March 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2016:0927-1: Optional update for dstat
by maintenance＠opensuse.org 31 Mar '16

31 Mar '16

openSUSE Optional Update: Optional update for dstat ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:0927-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update brings dstat, a versatile resource statistics tool, to the SLE12 backports project. See http://dag.wiee.rs/home-made/dstat/ for more information. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-417=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): dstat-0.7.3-2.1 References:

1 0

openSUSE-SU-2016:0922-1: moderate: Security update for libqt4
by opensuse-security＠opensuse.org 31 Mar '16

31 Mar '16

openSUSE Security Update: Security update for libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0922-1 Rating: moderate References: #865241 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libqt4 fixes the following issues: Various unsafe SSL ciphers have been disabled in the standard SSL classes. Also the RC4 based ciphers have been disabled. (bsc#865241) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-416=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libqt4-4.8.6-7.1 libqt4-debuginfo-4.8.6-7.1 libqt4-debugsource-4.8.6-7.1 libqt4-devel-4.8.6-7.1 libqt4-devel-debuginfo-4.8.6-7.1 libqt4-devel-doc-4.8.6-7.2 libqt4-devel-doc-debuginfo-4.8.6-7.2 libqt4-devel-doc-debugsource-4.8.6-7.2 libqt4-linguist-4.8.6-7.1 libqt4-linguist-debuginfo-4.8.6-7.1 libqt4-private-headers-devel-4.8.6-7.1 libqt4-qt3support-4.8.6-7.1 libqt4-qt3support-debuginfo-4.8.6-7.1 libqt4-sql-4.8.6-7.1 libqt4-sql-debuginfo-4.8.6-7.1 libqt4-sql-mysql-4.8.6-7.1 libqt4-sql-mysql-debuginfo-4.8.6-7.1 libqt4-sql-plugins-debugsource-4.8.6-7.1 libqt4-sql-postgresql-4.8.6-7.1 libqt4-sql-postgresql-debuginfo-4.8.6-7.1 libqt4-sql-sqlite-4.8.6-7.1 libqt4-sql-sqlite-debuginfo-4.8.6-7.1 libqt4-sql-unixODBC-4.8.6-7.1 libqt4-sql-unixODBC-debuginfo-4.8.6-7.1 libqt4-x11-4.8.6-7.1 libqt4-x11-debuginfo-4.8.6-7.1 qt4-x11-tools-4.8.6-7.2 qt4-x11-tools-debuginfo-4.8.6-7.2 - openSUSE Leap 42.1 (noarch): libqt4-devel-doc-data-4.8.6-7.2 - openSUSE Leap 42.1 (x86_64): libqt4-32bit-4.8.6-7.1 libqt4-debuginfo-32bit-4.8.6-7.1 libqt4-qt3support-32bit-4.8.6-7.1 libqt4-qt3support-debuginfo-32bit-4.8.6-7.1 libqt4-sql-32bit-4.8.6-7.1 libqt4-sql-debuginfo-32bit-4.8.6-7.1 libqt4-sql-mysql-32bit-4.8.6-7.1 libqt4-sql-mysql-debuginfo-32bit-4.8.6-7.1 libqt4-sql-postgresql-32bit-4.8.6-7.1 libqt4-sql-postgresql-debuginfo-32bit-4.8.6-7.1 libqt4-sql-sqlite-32bit-4.8.6-7.1 libqt4-sql-sqlite-debuginfo-32bit-4.8.6-7.1 libqt4-sql-unixODBC-32bit-4.8.6-7.1 libqt4-sql-unixODBC-debuginfo-32bit-4.8.6-7.1 libqt4-x11-32bit-4.8.6-7.1 libqt4-x11-debuginfo-32bit-4.8.6-7.1 References: https://bugzilla.suse.com/865241

1 0

openSUSE-RU-2016:0921-1: moderate: Recommended update for yast2-installation
by maintenance＠opensuse.org 31 Mar '16

31 Mar '16

openSUSE Recommended Update: Recommended update for yast2-installation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0921-1 Rating: moderate References: #910728 #935965 #956325 #960703 #966874 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for yast2-installation provides the following fixes: - Ensure plymouth does not interfere with X11 when executing yast2-firstboot. (bsc#966874) - Ensure second stage and YaST-Firstboot don't get killed by getty when running over 2nd or 3rd serial console. (bsc#935965) - Save the software selection for using it later in AutoYaST when deploying installation images. (bsc#956325, bsc#910728) - Move network service setup to yast2-network. (bsc#960703) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-415=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): yast2-installation-3.1.162.5-6.1 yast2-installation-devel-doc-3.1.162.5-6.1 References: https://bugzilla.suse.com/910728 https://bugzilla.suse.com/935965 https://bugzilla.suse.com/956325 https://bugzilla.suse.com/960703 https://bugzilla.suse.com/966874

1 0

openSUSE-RU-2016:0920-1: Recommended update for clamav-database
by maintenance＠opensuse.org 30 Mar '16

30 Mar '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0920-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh March 28th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-414=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201603280002-68.1 References:

1 0

openSUSE-SU-2016:0915-1: moderate: Security update for webkitgtk
by opensuse-security＠opensuse.org 30 Mar '16

30 Mar '16

openSUSE Security Update: Security update for webkitgtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0915-1 Rating: moderate References: #971460 Cross-References: CVE-2014-1748 CVE-2015-1071 CVE-2015-1076 CVE-2015-1081 CVE-2015-1083 CVE-2015-1120 CVE-2015-1122 CVE-2015-1127 CVE-2015-1153 CVE-2015-1155 CVE-2015-3658 CVE-2015-3659 CVE-2015-3727 CVE-2015-3731 CVE-2015-3741 CVE-2015-3743 CVE-2015-3745 CVE-2015-3747 CVE-2015-3748 CVE-2015-3749 CVE-2015-3752 CVE-2015-5788 CVE-2015-5794 CVE-2015-5801 CVE-2015-5809 CVE-2015-5822 CVE-2015-5928 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for webkitgtk fixes the following issues: - webkitgtk was updated to version 2.4.10 (boo#971460): + Fix rendering of form controls and scrollbars with GTK+ >= 3.19. + Fix crashes on PPC64. + Fix the build on powerpc 32 bits. + Add ARM64 build support. + Security fixes: CVE-2015-1120, CVE-2015-1076, CVE-2015-1071, CVE-2015-1081, CVE-2015-1122, CVE-2015-1155, CVE-2014-1748, CVE-2015-3752, CVE-2015-5809, CVE-2015-5928, CVE-2015-3749, CVE-2015-3659, CVE-2015-3748, CVE-2015-3743, CVE-2015-3731, CVE-2015-3745, CVE-2015-5822, CVE-2015-3658, CVE-2015-3741, CVE-2015-3727, CVE-2015-5801, CVE-2015-5788, CVE-2015-3747, CVE-2015-5794, CVE-2015-1127, CVE-2015-1153, CVE-2015-1083. + Updated translations. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-412=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-412=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libjavascriptcoregtk-1_0-0-2.4.10-7.2 libjavascriptcoregtk-1_0-0-debuginfo-2.4.10-7.2 libjavascriptcoregtk-3_0-0-2.4.10-7.2 libjavascriptcoregtk-3_0-0-debuginfo-2.4.10-7.2 libwebkitgtk-1_0-0-2.4.10-7.2 libwebkitgtk-1_0-0-debuginfo-2.4.10-7.2 libwebkitgtk-3_0-0-2.4.10-7.2 libwebkitgtk-3_0-0-debuginfo-2.4.10-7.2 libwebkitgtk-devel-2.4.10-7.2 libwebkitgtk3-devel-2.4.10-7.2 typelib-1_0-JavaScriptCore-1_0-2.4.10-7.2 typelib-1_0-JavaScriptCore-3_0-2.4.10-7.2 typelib-1_0-WebKit-1_0-2.4.10-7.2 typelib-1_0-WebKit-3_0-2.4.10-7.2 webkit-jsc-1-2.4.10-7.2 webkit-jsc-1-debuginfo-2.4.10-7.2 webkit-jsc-3-2.4.10-7.2 webkit-jsc-3-debuginfo-2.4.10-7.2 - openSUSE Leap 42.1 (noarch): libwebkitgtk2-lang-2.4.10-7.2 libwebkitgtk3-lang-2.4.10-7.2 - openSUSE Leap 42.1 (x86_64): libjavascriptcoregtk-1_0-0-32bit-2.4.10-7.2 libjavascriptcoregtk-1_0-0-debuginfo-32bit-2.4.10-7.2 libjavascriptcoregtk-3_0-0-32bit-2.4.10-7.2 libjavascriptcoregtk-3_0-0-debuginfo-32bit-2.4.10-7.2 libwebkitgtk-1_0-0-32bit-2.4.10-7.2 libwebkitgtk-1_0-0-debuginfo-32bit-2.4.10-7.2 libwebkitgtk-3_0-0-32bit-2.4.10-7.2 libwebkitgtk-3_0-0-debuginfo-32bit-2.4.10-7.2 - openSUSE 13.2 (i586 x86_64): libjavascriptcoregtk-1_0-0-2.4.10-13.2 libjavascriptcoregtk-1_0-0-debuginfo-2.4.10-13.2 libjavascriptcoregtk-3_0-0-2.4.10-13.2 libjavascriptcoregtk-3_0-0-debuginfo-2.4.10-13.2 libwebkitgtk-1_0-0-2.4.10-13.2 libwebkitgtk-1_0-0-debuginfo-2.4.10-13.2 libwebkitgtk-3_0-0-2.4.10-13.2 libwebkitgtk-3_0-0-debuginfo-2.4.10-13.2 libwebkitgtk-devel-2.4.10-13.2 libwebkitgtk3-devel-2.4.10-13.2 typelib-1_0-JavaScriptCore-1_0-2.4.10-13.2 typelib-1_0-JavaScriptCore-3_0-2.4.10-13.2 typelib-1_0-WebKit-1_0-2.4.10-13.2 typelib-1_0-WebKit-3_0-2.4.10-13.2 webkit-jsc-1-2.4.10-13.2 webkit-jsc-1-debuginfo-2.4.10-13.2 webkit-jsc-3-2.4.10-13.2 webkit-jsc-3-debuginfo-2.4.10-13.2 - openSUSE 13.2 (x86_64): libjavascriptcoregtk-1_0-0-32bit-2.4.10-13.2 libjavascriptcoregtk-1_0-0-debuginfo-32bit-2.4.10-13.2 libjavascriptcoregtk-3_0-0-32bit-2.4.10-13.2 libjavascriptcoregtk-3_0-0-debuginfo-32bit-2.4.10-13.2 libwebkitgtk-1_0-0-32bit-2.4.10-13.2 libwebkitgtk-1_0-0-debuginfo-32bit-2.4.10-13.2 libwebkitgtk-3_0-0-32bit-2.4.10-13.2 libwebkitgtk-3_0-0-debuginfo-32bit-2.4.10-13.2 - openSUSE 13.2 (noarch): libwebkitgtk2-lang-2.4.10-13.2 libwebkitgtk3-lang-2.4.10-13.2 References: https://www.suse.com/security/cve/CVE-2014-1748.html https://www.suse.com/security/cve/CVE-2015-1071.html https://www.suse.com/security/cve/CVE-2015-1076.html https://www.suse.com/security/cve/CVE-2015-1081.html https://www.suse.com/security/cve/CVE-2015-1083.html https://www.suse.com/security/cve/CVE-2015-1120.html https://www.suse.com/security/cve/CVE-2015-1122.html https://www.suse.com/security/cve/CVE-2015-1127.html https://www.suse.com/security/cve/CVE-2015-1153.html https://www.suse.com/security/cve/CVE-2015-1155.html https://www.suse.com/security/cve/CVE-2015-3658.html https://www.suse.com/security/cve/CVE-2015-3659.html https://www.suse.com/security/cve/CVE-2015-3727.html https://www.suse.com/security/cve/CVE-2015-3731.html https://www.suse.com/security/cve/CVE-2015-3741.html https://www.suse.com/security/cve/CVE-2015-3743.html https://www.suse.com/security/cve/CVE-2015-3745.html https://www.suse.com/security/cve/CVE-2015-3747.html https://www.suse.com/security/cve/CVE-2015-3748.html https://www.suse.com/security/cve/CVE-2015-3749.html https://www.suse.com/security/cve/CVE-2015-3752.html https://www.suse.com/security/cve/CVE-2015-5788.html https://www.suse.com/security/cve/CVE-2015-5794.html https://www.suse.com/security/cve/CVE-2015-5801.html https://www.suse.com/security/cve/CVE-2015-5809.html https://www.suse.com/security/cve/CVE-2015-5822.html https://www.suse.com/security/cve/CVE-2015-5928.html https://bugzilla.suse.com/971460

1 0

openSUSE-SU-2016:0914-1: important: Security update for xen
by opensuse-security＠opensuse.org 30 Mar '16

