thanks to Lorin Hochstein and Mark Stillwell Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2016-393=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): dropbear-2016.72-2.7.1 dropbear-debuginfo-2016.72-2.7.1 dropbear-debugsource-2016.72-2.7.1 References: https://www.suse.com/security/cve/CVE-2016-3116.html https://bugzilla.suse.com/970633

1 0

openSUSE-SU-2016:0865-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0865-1 Rating: important References: #967812 #967814 #967815 #967964 #967965 #967966 #967967 Cross-References: CVE-2015-5174 CVE-2015-5345 CVE-2015-5346 CVE-2015-5351 CVE-2016-0706 CVE-2016-0714 CVE-2016-0763 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for tomcat fixes the following issues: Tomcat 8 was updated from 8.0.23 to 8.0.32, to fix bugs and security issues. Fixed security issues: * CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (bsc#967967) * CVE-2015-5346: Session fixation vulnerability in Apache Tomcat when different session settings are used for deployments of multiple versions of the same web application, might have allowed remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java. (bsc#967814) * CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects before considering security constraints and Filters, which allowed remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (bsc#967965) * CVE-2015-5351: The (1) Manager and (2) Host Manager applications in Apache Tomcat established sessions and send CSRF tokens for arbitrary new requests, which allowed remote attackers to bypass a CSRF protection mechanism by using a token. (bsc#967812) * CVE-2016-0706: Apache Tomcat did not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allowed remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. (bsc#967815) * CVE-2016-0714: The session-persistence implementation in Apache Tomcat mishandled session attributes, which allowed remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. (bsc#967964) * CVE-2016-0763: The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat did not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allowed remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context. (bsc#967966) The full changes can be read on: http://tomcat.apache.org/tomcat-8.0-doc/changelog.html This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-384=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): tomcat-8.0.32-5.1 tomcat-admin-webapps-8.0.32-5.1 tomcat-docs-webapp-8.0.32-5.1 tomcat-el-3_0-api-8.0.32-5.1 tomcat-embed-8.0.32-5.1 tomcat-javadoc-8.0.32-5.1 tomcat-jsp-2_3-api-8.0.32-5.1 tomcat-jsvc-8.0.32-5.1 tomcat-lib-8.0.32-5.1 tomcat-servlet-3_1-api-8.0.32-5.1 tomcat-webapps-8.0.32-5.1 References: https://www.suse.com/security/cve/CVE-2015-5174.html https://www.suse.com/security/cve/CVE-2015-5345.html https://www.suse.com/security/cve/CVE-2015-5346.html https://www.suse.com/security/cve/CVE-2015-5351.html https://www.suse.com/security/cve/CVE-2016-0706.html https://www.suse.com/security/cve/CVE-2016-0714.html https://www.suse.com/security/cve/CVE-2016-0763.html https://bugzilla.suse.com/967812 https://bugzilla.suse.com/967814 https://bugzilla.suse.com/967815 https://bugzilla.suse.com/967964 https://bugzilla.suse.com/967965 https://bugzilla.suse.com/967966 https://bugzilla.suse.com/967967

1 0

openSUSE-RU-2016:0864-1: moderate: Recommended update for systemd-rpm-macros
by maintenance＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Recommended Update: Recommended update for systemd-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0864-1 Rating: moderate References: #955996 #956849 #968405 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This recommended update for systemd-rpm-macros fixes the following issues: - Add %tmpfiles_create macro (boo#956849) - Allow the packagers to specify the options -f and -n on the macros %service_del_preun(), %service_del_postun(), %systemd_post(), and %systemd_preun() (boo#968405) - Support of DISABLE_STOP_ON_REMOVAL and DISABLE_RESTART_ON_UPDATE from /etc/sysconfig/service (boo#955996) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-385=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): systemd-rpm-macros-2.1-3.1 References: https://bugzilla.suse.com/955996 https://bugzilla.suse.com/956849 https://bugzilla.suse.com/968405