30 Mar '16

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0914-1 Rating: important References: #864391 #864655 #864769 #864805 #877642 #901508 #902737 #924018 #928393 #945404 #945989 #954872 #956829 #957162 #957698 #959332 #959695 #960334 #960707 #960725 #960835 #960861 #961332 #961358 #961691 #963782 #963923 #964413 #967012 #967013 #967969 Cross-References: CVE-2013-4533 CVE-2013-4537 CVE-2013-4538 CVE-2013-4539 CVE-2014-0222 CVE-2014-3689 CVE-2014-7815 CVE-2014-9718 CVE-2015-1779 CVE-2015-5278 CVE-2015-6855 CVE-2015-7512 CVE-2015-8345 CVE-2015-8613 CVE-2015-8619 CVE-2015-8743 CVE-2015-8744 CVE-2015-8745 CVE-2016-1568 CVE-2016-1570 CVE-2016-1714 CVE-2016-1981 CVE-2016-2198 CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 26 vulnerabilities and has 5 fixes is now available. Description: xen was updated to fix 26 security issues. These security issues were fixed: - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655). - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391). - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769). - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805). - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642). - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508). - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737). - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393). - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018). - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989). - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404). - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162). - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829). - CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358). - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334). - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725). - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835). - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707). - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332). - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861). - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691). - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782). - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413). - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013). - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012). - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969). These non-security issues were fixed: - bsc#954872: script block-dmmd not working as expected - bsc#957698: DOM0 can't bring up on Dell PC - bsc#963923: domain weights not honored when sched-credit tslice is reduced - bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated - bsc#959695: Missing docs for xen Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-413=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xen-debugsource-4.5.2_06-12.1 xen-devel-4.5.2_06-12.1 xen-libs-4.5.2_06-12.1 xen-libs-debuginfo-4.5.2_06-12.1 xen-tools-domU-4.5.2_06-12.1 xen-tools-domU-debuginfo-4.5.2_06-12.1 - openSUSE Leap 42.1 (x86_64): xen-4.5.2_06-12.1 xen-doc-html-4.5.2_06-12.1 xen-kmp-default-4.5.2_06_k4.1.15_8-12.1 xen-kmp-default-debuginfo-4.5.2_06_k4.1.15_8-12.1 xen-libs-32bit-4.5.2_06-12.1 xen-libs-debuginfo-32bit-4.5.2_06-12.1 xen-tools-4.5.2_06-12.1 xen-tools-debuginfo-4.5.2_06-12.1 References: https://www.suse.com/security/cve/CVE-2013-4533.html https://www.suse.com/security/cve/CVE-2013-4537.html https://www.suse.com/security/cve/CVE-2013-4538.html https://www.suse.com/security/cve/CVE-2013-4539.html https://www.suse.com/security/cve/CVE-2014-0222.html https://www.suse.com/security/cve/CVE-2014-3689.html https://www.suse.com/security/cve/CVE-2014-7815.html https://www.suse.com/security/cve/CVE-2014-9718.html https://www.suse.com/security/cve/CVE-2015-1779.html https://www.suse.com/security/cve/CVE-2015-5278.html https://www.suse.com/security/cve/CVE-2015-6855.html https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://www.suse.com/security/cve/CVE-2015-8613.html https://www.suse.com/security/cve/CVE-2015-8619.html https://www.suse.com/security/cve/CVE-2015-8743.html https://www.suse.com/security/cve/CVE-2015-8744.html https://www.suse.com/security/cve/CVE-2015-8745.html https://www.suse.com/security/cve/CVE-2016-1568.html https://www.suse.com/security/cve/CVE-2016-1570.html https://www.suse.com/security/cve/CVE-2016-1714.html https://www.suse.com/security/cve/CVE-2016-1981.html https://www.suse.com/security/cve/CVE-2016-2198.html https://www.suse.com/security/cve/CVE-2016-2391.html https://www.suse.com/security/cve/CVE-2016-2392.html https://www.suse.com/security/cve/CVE-2016-2538.html https://bugzilla.suse.com/864391 https://bugzilla.suse.com/864655 https://bugzilla.suse.com/864769 https://bugzilla.suse.com/864805 https://bugzilla.suse.com/877642 https://bugzilla.suse.com/901508 https://bugzilla.suse.com/902737 https://bugzilla.suse.com/924018 https://bugzilla.suse.com/928393 https://bugzilla.suse.com/945404 https://bugzilla.suse.com/945989 https://bugzilla.suse.com/954872 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 https://bugzilla.suse.com/957698 https://bugzilla.suse.com/959332 https://bugzilla.suse.com/959695 https://bugzilla.suse.com/960334 https://bugzilla.suse.com/960707 https://bugzilla.suse.com/960725 https://bugzilla.suse.com/960835 https://bugzilla.suse.com/960861 https://bugzilla.suse.com/961332 https://bugzilla.suse.com/961358 https://bugzilla.suse.com/961691 https://bugzilla.suse.com/963782 https://bugzilla.suse.com/963923 https://bugzilla.suse.com/964413 https://bugzilla.suse.com/967012 https://bugzilla.suse.com/967013 https://bugzilla.suse.com/967969

1 0

openSUSE-RU-2016:0904-1: moderate: Recommended update for monit
by maintenance＠opensuse.org 29 Mar '16

29 Mar '16

openSUSE Recommended Update: Recommended update for monit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0904-1 Rating: moderate References: #971647 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for monit fixes the following issues: - fixed pid file directory (boo#971647) - set pid file directory in /etc/monitrc - removed /run from file list Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-411=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): monit-5.10-5.1 monit-debuginfo-5.10-5.1 monit-debugsource-5.10-5.1 - openSUSE Leap 42.1 (noarch): monit-doc-5.10-5.1 References: https://bugzilla.suse.com/971647

1 0

openSUSE-RU-2016:0903-1: moderate: Recommended update for clamav
by maintenance＠opensuse.org 29 Mar '16

29 Mar '16

openSUSE Recommended Update: Recommended update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0903-1 Rating: moderate References: #958451 #969814 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update provides version 0.99.1 for clamav: - Update to version 0.99.1 (boo#969814) * Add support for parsing Hancom Office files including extracting and scanning embedded objects. * Several bug fixes. For details, see http://blog.clamav.net/2016/03/clamav-0991-has-been-released.html /usr/share/doc/packages/clamav/ChangeLog - boo#958451: Remove updateclamconf, because it breaks configurations that have multiple occurances of the same keyword. Henceforth the configuration files have to be merged maually, if a ClamAV update adds or removs options. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-409=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): clamav-0.99.1-2.25.1 clamav-debuginfo-0.99.1-2.25.1 clamav-debugsource-0.99.1-2.25.1 References: https://bugzilla.suse.com/958451 https://bugzilla.suse.com/969814

1 0

openSUSE-RU-2016:0902-1: moderate: Recommended update for libical
by maintenance＠opensuse.org 29 Mar '16

29 Mar '16

openSUSE Recommended Update: Recommended update for libical ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0902-1 Rating: moderate References: #954161 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update provides version 1.0.1 for libical: - Update to 1.0.1 (boo#954161). + Bug fixes: - issue74: Do not escape double quote character - issue80,issue92: fix crashes using icaltimezone_load_builtin_timezone() recursively - Fix icalcomponent_foreach_recurrence() and large durations between recurrences (e.g. FREQ=YEARLY) - Properly handle UTCOFFSETs of the form +/-00mmss - Properly skip bogus dates (e.g. 2/30, 4/31) in RRULE:FREQ=MONTHLY - Properly handle RRULE:FREQ=MONTHLY;BYDAY;BYMONTHDAY when DTSTART isn't on BYDAY - Fix RRULE:FREQ=YEARLY;BYDAY;BYWEEKNO - MUST use ISO weeks - Properly skip bogus dates (e.g. 2/29) in RRULE:FREQ=YEARLY[;BYMONTH][;BYMONTHDAY] + Build fixes/features: - Autotools build system is removed - CMake version 2.8.9 (or higher) is required (was CMake version 2.4.0) - Add new -DSHARED_ONLY and -DSTATIC_ONLY CMake options - Remove -DSTATIC_LIBRARY CMake option - MSYS2 builds (fixed instructions) - Now can build api documentation with make docs + Update tzdata to version 2014g + Support added for schedule params: agent, status, force-send + Added a UID to the VFREEBUSY component + Allow dates > 2038 if sizeof(time_t) > 4 + Add properties from draft-ietf-tzdist-service + Add support for RRULE:FREQ=YEARLY;BYDAY;BYYEARDAY and fixed RRULE:FREQ=YEARLY;BYYEARDAY with negative days + More regression tests added, in particular for recurrence + Almost all compile warnings silenced + A bunch of Coverity Scan warnings silenced + Package cmake macros installed by package. - add reproducible-generator.patch from debian bug report to get reproducible builds (and predicatable API actually) - Add libical-leap-abi.patch -- use enum values used in prior LEAP package, for ABI compatibility (boo#954161). - Drop 941609-typo-fix_icaltime_days_in_year.patch: fixed upstream. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-410=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libical-debugsource-1.0.1-11.1 libical-devel-1.0.1-11.1 libical-devel-static-1.0.1-11.1 libical-doc-1.0.1-11.1 libical1-1.0.1-11.1 libical1-debuginfo-1.0.1-11.1 - openSUSE Leap 42.1 (x86_64): libical1-32bit-1.0.1-11.1 libical1-debuginfo-32bit-1.0.1-11.1 References: https://bugzilla.suse.com/954161

1 0

openSUSE-RU-2016:0900-1: moderate: Recommended update for enlightenment
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: Recommended update for enlightenment ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0900-1 Rating: moderate References: #920792 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for enlightenment fixes the following issues: - The QT PLATFORM THEME did not get set correctly for enlightenment so use a environment variable to force it. (boo#920792) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-406=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): enlightenment-0.19.12-3.1 enlightenment-branding-upstream-0.19.12-3.1 enlightenment-debuginfo-0.19.12-3.1 enlightenment-debugsource-0.19.12-3.1 enlightenment-devel-0.19.12-3.1 enlightenment-doc-html-0.19.12-3.1 References: https://bugzilla.suse.com/920792

1 0

openSUSE-RU-2016:0899-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0899-1 Rating: moderate References: #957291 #963441 #966869 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sssd provides the following fixes: - Add new configuration option "ldap_use_tokengroups" to control whether the Token-Groups attribute will be used when performing initgroup for users from Active Directory Server 2008 and later. By default Token-Groups usage is disabled. (bsc#963441, bsc#966869) - Resolve issues with missing groups and group attributes from Active Directory. (bsc#957291) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-408=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libipa_hbac-devel-1.11.5.1-10.1 libipa_hbac0-1.11.5.1-10.1 libipa_hbac0-debuginfo-1.11.5.1-10.1 libsss_idmap-devel-1.11.5.1-10.1 libsss_idmap0-1.11.5.1-10.1 libsss_idmap0-debuginfo-1.11.5.1-10.1 libsss_nss_idmap-devel-1.11.5.1-10.1 libsss_nss_idmap0-1.11.5.1-10.1 libsss_nss_idmap0-debuginfo-1.11.5.1-10.1 libsss_sudo-1.11.5.1-10.1 libsss_sudo-debuginfo-1.11.5.1-10.1 python-ipa_hbac-1.11.5.1-10.1 python-ipa_hbac-debuginfo-1.11.5.1-10.1 python-sss_nss_idmap-1.11.5.1-10.1 python-sss_nss_idmap-debuginfo-1.11.5.1-10.1 python-sssd-config-1.11.5.1-10.1 python-sssd-config-debuginfo-1.11.5.1-10.1 sssd-1.11.5.1-10.1 sssd-ad-1.11.5.1-10.1 sssd-ad-debuginfo-1.11.5.1-10.1 sssd-debuginfo-1.11.5.1-10.1 sssd-debugsource-1.11.5.1-10.1 sssd-ipa-1.11.5.1-10.1 sssd-ipa-debuginfo-1.11.5.1-10.1 sssd-krb5-1.11.5.1-10.1 sssd-krb5-common-1.11.5.1-10.1 sssd-krb5-common-debuginfo-1.11.5.1-10.1 sssd-krb5-debuginfo-1.11.5.1-10.1 sssd-ldap-1.11.5.1-10.1 sssd-ldap-debuginfo-1.11.5.1-10.1 sssd-proxy-1.11.5.1-10.1 sssd-proxy-debuginfo-1.11.5.1-10.1 sssd-tools-1.11.5.1-10.1 sssd-tools-debuginfo-1.11.5.1-10.1 - openSUSE Leap 42.1 (x86_64): sssd-32bit-1.11.5.1-10.1 sssd-debuginfo-32bit-1.11.5.1-10.1 References: https://bugzilla.suse.com/957291 https://bugzilla.suse.com/963441 https://bugzilla.suse.com/966869

1 0

openSUSE-RU-2016:0898-1: ocfs2console fix starting failure
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: ocfs2console fix starting failure ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0898-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: ocfs2console fix starting failure Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-407=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ocfs2-tools-1.8.4-9.1 ocfs2-tools-debuginfo-1.8.4-9.1 ocfs2-tools-debugsource-1.8.4-9.1 ocfs2-tools-devel-1.8.4-9.1 ocfs2-tools-devel-static-1.8.4-9.1 ocfs2-tools-o2cb-1.8.4-9.1 ocfs2-tools-o2cb-debuginfo-1.8.4-9.1 ocfs2console-1.8.4-9.1 ocfs2console-debuginfo-1.8.4-9.1 References:

1 0

openSUSE-SU-2016:0897-1: moderate: Security update for gdk-pixbuf
by opensuse-security＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Security Update: Security update for gdk-pixbuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0897-1 Rating: moderate References: #948790 #948791 #958963 Cross-References: CVE-2015-7552 CVE-2015-7673 CVE-2015-7674 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for gdk-pixbuf fixes the following issues: - CVE-2015-7552: Fixed various overflows in image handling (boo#958963). - CVE-2015-7673: Fixed an overflow and DoS with a TGA file (boo#948790). - CVE-2015-7674: Fixed overflow when scaling a gif (boo#948791). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-405=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gdk-pixbuf-debugsource-2.31.6-6.1 gdk-pixbuf-devel-2.31.6-6.1 gdk-pixbuf-devel-debuginfo-2.31.6-6.1 gdk-pixbuf-query-loaders-2.31.6-6.1 gdk-pixbuf-query-loaders-debuginfo-2.31.6-6.1 libgdk_pixbuf-2_0-0-2.31.6-6.1 libgdk_pixbuf-2_0-0-debuginfo-2.31.6-6.1 typelib-1_0-GdkPixbuf-2_0-2.31.6-6.1 - openSUSE 13.2 (x86_64): gdk-pixbuf-devel-32bit-2.31.6-6.1 gdk-pixbuf-devel-debuginfo-32bit-2.31.6-6.1 gdk-pixbuf-query-loaders-32bit-2.31.6-6.1 gdk-pixbuf-query-loaders-debuginfo-32bit-2.31.6-6.1 libgdk_pixbuf-2_0-0-32bit-2.31.6-6.1 libgdk_pixbuf-2_0-0-debuginfo-32bit-2.31.6-6.1 - openSUSE 13.2 (noarch): gdk-pixbuf-lang-2.31.6-6.1 References: https://www.suse.com/security/cve/CVE-2015-7552.html https://www.suse.com/security/cve/CVE-2015-7673.html https://www.suse.com/security/cve/CVE-2015-7674.html https://bugzilla.suse.com/948790 https://bugzilla.suse.com/948791 https://bugzilla.suse.com/958963

1 0

openSUSE-FU-2016:0896-1: moderate: Add Mozilla Thunderbird to SLE 12 Backports
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Feature Update: Add Mozilla Thunderbird to SLE 12 Backports ______________________________________________________________________________ Announcement ID: openSUSE-FU-2016:0896-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update adds Mozilla Thunderbird 38.7.0 to the SLE 12 Backports project. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-404=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-38.7.0-2.1 MozillaThunderbird-buildsymbols-38.7.0-2.1 MozillaThunderbird-devel-38.7.0-2.1 MozillaThunderbird-translations-common-38.7.0-2.1 MozillaThunderbird-translations-other-38.7.0-2.1 References:

1 0

openSUSE-RU-2016:0895-1: Recommended update for timezone
by maintenance＠opensuse.org 26 Mar '16

26 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0895-1 Rating: low References: #971377 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016b) for your system, including the following changes: - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-403=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): timezone-2016b-46.1 timezone-debuginfo-2016b-46.1 timezone-debugsource-2016b-46.1 - openSUSE 13.1 (noarch): timezone-java-2016b-46.1 References: https://bugzilla.suse.com/971377

1 0

openSUSE-SU-2016:0894-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Mar '16

26 Mar '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0894-1 Rating: important References: #969894 Cross-References: CVE-2015-4477 CVE-2015-7207 CVE-2016-1952 CVE-2016-1954 CVE-2016-1957 CVE-2016-1958 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: MozillaThunderbird was updated to 38.7.0 to fix the following issues: * Update to Thunderbird 38.7.0 (boo#969894) * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-136/CVE-2015-7207 (bmo#1185256) Same-origin policy violation using performance.getEntries and history navigation * MFSA 2016-16/CVE-2016-1952 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-402=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-38.7.0-70.80.1 MozillaThunderbird-buildsymbols-38.7.0-70.80.1 MozillaThunderbird-debuginfo-38.7.0-70.80.1 MozillaThunderbird-debugsource-38.7.0-70.80.1 MozillaThunderbird-devel-38.7.0-70.80.1 MozillaThunderbird-translations-common-38.7.0-70.80.1 MozillaThunderbird-translations-other-38.7.0-70.80.1 References: https://www.suse.com/security/cve/CVE-2015-4477.html https://www.suse.com/security/cve/CVE-2015-7207.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894

1 0

openSUSE-RU-2016:0893-1: Recommended update for timezone
by maintenance＠opensuse.org 25 Mar '16

25 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0893-1 Rating: low References: #972433 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016c) for your system, including the following changes: - Azerbaijan no longer observes DST (Asia/Baku) - Chile reverts from permanent to seasonal DST This release also includes changes affecting past time stamps and documentation. For a comprehensive list, please refer to the release announcement from ICANN: http://mm.icann.org/pipermail/tz-announce/2016-March/000037.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 4886=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016c-0.11.1 timezone-debuginfo-2016c-0.11.1 timezone-debugsource-2016c-0.11.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016c-0.11.1 References: https://bugzilla.suse.com/972433

1 0

openSUSE-RU-2016:0892-1: Recommended update for timezone
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0892-1 Rating: low References: #971377 #972433 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides the latest timezone information (2016c) for your system, including the following changes: - Azerbaijan no longer observes DST. - Chile reverts from permanent to seasonal DST. - Correct past timestamps for Europe/Kaliningrad, Europe/Vilnius, Europe/Volgograd 1989-1991 - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-401=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2016c-38.1 timezone-debuginfo-2016c-38.1 timezone-debugsource-2016c-38.1 - openSUSE 13.2 (noarch): timezone-java-2016c-38.1 References: https://bugzilla.suse.com/971377 https://bugzilla.suse.com/972433

1 0

openSUSE-RU-2016:0891-1: Recommended update for timezone
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0891-1 Rating: low References: #971377 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016b) for your system, including the following changes: - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-400=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016b-0.8.1 timezone-debuginfo-2016b-0.8.1 timezone-debugsource-2016b-0.8.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016b-0.8.1 References: https://bugzilla.suse.com/971377

1 0

openSUSE-SU-2016:0888-1: moderate: Security update for quagga
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0888-1 Rating: moderate References: #970952 Cross-References: CVE-2016-2342 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following security issue: - CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-396=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quagga-0.99.24.1-5.1 quagga-debuginfo-0.99.24.1-5.1 quagga-debugsource-0.99.24.1-5.1 quagga-devel-0.99.24.1-5.1 References: https://www.suse.com/security/cve/CVE-2016-2342.html https://bugzilla.suse.com/970952

1 0

openSUSE-RU-2016:0887-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0887-1 Rating: moderate References: #955400 #960040 #963585 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for YaST fixes the following issues: - SuSEFirewall module reads system configuration during autoinstallation. It behaves in the same way as regular installation or normal operation. (bsc#963585) - AutoYaST settings for SuSEFirewall are now merged with the existing configuration instead of being fully overwritten. - Put valid hostname into AutoYaST profile generated at the end of installation. (bsc#960040) - Add a default value for firewall setting FW_BOOT_INIT_FULL. (bsc#955400) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-398=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): yast2-3.1.155.3-3.1 yast2-devel-doc-3.1.155.3-3.1 References: https://bugzilla.suse.com/955400 https://bugzilla.suse.com/960040 https://bugzilla.suse.com/963585

1 0

openSUSE-RU-2016:0886-1: moderate: Recommended update for os-prober
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for os-prober ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0886-1 Rating: moderate References: #892364 #931955 #953987 #954225 #957018 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for os-prober fixes the following issues: Various patches were merged from openSUSE Factory: - fix os-prober fails to detect other SLES12 installation (boo#892364) - fix os-prober mount error, no such file or directory (boo#931955) - also skip legacy grub if /boot/grub2/grub.cfg is present - fix detect os on default subvolume in snapshot (boo#954225) - fix os-prober update broke Linux detection (boo#957018) - fix y2base runs at 100% cpu busy from beginning in installation of files to completion (boo#953987) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-391=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): os-prober-1.61-12.4.1 os-prober-debuginfo-1.61-12.4.1 os-prober-debugsource-1.61-12.4.1 References: https://bugzilla.suse.com/892364 https://bugzilla.suse.com/931955 https://bugzilla.suse.com/953987 https://bugzilla.suse.com/954225 https://bugzilla.suse.com/957018

1 0

openSUSE-RU-2016:0885-1: moderate: Recommended update for mgetty
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for mgetty ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0885-1 Rating: moderate References: #968571 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mgetty fixes the following issues: - Use correct permissions for unit files (boo#968571) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-390=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-390=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): g3utils-1.1.36-62.1 g3utils-debuginfo-1.1.36-62.1 mgetty-1.1.36-62.1 mgetty-debuginfo-1.1.36-62.1 mgetty-debugsource-1.1.36-62.1 sendfax-1.1.36-62.1 sendfax-debuginfo-1.1.36-62.1 - openSUSE 13.2 (i586 x86_64): g3utils-1.1.36-55.7.1 g3utils-debuginfo-1.1.36-55.7.1 mgetty-1.1.36-55.7.1 mgetty-debuginfo-1.1.36-55.7.1 mgetty-debugsource-1.1.36-55.7.1 sendfax-1.1.36-55.7.1 sendfax-debuginfo-1.1.36-55.7.1 References: https://bugzilla.suse.com/968571

1 0

openSUSE-SU-2016:0882-1: moderate: Security update for dropbear
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0882-1 Rating: moderate References: #970633 Cross-References: CVE-2016-3116 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: dropbear was updated to 2016.72 to fix the following issues: Changes in dropbear: - updated to upstream version 2016.72 * Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug fix release for boo#970633 - CVE-2016-3116 - updated to upstream version 2015.71 * Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 * Fix crash on exit when -p address:port is used, broke in 2015.68 * Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev * Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert, broke in 2015.70 * Fix server race condition that could cause sessions to hang on exit, https://github.com/robotframework/SSHLibrary/issues/128 - updated to upstream version 2015.70 * Fix server password authentication on Linux, broke in 2015.69 * Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68) * Avoid hang on session close when multiple sessions are started, affects Qt Creator Patch from Andrzej Szombierski * Reduce per-channel memory consumption in common case, increase default channel limit from 100 to 1000 which should improve SOCKS forwarding for modern webpages * Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin * Manpage improvements from Guilhem Moulin * Build fixes for Android from Mike Frysinger * Don't display the MOTD when an explicit command is run from Guilhem Moulin * Check curve25519 shared secret isn't zero - updated to upstream version 2015.68 * Reduce local data copying for improved efficiency. Measured 30% increase in throughput for connections to localhost * Forwarded TCP ports connect asynchronously and try all available addresses (IPv4, IPv6, round robin DNS) * Fix all compile warnings, many patches from Gaël Portay Note that configure with -Werror may not be successful on some platforms (OS X) and some configuration options may still result in unused variable warnings. * Use TCP Fast Open on Linux if available. Saves a round trip at connection to hosts that have previously been connected. Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" Client side is disabled by default pending further compatibility testing with networks and systems. * Increase maximum command length to 9000 bytes * Free memory before exiting, patch from Thorsten Horstmann. Useful for Dropbear ports to embedded systems and for checking memory leaks with valgrind. Only partially implemented for dbclient. This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h * DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless there is a leading slash (~ isn't treated specially) * Fix small ECC memory leaks * Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of Matta Consulting. Odds of bad values are around 2**-512 -- improbable. * Twofish-ctr cipher is supported though disabled by default * Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks to CL Ouyang * Fix null pointer crash with restrictions in authorized_keys without a command, patch from Guilhem Moulin * Ensure authentication timeout is handled while reading the initial banner, thanks to CL Ouyang for finding it. * Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz - fixed checksum URL - updated to upstream version 2015.67 * Call fsync() after generating private keys to ensure they aren't lost if a reboot occurs. Thanks to Peter Korsgaard * Disable non-delayed zlib compression by default on the server. Can be enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB * Default client key path ~/.ssh/id_dropbear * Prefer stronger algorithms by default, from Fedor Brunner. AES256 over 3DES Diffie-hellman group14 over group1 * Add option to disable CBC ciphers. * Disable twofish in default options.h * Enable sha2 HMAC algorithms by default, the code was already required for ECC key exchange. sha1 is the first preference still for performance. * Fix installing dropbear.8 in a separate build directory, from Like Ma * Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe * Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea * Minor bug fixes, a few issues found by Coverity scan - replaced deprecated gpg-offline check by obs-service-source_validator - updated to upstream version 2014.66 * Use the same keepalive handling behaviour as OpenSSH. This will work better with some SSH implementations that have different behaviour with unknown message types. * Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own keepalive message * Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere * Fix wtmp which broke since 2013.62, patch from Whoopie Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-387=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-387=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dropbear-2016.72-8.1 dropbear-debuginfo-2016.72-8.1 dropbear-debugsource-2016.72-8.1 - openSUSE 13.2 (i586 x86_64): dropbear-2016.72-2.3.1 dropbear-debuginfo-2016.72-2.3.1 dropbear-debugsource-2016.72-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-3116.html https://bugzilla.suse.com/970633