1 0

openSUSE-SU-2016:0863-1: moderate: Security update for quagga
by opensuse-security＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0863-1 Rating: moderate References: #970952 Cross-References: CVE-2016-2342 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following security issue: - CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-383=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): quagga-0.99.23-2.3.1 quagga-debuginfo-0.99.23-2.3.1 quagga-debugsource-0.99.23-2.3.1 quagga-devel-0.99.23-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-2342.html https://bugzilla.suse.com/970952

1 0

openSUSE-SU-2016:0859-1: important: Security update for bind
by opensuse-security＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0859-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: Fix two assertion failures that can lead to a remote denial of service attack: * CVE-2016-1285: An error when parsing signature records for DNAME can lead to named exiting due to an assertion failure. (bsc#970072) * CVE-2016-1286: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. (bsc#970073) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-382=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.6P1-33.1 bind-chrootenv-9.9.6P1-33.1 bind-debuginfo-9.9.6P1-33.1 bind-debugsource-9.9.6P1-33.1 bind-devel-9.9.6P1-33.1 bind-libs-9.9.6P1-33.1 bind-libs-debuginfo-9.9.6P1-33.1 bind-lwresd-9.9.6P1-33.1 bind-lwresd-debuginfo-9.9.6P1-33.1 bind-utils-9.9.6P1-33.1 bind-utils-debuginfo-9.9.6P1-33.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.6P1-33.1 bind-libs-debuginfo-32bit-9.9.6P1-33.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.6P1-33.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073

1 0

openSUSE-RU-2016:0852-1: moderate: Recommended update for yast2-vm
by maintenance＠opensuse.org 22 Mar '16

22 Mar '16

openSUSE Recommended Update: Recommended update for yast2-vm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0852-1 Rating: moderate References: #905580 #907747 #941125 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This recommended update for yast2-vm fixes the following issues: - boo#941125 - yast2-vm: uses /etc/inittab - 3.1.21 - boo#907747 - yast-vm fails to find the pattern on sled - 3.1.20 - boo#905580 - SIGSEGV in yast2 relocation-server - 3.1.19 - boo#941125 - yast2-vm: uses /etc/inittab - 3.1.21 - boo#907747 - yast-vm fails to find the pattern on sled - 3.1.20 - boo#905580 - SIGSEGV in yast2 relocation-server - 3.1.19 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-378=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): yast2-vm-3.1.21-2.3.1 References: https://bugzilla.suse.com/905580 https://bugzilla.suse.com/907747 https://bugzilla.suse.com/941125

1 0

openSUSE-RU-2016:0851-1: moderate: Recommended update for spice
by maintenance＠opensuse.org 22 Mar '16

22 Mar '16

openSUSE Recommended Update: Recommended update for spice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0851-1 Rating: moderate References: #969059 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for spice fixes the following issues: - Fix crash when starting up Xspice (boo#969059). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-379=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libspice-server-devel-0.12.4-4.9.1 libspice-server1-0.12.4-4.9.1 libspice-server1-debuginfo-0.12.4-4.9.1 spice-client-0.12.4-4.9.1 spice-client-debuginfo-0.12.4-4.9.1 spice-debugsource-0.12.4-4.9.1 References: https://bugzilla.suse.com/969059

1 0

openSUSE-RU-2016:0850-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0850-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - database refresh March 21st This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-377=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201603210002-65.1 References:

1 0

openSUSE-SU-2016:0845-1: moderate: Security update for shotwell
by opensuse-security＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Security Update: Security update for shotwell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0845-1 Rating: moderate References: #958382 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Shotwell was updated to fix the following issues: * boo#958382: Shotwell did not perform TLS certificate verification when publishing photos to external services Also contains all upstream bug fixes and improvements in the current upstream version. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch 4816=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): shotwell-0.22.0+git.20160103-8.1 shotwell-debuginfo-0.22.0+git.20160103-8.1 shotwell-debugsource-0.22.0+git.20160103-8.1 - openSUSE 13.2 (noarch): shotwell-lang-0.22.0+git.20160103-8.1 References: https://bugzilla.suse.com/958382

1 0