1 0

openSUSE-SU-2016:0881-1: moderate: Security update for perl
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0881-1 Rating: moderate References: #928292 #961528 #967082 Cross-References: CVE-2015-8607 CVE-2016-2381 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for perl fixes the following issues: - CVE-2016-2381: Fixed environment duplicated variable handling bug [boo#967082] - fix memory leak in 'use utf8' handling [boo#928292] - CVE-2015-8607: Fixed taint propagation in canonpath [boo#961528] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-386=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): perl-5.20.1-3.1 perl-base-5.20.1-3.1 perl-base-debuginfo-5.20.1-3.1 perl-debuginfo-5.20.1-3.1 perl-debugsource-5.20.1-3.1 - openSUSE 13.2 (x86_64): perl-32bit-5.20.1-3.1 perl-base-32bit-5.20.1-3.1 perl-base-debuginfo-32bit-5.20.1-3.1 perl-debuginfo-32bit-5.20.1-3.1 - openSUSE 13.2 (noarch): perl-doc-5.20.1-3.1 References: https://www.suse.com/security/cve/CVE-2015-8607.html https://www.suse.com/security/cve/CVE-2016-2381.html https://bugzilla.suse.com/928292 https://bugzilla.suse.com/961528 https://bugzilla.suse.com/967082

1 0

openSUSE-SU-2016:0880-1: moderate: Security update for libssh
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0880-1 Rating: moderate References: #965875 Cross-References: CVE-2016-0739 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2016-0739: Fix Weakness in diffie-hellman secret key generation. (bsc#965875) This fix was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-394=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libssh-debugsource-0.6.3-2.10.1 libssh-devel-0.6.3-2.10.1 libssh-devel-doc-0.6.3-2.10.1 libssh4-0.6.3-2.10.1 libssh4-debuginfo-0.6.3-2.10.1 - openSUSE 13.2 (x86_64): libssh4-32bit-0.6.3-2.10.1 libssh4-debuginfo-32bit-0.6.3-2.10.1 References: https://www.suse.com/security/cve/CVE-2016-0739.html https://bugzilla.suse.com/965875

1 0

openSUSE-RU-2016:0879-1: Recommended update for libcap
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for libcap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0879-1 Rating: low References: #967838 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libcap adds two new capabilities (CAP_WAKE_ALARM and CAP_BLOCK_SUSPEND) which are available in Linux Kernel 3.12. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-392=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libcap-debugsource-2.22-16.1 libcap-devel-2.22-16.1 libcap-progs-2.22-16.1 libcap-progs-debuginfo-2.22-16.1 libcap2-2.22-16.1 libcap2-debuginfo-2.22-16.1 - openSUSE Leap 42.1 (x86_64): libcap2-32bit-2.22-16.1 libcap2-debuginfo-32bit-2.22-16.1 References: https://bugzilla.suse.com/967838

1 0

openSUSE-SU-2016:0878-1: moderate: Security update for pidgin-otr
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for pidgin-otr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0878-1 Rating: moderate References: #970498 Cross-References: CVE-2015-8833 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to pidgin-otr 4.0.2 fixes the following issue: - CVE-2015-8833: use-after-free issue during SMP (boo#970498) It also contains new and updated translations. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-397=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-397=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): pidgin-otr-4.0.2-7.1 pidgin-otr-debuginfo-4.0.2-7.1 pidgin-otr-debugsource-4.0.2-7.1 - openSUSE 13.2 (i586 x86_64): pidgin-otr-4.0.2-7.8.1 pidgin-otr-debuginfo-4.0.2-7.8.1 pidgin-otr-debugsource-4.0.2-7.8.1 References: https://www.suse.com/security/cve/CVE-2015-8833.html https://bugzilla.suse.com/970498

1 0

openSUSE-SU-2016:0877-1: important: Security update for samba
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0877-1 Rating: important References: #953382 #953972 #960249 #962177 #964023 #966271 #968222 Cross-References: CVE-2015-7560 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for the samba server fixes the following issues: Security issue fixed: - CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); (bsc#968222). Other bugs fixed: - Enable clustering (CTDB) support; (bsc#966271). - s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023). - vfs_fruit: Fix renaming directories with open files; (bso#11065). - Fix MacOS finder error 36 when copying folder to Samba; (bso#11347). - s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). - Fix copying files with vfs_fruit when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). - s3:libsmb: Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). - Reduce the memory footprint of empty string options; (bso#11625). - lib/async_req: Do not install async_connect_send_test; (bso#11639). - docs: Fix typos in man vfs_gpfs; (bso#11641). - smbd: make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). - smbcacls: Fix uninitialized variable; (bso#11682). - s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). - Add quotes around path of update-apparmor-samba-profile; (bsc#962177). - Prevent access denied if the share path is "/"; (bso#11647); (bsc#960249). - Ensure samlogon fallback requests are rerouted after kerberos failure; (bsc#953972). - samba: winbind crash -> netlogon_creds_client_authenticator; (bsc#953972) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-399=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ctdb-4.2.4-12.1 ctdb-debuginfo-4.2.4-12.1 ctdb-devel-4.2.4-12.1 ctdb-tests-4.2.4-12.1 ctdb-tests-debuginfo-4.2.4-12.1 libdcerpc-atsvc-devel-4.2.4-12.1 libdcerpc-atsvc0-4.2.4-12.1 libdcerpc-atsvc0-debuginfo-4.2.4-12.1 libdcerpc-binding0-4.2.4-12.1 libdcerpc-binding0-debuginfo-4.2.4-12.1 libdcerpc-devel-4.2.4-12.1 libdcerpc-samr-devel-4.2.4-12.1 libdcerpc-samr0-4.2.4-12.1 libdcerpc-samr0-debuginfo-4.2.4-12.1 libdcerpc0-4.2.4-12.1 libdcerpc0-debuginfo-4.2.4-12.1 libgensec-devel-4.2.4-12.1 libgensec0-4.2.4-12.1 libgensec0-debuginfo-4.2.4-12.1 libndr-devel-4.2.4-12.1 libndr-krb5pac-devel-4.2.4-12.1 libndr-krb5pac0-4.2.4-12.1 libndr-krb5pac0-debuginfo-4.2.4-12.1 libndr-nbt-devel-4.2.4-12.1 libndr-nbt0-4.2.4-12.1 libndr-nbt0-debuginfo-4.2.4-12.1 libndr-standard-devel-4.2.4-12.1 libndr-standard0-4.2.4-12.1 libndr-standard0-debuginfo-4.2.4-12.1 libndr0-4.2.4-12.1 libndr0-debuginfo-4.2.4-12.1 libnetapi-devel-4.2.4-12.1 libnetapi0-4.2.4-12.1 libnetapi0-debuginfo-4.2.4-12.1 libregistry-devel-4.2.4-12.1 libregistry0-4.2.4-12.1 libregistry0-debuginfo-4.2.4-12.1 libsamba-credentials-devel-4.2.4-12.1 libsamba-credentials0-4.2.4-12.1 libsamba-credentials0-debuginfo-4.2.4-12.1 libsamba-hostconfig-devel-4.2.4-12.1 libsamba-hostconfig0-4.2.4-12.1 libsamba-hostconfig0-debuginfo-4.2.4-12.1 libsamba-passdb-devel-4.2.4-12.1 libsamba-passdb0-4.2.4-12.1 libsamba-passdb0-debuginfo-4.2.4-12.1 libsamba-policy-devel-4.2.4-12.1 libsamba-policy0-4.2.4-12.1 libsamba-policy0-debuginfo-4.2.4-12.1 libsamba-util-devel-4.2.4-12.1 libsamba-util0-4.2.4-12.1 libsamba-util0-debuginfo-4.2.4-12.1 libsamdb-devel-4.2.4-12.1 libsamdb0-4.2.4-12.1 libsamdb0-debuginfo-4.2.4-12.1 libsmbclient-devel-4.2.4-12.1 libsmbclient-raw-devel-4.2.4-12.1 libsmbclient-raw0-4.2.4-12.1 libsmbclient-raw0-debuginfo-4.2.4-12.1 libsmbclient0-4.2.4-12.1 libsmbclient0-debuginfo-4.2.4-12.1 libsmbconf-devel-4.2.4-12.1 libsmbconf0-4.2.4-12.1 libsmbconf0-debuginfo-4.2.4-12.1 libsmbldap-devel-4.2.4-12.1 libsmbldap0-4.2.4-12.1 libsmbldap0-debuginfo-4.2.4-12.1 libtevent-util-devel-4.2.4-12.1 libtevent-util0-4.2.4-12.1 libtevent-util0-debuginfo-4.2.4-12.1 libwbclient-devel-4.2.4-12.1 libwbclient0-4.2.4-12.1 libwbclient0-debuginfo-4.2.4-12.1 samba-4.2.4-12.1 samba-client-4.2.4-12.1 samba-client-debuginfo-4.2.4-12.1 samba-core-devel-4.2.4-12.1 samba-debuginfo-4.2.4-12.1 samba-debugsource-4.2.4-12.1 samba-libs-4.2.4-12.1 samba-libs-debuginfo-4.2.4-12.1 samba-pidl-4.2.4-12.1 samba-python-4.2.4-12.1 samba-python-debuginfo-4.2.4-12.1 samba-test-4.2.4-12.1 samba-test-debuginfo-4.2.4-12.1 samba-test-devel-4.2.4-12.1 samba-winbind-4.2.4-12.1 samba-winbind-debuginfo-4.2.4-12.1 - openSUSE Leap 42.1 (x86_64): libdcerpc-atsvc0-32bit-4.2.4-12.1 libdcerpc-atsvc0-debuginfo-32bit-4.2.4-12.1 libdcerpc-binding0-32bit-4.2.4-12.1 libdcerpc-binding0-debuginfo-32bit-4.2.4-12.1 libdcerpc-samr0-32bit-4.2.4-12.1 libdcerpc-samr0-debuginfo-32bit-4.2.4-12.1 libdcerpc0-32bit-4.2.4-12.1 libdcerpc0-debuginfo-32bit-4.2.4-12.1 libgensec0-32bit-4.2.4-12.1 libgensec0-debuginfo-32bit-4.2.4-12.1 libndr-krb5pac0-32bit-4.2.4-12.1 libndr-krb5pac0-debuginfo-32bit-4.2.4-12.1 libndr-nbt0-32bit-4.2.4-12.1 libndr-nbt0-debuginfo-32bit-4.2.4-12.1 libndr-standard0-32bit-4.2.4-12.1 libndr-standard0-debuginfo-32bit-4.2.4-12.1 libndr0-32bit-4.2.4-12.1 libndr0-debuginfo-32bit-4.2.4-12.1 libnetapi0-32bit-4.2.4-12.1 libnetapi0-debuginfo-32bit-4.2.4-12.1 libregistry0-32bit-4.2.4-12.1 libregistry0-debuginfo-32bit-4.2.4-12.1 libsamba-credentials0-32bit-4.2.4-12.1 libsamba-credentials0-debuginfo-32bit-4.2.4-12.1 libsamba-hostconfig0-32bit-4.2.4-12.1 libsamba-hostconfig0-debuginfo-32bit-4.2.4-12.1 libsamba-passdb0-32bit-4.2.4-12.1 libsamba-passdb0-debuginfo-32bit-4.2.4-12.1 libsamba-policy0-32bit-4.2.4-12.1 libsamba-policy0-debuginfo-32bit-4.2.4-12.1 libsamba-util0-32bit-4.2.4-12.1 libsamba-util0-debuginfo-32bit-4.2.4-12.1 libsamdb0-32bit-4.2.4-12.1 libsamdb0-debuginfo-32bit-4.2.4-12.1 libsmbclient-raw0-32bit-4.2.4-12.1 libsmbclient-raw0-debuginfo-32bit-4.2.4-12.1 libsmbclient0-32bit-4.2.4-12.1 libsmbclient0-debuginfo-32bit-4.2.4-12.1 libsmbconf0-32bit-4.2.4-12.1 libsmbconf0-debuginfo-32bit-4.2.4-12.1 libsmbldap0-32bit-4.2.4-12.1 libsmbldap0-debuginfo-32bit-4.2.4-12.1 libtevent-util0-32bit-4.2.4-12.1 libtevent-util0-debuginfo-32bit-4.2.4-12.1 libwbclient0-32bit-4.2.4-12.1 libwbclient0-debuginfo-32bit-4.2.4-12.1 samba-32bit-4.2.4-12.1 samba-client-32bit-4.2.4-12.1 samba-client-debuginfo-32bit-4.2.4-12.1 samba-debuginfo-32bit-4.2.4-12.1 samba-libs-32bit-4.2.4-12.1 samba-libs-debuginfo-32bit-4.2.4-12.1 samba-winbind-32bit-4.2.4-12.1 samba-winbind-debuginfo-32bit-4.2.4-12.1 - openSUSE Leap 42.1 (noarch): samba-doc-4.2.4-12.1 References: https://www.suse.com/security/cve/CVE-2015-7560.html https://bugzilla.suse.com/953382 https://bugzilla.suse.com/953972 https://bugzilla.suse.com/960249 https://bugzilla.suse.com/962177 https://bugzilla.suse.com/964023 https://bugzilla.suse.com/966271 https://bugzilla.suse.com/968222

1 0

openSUSE-SU-2016:0876-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0876-1 Rating: important References: #969894 Cross-References: CVE-2015-4477 CVE-2015-7207 CVE-2016-1952 CVE-2016-1954 CVE-2016-1957 CVE-2016-1958 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: MozillaThunderbird was updated to 38.7.0 to fix the following issues: * Update to Thunderbird 38.7.0 (boo#969894) * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-136/CVE-2015-7207 (bmo#1185256) Same-origin policy violation using performance.getEntries and history navigation * MFSA 2016-16/CVE-2016-1952 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-395=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-395=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-38.7.0-13.1 MozillaThunderbird-buildsymbols-38.7.0-13.1 MozillaThunderbird-debuginfo-38.7.0-13.1 MozillaThunderbird-debugsource-38.7.0-13.1 MozillaThunderbird-devel-38.7.0-13.1 MozillaThunderbird-translations-common-38.7.0-13.1 MozillaThunderbird-translations-other-38.7.0-13.1 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-38.7.0-40.2 MozillaThunderbird-buildsymbols-38.7.0-40.2 MozillaThunderbird-debuginfo-38.7.0-40.2 MozillaThunderbird-debugsource-38.7.0-40.2 MozillaThunderbird-devel-38.7.0-40.2 MozillaThunderbird-translations-common-38.7.0-40.2 MozillaThunderbird-translations-other-38.7.0-40.2 References: https://www.suse.com/security/cve/CVE-2015-4477.html https://www.suse.com/security/cve/CVE-2015-7207.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894

1 0

openSUSE-SU-2016:0875-1: important: Security update for graphite2
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for graphite2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0875-1 Rating: important References: #965803 #965807 #965810 Cross-References: CVE-2016-1521 CVE-2016-1523 CVE-2016-1526 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for graphite2 fixes the following issues: - CVE-2016-1521: The directrun function in directmachine.cpp in Libgraphite did not validate a certain skip operation, which allowed remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. - CVE-2016-1523: The SillMap::readFace function in FeatureMap.cpp in Libgraphite mishandled a return value, which allowed remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font. - CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite incorrectly validated a size value, which allowed remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. This update was imported from the SUSE:SLE-12:Update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-389=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): graphite2-1.3.1-3.1 graphite2-debuginfo-1.3.1-3.1 graphite2-debugsource-1.3.1-3.1 graphite2-devel-1.3.1-3.1 libgraphite2-3-1.3.1-3.1 libgraphite2-3-debuginfo-1.3.1-3.1 - openSUSE Leap 42.1 (x86_64): libgraphite2-3-32bit-1.3.1-3.1 libgraphite2-3-debuginfo-32bit-1.3.1-3.1 References: https://www.suse.com/security/cve/CVE-2016-1521.html https://www.suse.com/security/cve/CVE-2016-1523.html https://www.suse.com/security/cve/CVE-2016-1526.html https://bugzilla.suse.com/965803 https://bugzilla.suse.com/965807 https://bugzilla.suse.com/965810

1 0

openSUSE-SU-2016:0874-1: moderate: Security update for dropbear
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0874-1 Rating: moderate References: #970633 Cross-References: CVE-2016-3116 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dropbear fixes the following issues: - dropbear was updated to upstream version 2016.72 * Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug fix release for boo#970633 - CVE-2016-3116 - dropbear was updated to upstream version 2015.71 * Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 * Fix crash on exit when -p address:port is used, broke in 2015.68 * Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev * Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert, broke in 2015.70 * Fix server race condition that could cause sessions to hang on exit, https://github.com/robotframework/SSHLibrary/issues/128 - dropbear was updated to upstream version 2015.70 * Fix server password authentication on Linux, broke in 2015.69 * Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68) * Avoid hang on session close when multiple sessions are started, affects Qt Creator Patch from Andrzej Szombierski * Reduce per-channel memory consumption in common case, increase default channel limit from 100 to 1000 which should improve SOCKS forwarding for modern webpages * Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin * Manpage improvements from Guilhem Moulin * Build fixes for Android from Mike Frysinger * Don't display the MOTD when an explicit command is run from Guilhem Moulin * Check curve25519 shared secret isn't zero - dropbear was updated to upstream version 2015.68 * Reduce local data copying for improved efficiency. Measured 30% increase in throughput for connections to localhost * Forwarded TCP ports connect asynchronously and try all available addresses (IPv4, IPv6, round robin DNS) * Fix all compile warnings, many patches from Gaël Portay Note that configure with -Werror may not be successful on some platforms (OS X) and some configuration options may still result in unused variable warnings. * Use TCP Fast Open on Linux if available. Saves a round trip at connection to hosts that have previously been connected. Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" Client side is disabled by default pending further compatibility testing with networks and systems. * Increase maximum command length to 9000 bytes * Free memory before exiting, patch from Thorsten Horstmann. Useful for Dropbear ports to embedded systems and for checking memory leaks with valgrind. Only partially implemented for dbclient. This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h * DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless there is a leading slash (~ isn't treated specially) * Fix small ECC memory leaks * Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of Matta Consulting. Odds of bad values are around 2**-512 -- improbable. * Twofish-ctr cipher is supported though disabled by default * Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks to CL Ouyang * Fix null pointer crash with restrictions in authorized_keys without a command, patch from Guilhem Moulin * Ensure authentication timeout is handled while reading the initial banner, thanks to CL Ouyang for finding it. * Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz - dropbear was updated to upstream version 2015.67 * Call fsync() after generating private keys to ensure they aren't lost if a reboot occurs. Thanks to Peter Korsgaard * Disable non-delayed zlib compression by default on the server. Can be enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB * Default client key path ~/.ssh/id_dropbear * Prefer stronger algorithms by default, from Fedor Brunner. AES256 over 3DES Diffie-hellman group14 over group1 * Add option to disable CBC ciphers. * Disable twofish in default options.h * Enable sha2 HMAC algorithms by default, the code was already required for ECC key exchange. sha1 is the first preference still for performance. * Fix installing dropbear.8 in a separate build directory, from Like Ma * Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe * Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea * Minor bug fixes, a few issues found by Coverity scan - dropbear was updated to upstream version 2014.66 * Use the same keepalive handling behaviour as OpenSSH. This will work better with some SSH implementations that have different behaviour with unknown message types. * Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own keepalive message * Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere * Fix wtmp which broke since 2013.62, patch from Whoopie - dropbear was updated to upstream version 2014.65 * Fix 2014.64 regression, server session hang on exit with scp (and probably others), thanks to NiLuJe for tracking it down * Fix 2014.64 regression, clock_gettime() error handling which broke on older Linux kernels, reported by NiLuJe * Fix 2014.64 regression, writev() could occassionally fail with EAGAIN which wasn't caught * Avoid error message when trying to set QoS on proxycommand or multihop pipes * Use /usr/bin/xauth, thanks to Mike Frysinger * Don't exit the client if the local user entry can't be found, thanks to iquaba - added missing systemd entries for dropbear-keygen.service - dropbear was updated to upstream version 2014.64 * Fix compiling with ECDSA and DSS disabled * Don't exit abruptly if too many outgoing packets are queued for writev(). Patch thanks to Ronny Meeus * The -K keepalive option now behaves more like OpenSSH's "ServerAliveInterval". If no response is received after 3 keepalives then the session is terminated. This will close connections faster than waiting for a TCP timeout. * Rework TCP priority setting. New settings are if (connecting || ptys || x11) tos = LOWDELAY else if (tcp_forwards) tos = 0 else tos = BULK Thanks to Catalin Patulea for the suggestion. * Improve handling of many concurrent new TCP forwarded connections, should now be able to handle as many as MAX_CHANNELS. Thanks to Eduardo Silva for reporting and investigating it. * Make sure that exit messages from the client are printed, regression in 2013.57 * Use monotonic clock where available, timeouts won't be affected by system time changes * Add -V for version - dropbear was updated regular init script to also create ECDSA keys - update to upstream version 2014.63 * Fix ~. to terminate a client interactive session after waking a laptop from sleep. * Changed port separator syntax again, now using host^port. This is because IPv6 link-local addresses use %. Reported by Gui Iribarren * Avoid constantly relinking dropbearmulti target, fix "make install" for multi target, thanks to Mike Frysinger * Avoid getting stuck in a loop writing huge key files, reported by Bruno Thomsen * Don't link dropbearkey or dropbearconvert to libz or libutil, thanks to Nicolas Boos * Fix linking -lcrypt on systems without /usr/lib, thanks to Nicolas Boos * Avoid crash on exit due to cleaned up keys before last packets are sent, debugged by Ronald Wahl * Fix a race condition in rekeying where Dropbear would exit if it received a still-in-flight packet after initiating rekeying. Reported by Oliver Metz. This is a longstanding bug but is triggered more easily since 2013.57 * [...] - dropbear was updated service files and activated building of ecdsa keys - only package the old init service in distributions without systemd - imported upstream version 2013.62 * Disable "interactive" QoS connection options when a connection doesn't have a PTY (eg scp, rsync). Thanks to Catalin Patulea for the patch. * Log when a hostkey is generated with -R, fix some bugs in handling server hostkey commandline options * Fix crash in Dropbearconvert and 521 bit key, reported by NiLuJe * Update config.guess and config.sub again * ECC (elliptic curve) support. Supports ECDSA hostkeys (requires new keys to be generated) and ECDH for setting up encryption keys (no intervention required). This is significantly faster. * curve25519-sha256(a)libssh.org support for setting up encryption keys. This is another elliptic curve mode with less potential of NSA interference in algorithm parameters. curve25519-donna code thanks to Adam Langley * -R option to automatically generate hostkeys. This is recommended for embedded platforms since it allows the system random number device /dev/urandom a longer startup time to generate a secure seed before the hostkey is required. * Compile fixes for old vendor compilers like Tru64 from Daniel Richard G. * Make authorized_keys handling more robust, don't exit encountering malformed lines. Thanks to Lorin Hochstein and Mark Stillwell Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2016-393=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): dropbear-2016.72-2.7.1 dropbear-debuginfo-2016.72-2.7.1 dropbear-debugsource-2016.72-2.7.1 References: https://www.suse.com/security/cve/CVE-2016-3116.html https://bugzilla.suse.com/970633

1 0

openSUSE-SU-2016:0865-1: important: Security update for tomcat
by opensuse-security＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0865-1 Rating: important References: #967812 #967814 #967815 #967964 #967965 #967966 #967967 Cross-References: CVE-2015-5174 CVE-2015-5345 CVE-2015-5346 CVE-2015-5351 CVE-2016-0706 CVE-2016-0714 CVE-2016-0763 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for tomcat fixes the following issues: Tomcat 8 was updated from 8.0.23 to 8.0.32, to fix bugs and security issues. Fixed security issues: * CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (bsc#967967) * CVE-2015-5346: Session fixation vulnerability in Apache Tomcat when different session settings are used for deployments of multiple versions of the same web application, might have allowed remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java. (bsc#967814) * CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects before considering security constraints and Filters, which allowed remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (bsc#967965) * CVE-2015-5351: The (1) Manager and (2) Host Manager applications in Apache Tomcat established sessions and send CSRF tokens for arbitrary new requests, which allowed remote attackers to bypass a CSRF protection mechanism by using a token. (bsc#967812) * CVE-2016-0706: Apache Tomcat did not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allowed remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. (bsc#967815) * CVE-2016-0714: The session-persistence implementation in Apache Tomcat mishandled session attributes, which allowed remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. (bsc#967964) * CVE-2016-0763: The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat did not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allowed remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context. (bsc#967966) The full changes can be read on: http://tomcat.apache.org/tomcat-8.0-doc/changelog.html This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-384=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): tomcat-8.0.32-5.1 tomcat-admin-webapps-8.0.32-5.1 tomcat-docs-webapp-8.0.32-5.1 tomcat-el-3_0-api-8.0.32-5.1 tomcat-embed-8.0.32-5.1 tomcat-javadoc-8.0.32-5.1 tomcat-jsp-2_3-api-8.0.32-5.1 tomcat-jsvc-8.0.32-5.1 tomcat-lib-8.0.32-5.1 tomcat-servlet-3_1-api-8.0.32-5.1 tomcat-webapps-8.0.32-5.1 References: https://www.suse.com/security/cve/CVE-2015-5174.html https://www.suse.com/security/cve/CVE-2015-5345.html https://www.suse.com/security/cve/CVE-2015-5346.html https://www.suse.com/security/cve/CVE-2015-5351.html https://www.suse.com/security/cve/CVE-2016-0706.html https://www.suse.com/security/cve/CVE-2016-0714.html https://www.suse.com/security/cve/CVE-2016-0763.html https://bugzilla.suse.com/967812 https://bugzilla.suse.com/967814 https://bugzilla.suse.com/967815 https://bugzilla.suse.com/967964 https://bugzilla.suse.com/967965 https://bugzilla.suse.com/967966 https://bugzilla.suse.com/967967

1 0

openSUSE-RU-2016:0864-1: moderate: Recommended update for systemd-rpm-macros
by maintenance＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Recommended Update: Recommended update for systemd-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0864-1 Rating: moderate References: #955996 #956849 #968405 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This recommended update for systemd-rpm-macros fixes the following issues: - Add %tmpfiles_create macro (boo#956849) - Allow the packagers to specify the options -f and -n on the macros %service_del_preun(), %service_del_postun(), %systemd_post(), and %systemd_preun() (boo#968405) - Support of DISABLE_STOP_ON_REMOVAL and DISABLE_RESTART_ON_UPDATE from /etc/sysconfig/service (boo#955996) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-385=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): systemd-rpm-macros-2.1-3.1 References: https://bugzilla.suse.com/955996 https://bugzilla.suse.com/956849 https://bugzilla.suse.com/968405

1 0

openSUSE-SU-2016:0863-1: moderate: Security update for quagga
by opensuse-security＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0863-1 Rating: moderate References: #970952 Cross-References: CVE-2016-2342 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following security issue: - CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-383=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): quagga-0.99.23-2.3.1 quagga-debuginfo-0.99.23-2.3.1 quagga-debugsource-0.99.23-2.3.1 quagga-devel-0.99.23-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-2342.html https://bugzilla.suse.com/970952

1 0

openSUSE-SU-2016:0859-1: important: Security update for bind
by opensuse-security＠opensuse.org 23 Mar '16

23 Mar '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0859-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: Fix two assertion failures that can lead to a remote denial of service attack: * CVE-2016-1285: An error when parsing signature records for DNAME can lead to named exiting due to an assertion failure. (bsc#970072) * CVE-2016-1286: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. (bsc#970073) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-382=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.6P1-33.1 bind-chrootenv-9.9.6P1-33.1 bind-debuginfo-9.9.6P1-33.1 bind-debugsource-9.9.6P1-33.1 bind-devel-9.9.6P1-33.1 bind-libs-9.9.6P1-33.1 bind-libs-debuginfo-9.9.6P1-33.1 bind-lwresd-9.9.6P1-33.1 bind-lwresd-debuginfo-9.9.6P1-33.1 bind-utils-9.9.6P1-33.1 bind-utils-debuginfo-9.9.6P1-33.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.6P1-33.1 bind-libs-debuginfo-32bit-9.9.6P1-33.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.6P1-33.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073

1 0

openSUSE-RU-2016:0852-1: moderate: Recommended update for yast2-vm
by maintenance＠opensuse.org 22 Mar '16

22 Mar '16

openSUSE Recommended Update: Recommended update for yast2-vm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0852-1 Rating: moderate References: #905580 #907747 #941125 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This recommended update for yast2-vm fixes the following issues: - boo#941125 - yast2-vm: uses /etc/inittab - 3.1.21 - boo#907747 - yast-vm fails to find the pattern on sled - 3.1.20 - boo#905580 - SIGSEGV in yast2 relocation-server - 3.1.19 - boo#941125 - yast2-vm: uses /etc/inittab - 3.1.21 - boo#907747 - yast-vm fails to find the pattern on sled - 3.1.20 - boo#905580 - SIGSEGV in yast2 relocation-server - 3.1.19 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-378=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): yast2-vm-3.1.21-2.3.1 References: https://bugzilla.suse.com/905580 https://bugzilla.suse.com/907747 https://bugzilla.suse.com/941125

1 0

openSUSE-RU-2016:0851-1: moderate: Recommended update for spice
by maintenance＠opensuse.org 22 Mar '16

22 Mar '16

openSUSE Recommended Update: Recommended update for spice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0851-1 Rating: moderate References: #969059 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for spice fixes the following issues: - Fix crash when starting up Xspice (boo#969059). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-379=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libspice-server-devel-0.12.4-4.9.1 libspice-server1-0.12.4-4.9.1 libspice-server1-debuginfo-0.12.4-4.9.1 spice-client-0.12.4-4.9.1 spice-client-debuginfo-0.12.4-4.9.1 spice-debugsource-0.12.4-4.9.1 References: https://bugzilla.suse.com/969059

1 0

openSUSE-RU-2016:0850-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0850-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - database refresh March 21st This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-377=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201603210002-65.1 References:

1 0

openSUSE-SU-2016:0845-1: moderate: Security update for shotwell
by opensuse-security＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Security Update: Security update for shotwell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0845-1 Rating: moderate References: #958382 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Shotwell was updated to fix the following issues: * boo#958382: Shotwell did not perform TLS certificate verification when publishing photos to external services Also contains all upstream bug fixes and improvements in the current upstream version. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch 4816=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): shotwell-0.22.0+git.20160103-8.1 shotwell-debuginfo-0.22.0+git.20160103-8.1 shotwell-debugsource-0.22.0+git.20160103-8.1 - openSUSE 13.2 (noarch): shotwell-lang-0.22.0+git.20160103-8.1 References: https://bugzilla.suse.com/958382

1 0

openSUSE-SU-2016:0844-1: moderate: Security update for shotwell
by opensuse-security＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Security Update: Security update for shotwell ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0844-1 Rating: moderate References: #958382 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Shotwell was updated to fix the following issues: * boo#958382: Shotwell did not perform TLS certificate verification when publishing photos to external services Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 4813=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): shotwell-0.22.0+git.20160103-5.1 shotwell-debuginfo-0.22.0+git.20160103-5.1 shotwell-debugsource-0.22.0+git.20160103-5.1 - openSUSE Leap 42.1 (noarch): shotwell-lang-0.22.0+git.20160103-5.1 References: https://bugzilla.suse.com/958382

1 0

openSUSE-RU-2016:0843-1: moderate: Recommended update for resource-agents
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0843-1 Rating: moderate References: #961380 #962795 #965179 #967380 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for resource-agents provides the following fixes: - SAPDatabase: Add support for Oracle 12c. (bsc#967380) - exportfs: Don't increment fsid for single directory. (bsc#961380) - ldirectord: Fix unset failcount error. (bsc#962795) - nfsserver: Check if /var/lock/subsys exists before using it. (bsc#965179) - nfsserver: Prevent error messages on platforms without rpcuser. (bsc#965179) - nfsserver: Fix monitor for systemd. (bsc#965179) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-376=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ldirectord-3.9.6+git.1442374860.7f3628a-6.1 monitoring-plugins-metadata-3.9.6+git.1442374860.7f3628a-6.1 resource-agents-3.9.6+git.1442374860.7f3628a-6.1 resource-agents-debuginfo-3.9.6+git.1442374860.7f3628a-6.1 resource-agents-debugsource-3.9.6+git.1442374860.7f3628a-6.1 References: https://bugzilla.suse.com/961380 https://bugzilla.suse.com/962795 https://bugzilla.suse.com/965179 https://bugzilla.suse.com/967380

1 0

openSUSE-RU-2016:0842-1: Recommended update for python-rtslib
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Recommended Update: Recommended update for python-rtslib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0842-1 Rating: low References: #963348 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-rtslib provides the following enhancements: - Add support for xen-scsiback. (fate#315712) - Add support for nvme discs. (bsc#963348) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-374=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): python-rtslib-2.2-12.1 References: https://bugzilla.suse.com/963348

1 0

openSUSE-OU-2016:0841-1: Optional update for libwebp
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Optional Update: Optional update for libwebp ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:0841-1 Rating: low References: #965150 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds the libwebpdecoder1 library to SLE Software Development Kit 12 SP1. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-372=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libwebp-debugsource-0.4.3-7.1 libwebp-devel-0.4.3-7.1 libwebp-tools-0.4.3-7.1 libwebp-tools-debuginfo-0.4.3-7.1 libwebp5-0.4.3-7.1 libwebp5-debuginfo-0.4.3-7.1 libwebpdecoder1-0.4.3-7.1 libwebpdecoder1-debuginfo-0.4.3-7.1 libwebpdemux1-0.4.3-7.1 libwebpdemux1-debuginfo-0.4.3-7.1 libwebpmux1-0.4.3-7.1 libwebpmux1-debuginfo-0.4.3-7.1 - openSUSE Leap 42.1 (x86_64): libwebp5-32bit-0.4.3-7.1 libwebp5-debuginfo-32bit-0.4.3-7.1 libwebpdecoder1-32bit-0.4.3-7.1 libwebpdecoder1-debuginfo-32bit-0.4.3-7.1 libwebpdemux1-32bit-0.4.3-7.1 libwebpdemux1-debuginfo-32bit-0.4.3-7.1 libwebpmux1-32bit-0.4.3-7.1 libwebpmux1-debuginfo-32bit-0.4.3-7.1 References: https://bugzilla.suse.com/965150

1 0

openSUSE-RU-2016:0840-1: moderate: Recommended update for pdfchain
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Recommended Update: Recommended update for pdfchain ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0840-1 Rating: moderate References: #970530 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pdfchain fixes the following issues: - boo#970530: startup crash pdfchain was also updated to 0.4.4.2 containing various upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-371=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): pdfchain-0.4.4.2-9.1 pdfchain-debuginfo-0.4.4.2-9.1 pdfchain-debugsource-0.4.4.2-9.1 References: https://bugzilla.suse.com/970530

1 0

openSUSE-RU-2016:0838-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0838-1 Rating: moderate References: #959886 #960158 #963230 #964355 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for systemd fixes the following issues: - Prevent fill up of logs (boo#960158) - Make systemd.log_level=debug work as expected (boo#963230) - Remove WorkingDirectory parameter from emergency, rescue and console-shell.service (boo#959886) - Fix wrong substitution variable name in systemd-udev-root-symlink.service.in (boo#964355) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-375=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libgudev-1_0-0-210.1456152170.f2b9ea6-25.34.1 libgudev-1_0-0-debuginfo-210.1456152170.f2b9ea6-25.34.1 libgudev-1_0-devel-210.1456152170.f2b9ea6-25.34.1 libudev-devel-210.1456152170.f2b9ea6-25.34.1 libudev-mini-devel-210.1456152170.f2b9ea6-25.34.1 libudev-mini1-210.1456152170.f2b9ea6-25.34.1 libudev-mini1-debuginfo-210.1456152170.f2b9ea6-25.34.1 libudev1-210.1456152170.f2b9ea6-25.34.1 libudev1-debuginfo-210.1456152170.f2b9ea6-25.34.1 nss-myhostname-210.1456152170.f2b9ea6-25.34.1 nss-myhostname-debuginfo-210.1456152170.f2b9ea6-25.34.1 systemd-210.1456152170.f2b9ea6-25.34.1 systemd-debuginfo-210.1456152170.f2b9ea6-25.34.1 systemd-debugsource-210.1456152170.f2b9ea6-25.34.1 systemd-devel-210.1456152170.f2b9ea6-25.34.1 systemd-journal-gateway-210.1456152170.f2b9ea6-25.34.1 systemd-journal-gateway-debuginfo-210.1456152170.f2b9ea6-25.34.1 systemd-logger-210.1456152170.f2b9ea6-25.34.1 systemd-mini-210.1456152170.f2b9ea6-25.34.1 systemd-mini-debuginfo-210.1456152170.f2b9ea6-25.34.1 systemd-mini-debugsource-210.1456152170.f2b9ea6-25.34.1 systemd-mini-devel-210.1456152170.f2b9ea6-25.34.1 systemd-mini-sysvinit-210.1456152170.f2b9ea6-25.34.1 systemd-sysvinit-210.1456152170.f2b9ea6-25.34.1 typelib-1_0-GUdev-1_0-210.1456152170.f2b9ea6-25.34.1 udev-210.1456152170.f2b9ea6-25.34.1 udev-debuginfo-210.1456152170.f2b9ea6-25.34.1 udev-mini-210.1456152170.f2b9ea6-25.34.1 udev-mini-debuginfo-210.1456152170.f2b9ea6-25.34.1 - openSUSE 13.2 (x86_64): libgudev-1_0-0-32bit-210.1456152170.f2b9ea6-25.34.1 libgudev-1_0-0-debuginfo-32bit-210.1456152170.f2b9ea6-25.34.1 libudev1-32bit-210.1456152170.f2b9ea6-25.34.1 libudev1-debuginfo-32bit-210.1456152170.f2b9ea6-25.34.1 nss-myhostname-32bit-210.1456152170.f2b9ea6-25.34.1 nss-myhostname-debuginfo-32bit-210.1456152170.f2b9ea6-25.34.1 systemd-32bit-210.1456152170.f2b9ea6-25.34.1 systemd-debuginfo-32bit-210.1456152170.f2b9ea6-25.34.1 - openSUSE 13.2 (noarch): systemd-bash-completion-210.1456152170.f2b9ea6-25.34.1 References: https://bugzilla.suse.com/959886 https://bugzilla.suse.com/960158 https://bugzilla.suse.com/963230 https://bugzilla.suse.com/964355

1 0

openSUSE-RU-2016:0836-1: moderate: Recommended update for machinery
by maintenance＠opensuse.org 21 Mar '16

21 Mar '16

openSUSE Recommended Update: Recommended update for machinery ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0836-1 Rating: moderate References: #968380 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides Machinery 1.18.0, which brings the following fixes and enhancements: - Make the machinery-helper exclusive to improve inspection performance significantly on all supported architectures. - Fix treatment of the rpm '(replaced)' flag (gh#SUSE/machinery#1897) - Fix repository recognition on older Debian systems - Inspection of unmanaged-files is now also using the faster machinery-helper when a remote user is used - Show all available information for unmanaged files in HTML view (gh#SUSE/machinery#1905) - Move the machinery documentation from man page to HTML format - Implement "--extract-metadata" option for the unmanaged-files inspection to retrieve the file meta (e.g. owner, group, size) data without extracting the files. - Fixed counting of files in unmanaged directories (empty directories now report zero files as one would expect) - Fix reset button in HTML view (gh#SUSE/machinery#1899) - Align config-files scope in HTML view (gh#SUSE/machinery#1814) - Allow closing file dialog (in WebUI) by pressing ESC - Support inspection of Ubuntu 14.04 systems - New '--ssh-identity-file' option to specify a SSH private key when inspecting a remote system - New '--ssh-port' option to specify an SSH port when inspecting a remote system This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-373=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): machinery-1.18.0-9.1 machinery-debuginfo-1.18.0-9.1 machinery-doc-1.18.0-9.1 References: https://bugzilla.suse.com/968380

1 0

openSUSE-SU-2016:0835-1: important: Security update for rubygem-actionpack-3_2
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for rubygem-actionpack-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0835-1 Rating: important References: #968849 #968850 Cross-References: CVE-2016-2097 CVE-2016-2098 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rubygem-actionpack-3_2 fixes the following issues: - CVE-2016-2097: rubygem-actionview: Possible Information Leak Vulnerability in Action View. (boo#968850) - CVE-2016-2098: rubygem-actionpack: Possible remote code execution vulnerability in Action Pack (boo#968849) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-369=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-actionpack-3_2-3.2.17-3.10.1 rubygem-actionpack-3_2-doc-3.2.17-3.10.1 References: https://www.suse.com/security/cve/CVE-2016-2097.html https://www.suse.com/security/cve/CVE-2016-2098.html https://bugzilla.suse.com/968849 https://bugzilla.suse.com/968850

1 0

openSUSE-SU-2016:0834-1: important: Security update for bind
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0834-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: Fix two assertion failures that can lead to a remote denial of service attack: * CVE-2016-1285: An error when parsing signature records for DNAME can lead to named exiting due to an assertion failure. (bsc#970072) * CVE-2016-1286: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. (bsc#970073) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-368=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bind-9.9.6P1-2.19.1 bind-chrootenv-9.9.6P1-2.19.1 bind-debuginfo-9.9.6P1-2.19.1 bind-debugsource-9.9.6P1-2.19.1 bind-devel-9.9.6P1-2.19.1 bind-libs-9.9.6P1-2.19.1 bind-libs-debuginfo-9.9.6P1-2.19.1 bind-lwresd-9.9.6P1-2.19.1 bind-lwresd-debuginfo-9.9.6P1-2.19.1 bind-utils-9.9.6P1-2.19.1 bind-utils-debuginfo-9.9.6P1-2.19.1 - openSUSE 13.2 (x86_64): bind-libs-32bit-9.9.6P1-2.19.1 bind-libs-debuginfo-32bit-9.9.6P1-2.19.1 - openSUSE 13.2 (noarch): bind-doc-9.9.6P1-2.19.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073

1 0

openSUSE-SU-2016:0833-1: important: Security update for bsh2
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for bsh2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0833-1 Rating: important References: #967593 Cross-References: CVE-2016-2510 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bsh2 fixes the following issues: - Version update to 2.0b6 boo#967593 CVE-2016-2510 * Upstream developement moved to github * No obvious changelog apart from the above Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-370=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): bsh2-2.0.0.b6-27.3.1 bsh2-bsf-2.0.0.b6-27.3.1 bsh2-classgen-2.0.0.b6-27.3.1 bsh2-demo-2.0.0.b6-27.3.1 bsh2-javadoc-2.0.0.b6-27.3.1 bsh2-manual-2.0.0.b6-27.3.1 References: https://www.suse.com/security/cve/CVE-2016-2510.html https://bugzilla.suse.com/967593

1 0

openSUSE-SU-2016:0832-1: important: Security update for git
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0832-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-366=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): git-1.8.4.5-3.14.1 git-arch-1.8.4.5-3.14.1 git-core-1.8.4.5-3.14.1 git-core-debuginfo-1.8.4.5-3.14.1 git-cvs-1.8.4.5-3.14.1 git-daemon-1.8.4.5-3.14.1 git-daemon-debuginfo-1.8.4.5-3.14.1 git-debugsource-1.8.4.5-3.14.1 git-email-1.8.4.5-3.14.1 git-gui-1.8.4.5-3.14.1 git-remote-helpers-1.8.4.5-3.14.1 git-svn-1.8.4.5-3.14.1 git-svn-debuginfo-1.8.4.5-3.14.1 git-web-1.8.4.5-3.14.1 gitk-1.8.4.5-3.14.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-SU-2016:0831-1: important: Security update for cgit
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0831-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for cgit fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-367=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): cgit-0.8.3.3-5.11.1 cgit-debuginfo-0.8.3.3-5.11.1 cgit-debugsource-0.8.3.3-5.11.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-SU-2016:0830-1: important: Security update for bind
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0830-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: * CVE-2016-1285: remote DoS caused by malformed data on control channel * CVE-2016-1286: remote DoS via assertion failure in parsing of signature records for DNAME records Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-365=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): bind-9.9.4P2-75.1 bind-chrootenv-9.9.4P2-75.1 bind-debuginfo-9.9.4P2-75.1 bind-debugsource-9.9.4P2-75.1 bind-devel-9.9.4P2-75.1 bind-libs-9.9.4P2-75.1 bind-libs-debuginfo-9.9.4P2-75.1 bind-lwresd-9.9.4P2-75.1 bind-lwresd-debuginfo-9.9.4P2-75.1 bind-utils-9.9.4P2-75.1 bind-utils-debuginfo-9.9.4P2-75.1 - openSUSE Evergreen 11.4 (x86_64): bind-libs-32bit-9.9.4P2-75.1 bind-libs-debuginfo-32bit-9.9.4P2-75.1 - openSUSE Evergreen 11.4 (noarch): bind-doc-9.9.4P2-75.1 - openSUSE Evergreen 11.4 (ia64): bind-libs-debuginfo-x86-9.9.4P2-75.1 bind-libs-x86-9.9.4P2-75.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073

1 0

openSUSE-SU-2016:0829-1: important: Security update for cgit
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0829-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for cgit fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-367=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cgit-0.12-11.12.1 cgit-debuginfo-0.12-11.12.1 cgit-debugsource-0.12-11.12.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-SU-2016:0828-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0828-1 Rating: important References: #970509 #970511 #970514 Cross-References: CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update contains Chromium 49.0.2623.87 to fix the following issues: - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-364=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-49.0.2623.87-138.1 chromedriver-debuginfo-49.0.2623.87-138.1 chromium-49.0.2623.87-138.1 chromium-debuginfo-49.0.2623.87-138.1 chromium-debugsource-49.0.2623.87-138.1 chromium-desktop-gnome-49.0.2623.87-138.1 chromium-desktop-kde-49.0.2623.87-138.1 chromium-ffmpegsumo-49.0.2623.87-138.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-138.1 References: https://www.suse.com/security/cve/CVE-2016-1643.html https://www.suse.com/security/cve/CVE-2016-1644.html https://www.suse.com/security/cve/CVE-2016-1645.html https://bugzilla.suse.com/970509 https://bugzilla.suse.com/970511 https://bugzilla.suse.com/970514

1 0

openSUSE-SU-2016:0827-1: important: Security update for bind
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0827-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: * CVE-2016-1285: remote DoS caused by malformed data on control channel * CVE-2016-1286: remote DoS via assertion failure in parsing of signature records for DNAME records Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-365=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bind-9.9.4P2-2.29.1 bind-chrootenv-9.9.4P2-2.29.1 bind-debuginfo-9.9.4P2-2.29.1 bind-debugsource-9.9.4P2-2.29.1 bind-devel-9.9.4P2-2.29.1 bind-libs-9.9.4P2-2.29.1 bind-libs-debuginfo-9.9.4P2-2.29.1 bind-lwresd-9.9.4P2-2.29.1 bind-lwresd-debuginfo-9.9.4P2-2.29.1 bind-utils-9.9.4P2-2.29.1 bind-utils-debuginfo-9.9.4P2-2.29.1 - openSUSE 13.1 (x86_64): bind-libs-32bit-9.9.4P2-2.29.1 bind-libs-debuginfo-32bit-9.9.4P2-2.29.1 - openSUSE 13.1 (noarch): bind-doc-9.9.4P2-2.29.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073

1 0

openSUSE-SU-2016:0826-1: important: Security update for git
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0826-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-366=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): git-1.7.3.4-4.14.1 git-arch-1.7.3.4-4.14.1 git-core-1.7.3.4-4.14.1 git-core-debuginfo-1.7.3.4-4.14.1 git-cvs-1.7.3.4-4.14.1 git-daemon-1.7.3.4-4.14.1 git-daemon-debuginfo-1.7.3.4-4.14.1 git-debugsource-1.7.3.4-4.14.1 git-email-1.7.3.4-4.14.1 git-gui-1.7.3.4-4.14.1 git-remote-helpers-1.7.3.4-4.14.1 git-svn-1.7.3.4-4.14.1 git-web-1.7.3.4-4.14.1 gitk-1.7.3.4-4.14.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-RU-2016:0819-1: moderate: Recommended update for nfs-utils
by maintenance＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Recommended Update: Recommended update for nfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0819-1 Rating: moderate References: #950340 #963616 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for nfs-utils fixes the following issues: - Add ordering dependency on network-online.target, preventing attempts to mount NFS filesystems before the network is up. (bsc#963616) - Avoid "already mounted" errors from 'mount -a' when name in /etc/fstab differs slightly from /proc/mounts. (bsc#950340) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-363=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nfs-client-1.3.0-14.1 nfs-client-debuginfo-1.3.0-14.1 nfs-doc-1.3.0-14.1 nfs-kernel-server-1.3.0-14.1 nfs-kernel-server-debuginfo-1.3.0-14.1 nfs-utils-debugsource-1.3.0-14.1 References: https://bugzilla.suse.com/950340 https://bugzilla.suse.com/963616

1 0

openSUSE-SU-2016:0818-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0818-1 Rating: important References: #970509 #970511 #970514 Cross-References: CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update contains Chromium 49.0.2623.87 to fix the following issues: - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-362=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-49.0.2623.87-58.1 chromedriver-debuginfo-49.0.2623.87-58.1 chromium-49.0.2623.87-58.1 chromium-debuginfo-49.0.2623.87-58.1 chromium-debugsource-49.0.2623.87-58.1 chromium-desktop-gnome-49.0.2623.87-58.1 chromium-desktop-kde-49.0.2623.87-58.1 chromium-ffmpegsumo-49.0.2623.87-58.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-58.1 References: https://www.suse.com/security/cve/CVE-2016-1643.html https://www.suse.com/security/cve/CVE-2016-1644.html https://www.suse.com/security/cve/CVE-2016-1645.html https://bugzilla.suse.com/970509 https://bugzilla.suse.com/970511 https://bugzilla.suse.com/970514

1 0

openSUSE-SU-2016:0817-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0817-1 Rating: important References: #970509 #970511 #970514 Cross-References: CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update contains Chromium 49.0.2623.87 to fix the following issues: - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-362=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-362=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-49.0.2623.87-31.1 chromedriver-debuginfo-49.0.2623.87-31.1 chromium-49.0.2623.87-31.1 chromium-debuginfo-49.0.2623.87-31.1 chromium-debugsource-49.0.2623.87-31.1 chromium-desktop-gnome-49.0.2623.87-31.1 chromium-desktop-kde-49.0.2623.87-31.1 chromium-ffmpegsumo-49.0.2623.87-31.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-31.1 - openSUSE 13.2 (i586 x86_64): chromedriver-49.0.2623.87-84.1 chromedriver-debuginfo-49.0.2623.87-84.1 chromium-49.0.2623.87-84.1 chromium-debuginfo-49.0.2623.87-84.1 chromium-debugsource-49.0.2623.87-84.1 chromium-desktop-gnome-49.0.2623.87-84.1 chromium-desktop-kde-49.0.2623.87-84.1 chromium-ffmpegsumo-49.0.2623.87-84.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-84.1 References: https://www.suse.com/security/cve/CVE-2016-1643.html https://www.suse.com/security/cve/CVE-2016-1644.html https://www.suse.com/security/cve/CVE-2016-1645.html https://bugzilla.suse.com/970509 https://bugzilla.suse.com/970511 https://bugzilla.suse.com/970514

1 0

openSUSE-RU-2016:0815-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0815-1 Rating: moderate References: #927250 #942946 #948458 #948555 #949574 #954336 #954781 #955469 #955770 #958295 #958935 #958937 #961226 #961576 #962080 #964355 #965475 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 17 recommended fixes can now be installed. Description: This update for systemd provides the following fixes: - Set "maximum number of udev children reached" message's log level to debug. (bsc#958295) - Properly sum up journald's entry size counter. This allows systemd services to generate a core dump when they crash. (bsc#961226) - Rework messages during shutdown. (bsc#955469) - Move net_persistent_rule generator to SCRIPTS. (bsc#958935) - Revert "Skip persistent device link creation on multipath device paths". (bsc#942946) - Make sure all swap units are ordered before the swap target. (bsc#955770) - Add minimal support for 'set-property' command to bash-completion. (bsc#948458) - Properly handle locale at boot time. (bsc#927250) - Allow systemd-sysv-convert to do its job even if one of the sysvinit scripts is not found. (bsc#954336) - Do not return error when paths in ReadOnlyDirectories= and InaccessibleDirectories= directives are prefixed with "-" and don't exist. (bsc#954781) - Ensure tmp.mount is started automatically at boot time. (bsc#949574) - Don't ship fix.service anymore on 13.1, not needed by v210 (boo#965475) - Fix wrong substitution variable name in systemd-udev-root-symlink.service.in (boo#964355) - udev firmware loading support has been removed from 13.1 - systemd-firstboot is also shipped by SLE12 This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-360=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgudev-1_0-0-210-89.1 libgudev-1_0-0-debuginfo-210-89.1 libgudev-1_0-devel-210-89.1 libudev-devel-210-89.1 libudev-mini-devel-210-89.1 libudev-mini1-210-89.1 libudev-mini1-debuginfo-210-89.1 libudev1-210-89.1 libudev1-debuginfo-210-89.1 nss-myhostname-210-89.1 nss-myhostname-debuginfo-210-89.1 systemd-210-89.1 systemd-debuginfo-210-89.1 systemd-debugsource-210-89.1 systemd-devel-210-89.1 systemd-journal-gateway-210-89.1 systemd-journal-gateway-debuginfo-210-89.1 systemd-logger-210-89.1 systemd-mini-210-89.1 systemd-mini-debuginfo-210-89.1 systemd-mini-debugsource-210-89.1 systemd-mini-devel-210-89.1 systemd-mini-sysvinit-210-89.1 systemd-sysvinit-210-89.1 typelib-1_0-GUdev-1_0-210-89.1 udev-210-89.1 udev-debuginfo-210-89.1 udev-mini-210-89.1 udev-mini-debuginfo-210-89.1 - openSUSE Leap 42.1 (x86_64): libgudev-1_0-0-32bit-210-89.1 libgudev-1_0-0-debuginfo-32bit-210-89.1 libudev1-32bit-210-89.1 libudev1-debuginfo-32bit-210-89.1 nss-myhostname-32bit-210-89.1 nss-myhostname-debuginfo-32bit-210-89.1 systemd-32bit-210-89.1 systemd-debuginfo-32bit-210-89.1 - openSUSE Leap 42.1 (noarch): systemd-bash-completion-210-89.1 References: https://bugzilla.suse.com/927250 https://bugzilla.suse.com/942946 https://bugzilla.suse.com/948458 https://bugzilla.suse.com/948555 https://bugzilla.suse.com/949574 https://bugzilla.suse.com/954336 https://bugzilla.suse.com/954781 https://bugzilla.suse.com/955469 https://bugzilla.suse.com/955770 https://bugzilla.suse.com/958295 https://bugzilla.suse.com/958935 https://bugzilla.suse.com/958937 https://bugzilla.suse.com/961226 https://bugzilla.suse.com/961576 https://bugzilla.suse.com/962080 https://bugzilla.suse.com/964355 https://bugzilla.suse.com/965475

1 0

openSUSE-SU-2016:0813-1: important: Security update for samba
by opensuse-security＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0813-1 Rating: important References: #953382 #953972 #968222 #968223 Cross-References: CVE-2015-7560 CVE-2016-0771 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for samba fixes the following issues: Version update to 4.1.23. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (boo#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (boo#968223). Also fixed: - Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-359=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libdcerpc-atsvc-devel-4.1.23-31.1 libdcerpc-atsvc0-4.1.23-31.1 libdcerpc-atsvc0-debuginfo-4.1.23-31.1 libdcerpc-binding0-4.1.23-31.1 libdcerpc-binding0-debuginfo-4.1.23-31.1 libdcerpc-devel-4.1.23-31.1 libdcerpc-samr-devel-4.1.23-31.1 libdcerpc-samr0-4.1.23-31.1 libdcerpc-samr0-debuginfo-4.1.23-31.1 libdcerpc0-4.1.23-31.1 libdcerpc0-debuginfo-4.1.23-31.1 libgensec-devel-4.1.23-31.1 libgensec0-4.1.23-31.1 libgensec0-debuginfo-4.1.23-31.1 libndr-devel-4.1.23-31.1 libndr-krb5pac-devel-4.1.23-31.1 libndr-krb5pac0-4.1.23-31.1 libndr-krb5pac0-debuginfo-4.1.23-31.1 libndr-nbt-devel-4.1.23-31.1 libndr-nbt0-4.1.23-31.1 libndr-nbt0-debuginfo-4.1.23-31.1 libndr-standard-devel-4.1.23-31.1 libndr-standard0-4.1.23-31.1 libndr-standard0-debuginfo-4.1.23-31.1 libndr0-4.1.23-31.1 libndr0-debuginfo-4.1.23-31.1 libnetapi-devel-4.1.23-31.1 libnetapi0-4.1.23-31.1 libnetapi0-debuginfo-4.1.23-31.1 libpdb-devel-4.1.23-31.1 libpdb0-4.1.23-31.1 libpdb0-debuginfo-4.1.23-31.1 libregistry-devel-4.1.23-31.1 libregistry0-4.1.23-31.1 libregistry0-debuginfo-4.1.23-31.1 libsamba-credentials-devel-4.1.23-31.1 libsamba-credentials0-4.1.23-31.1 libsamba-credentials0-debuginfo-4.1.23-31.1 libsamba-hostconfig-devel-4.1.23-31.1 libsamba-hostconfig0-4.1.23-31.1 libsamba-hostconfig0-debuginfo-4.1.23-31.1 libsamba-policy-devel-4.1.23-31.1 libsamba-policy0-4.1.23-31.1 libsamba-policy0-debuginfo-4.1.23-31.1 libsamba-util-devel-4.1.23-31.1 libsamba-util0-4.1.23-31.1 libsamba-util0-debuginfo-4.1.23-31.1 libsamdb-devel-4.1.23-31.1 libsamdb0-4.1.23-31.1 libsamdb0-debuginfo-4.1.23-31.1 libsmbclient-devel-4.1.23-31.1 libsmbclient-raw-devel-4.1.23-31.1 libsmbclient-raw0-4.1.23-31.1 libsmbclient-raw0-debuginfo-4.1.23-31.1 libsmbclient0-4.1.23-31.1 libsmbclient0-debuginfo-4.1.23-31.1 libsmbconf-devel-4.1.23-31.1 libsmbconf0-4.1.23-31.1 libsmbconf0-debuginfo-4.1.23-31.1 libsmbldap-devel-4.1.23-31.1 libsmbldap0-4.1.23-31.1 libsmbldap0-debuginfo-4.1.23-31.1 libsmbsharemodes-devel-4.1.23-31.1 libsmbsharemodes0-4.1.23-31.1 libsmbsharemodes0-debuginfo-4.1.23-31.1 libtevent-util-devel-4.1.23-31.1 libtevent-util0-4.1.23-31.1 libtevent-util0-debuginfo-4.1.23-31.1 libwbclient-devel-4.1.23-31.1 libwbclient0-4.1.23-31.1 libwbclient0-debuginfo-4.1.23-31.1 samba-4.1.23-31.1 samba-client-4.1.23-31.1 samba-client-debuginfo-4.1.23-31.1 samba-core-devel-4.1.23-31.1 samba-debuginfo-4.1.23-31.1 samba-debugsource-4.1.23-31.1 samba-libs-4.1.23-31.1 samba-libs-debuginfo-4.1.23-31.1 samba-pidl-4.1.23-31.1 samba-python-4.1.23-31.1 samba-python-debuginfo-4.1.23-31.1 samba-test-4.1.23-31.1 samba-test-debuginfo-4.1.23-31.1 samba-test-devel-4.1.23-31.1 samba-winbind-4.1.23-31.1 samba-winbind-debuginfo-4.1.23-31.1 - openSUSE 13.2 (x86_64): libdcerpc-atsvc0-32bit-4.1.23-31.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.23-31.1 libdcerpc-binding0-32bit-4.1.23-31.1 libdcerpc-binding0-debuginfo-32bit-4.1.23-31.1 libdcerpc-samr0-32bit-4.1.23-31.1 libdcerpc-samr0-debuginfo-32bit-4.1.23-31.1 libdcerpc0-32bit-4.1.23-31.1 libdcerpc0-debuginfo-32bit-4.1.23-31.1 libgensec0-32bit-4.1.23-31.1 libgensec0-debuginfo-32bit-4.1.23-31.1 libndr-krb5pac0-32bit-4.1.23-31.1 libndr-krb5pac0-debuginfo-32bit-4.1.23-31.1 libndr-nbt0-32bit-4.1.23-31.1 libndr-nbt0-debuginfo-32bit-4.1.23-31.1 libndr-standard0-32bit-4.1.23-31.1 libndr-standard0-debuginfo-32bit-4.1.23-31.1 libndr0-32bit-4.1.23-31.1 libndr0-debuginfo-32bit-4.1.23-31.1 libnetapi0-32bit-4.1.23-31.1 libnetapi0-debuginfo-32bit-4.1.23-31.1 libpdb0-32bit-4.1.23-31.1 libpdb0-debuginfo-32bit-4.1.23-31.1 libregistry0-32bit-4.1.23-31.1 libregistry0-debuginfo-32bit-4.1.23-31.1 libsamba-credentials0-32bit-4.1.23-31.1 libsamba-credentials0-debuginfo-32bit-4.1.23-31.1 libsamba-hostconfig0-32bit-4.1.23-31.1 libsamba-hostconfig0-debuginfo-32bit-4.1.23-31.1 libsamba-policy0-32bit-4.1.23-31.1 libsamba-policy0-debuginfo-32bit-4.1.23-31.1 libsamba-util0-32bit-4.1.23-31.1 libsamba-util0-debuginfo-32bit-4.1.23-31.1 libsamdb0-32bit-4.1.23-31.1 libsamdb0-debuginfo-32bit-4.1.23-31.1 libsmbclient-raw0-32bit-4.1.23-31.1 libsmbclient-raw0-debuginfo-32bit-4.1.23-31.1 libsmbclient0-32bit-4.1.23-31.1 libsmbclient0-debuginfo-32bit-4.1.23-31.1 libsmbconf0-32bit-4.1.23-31.1 libsmbconf0-debuginfo-32bit-4.1.23-31.1 libsmbldap0-32bit-4.1.23-31.1 libsmbldap0-debuginfo-32bit-4.1.23-31.1 libtevent-util0-32bit-4.1.23-31.1 libtevent-util0-debuginfo-32bit-4.1.23-31.1 libwbclient0-32bit-4.1.23-31.1 libwbclient0-debuginfo-32bit-4.1.23-31.1 samba-32bit-4.1.23-31.1 samba-client-32bit-4.1.23-31.1 samba-client-debuginfo-32bit-4.1.23-31.1 samba-debuginfo-32bit-4.1.23-31.1 samba-libs-32bit-4.1.23-31.1 samba-libs-debuginfo-32bit-4.1.23-31.1 samba-winbind-32bit-4.1.23-31.1 samba-winbind-debuginfo-32bit-4.1.23-31.1 - openSUSE 13.2 (noarch): samba-doc-4.1.23-31.1 References: https://www.suse.com/security/cve/CVE-2015-7560.html https://www.suse.com/security/cve/CVE-2016-0771.html https://bugzilla.suse.com/953382 https://bugzilla.suse.com/953972 https://bugzilla.suse.com/968222 https://bugzilla.suse.com/968223

1 0

openSUSE-RU-2016:0812-1: moderate: Recommended update for clementine
by maintenance＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Recommended Update: Recommended update for clementine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0812-1 Rating: moderate References: #904155 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for clementine fixes the following issues: - Added recommends for gstreamer-0_10-plugins--fluendo_mp3 to fix missing plugins message. See boo#904155 - check for 1230 din spec-file and do not use cmake-rpm-macro for 12.3 - Update to 1.2.3 * Fix compilation with GCC 4.9 * Fix poor search performance with sqlite 3.8. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-358=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-358=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): clementine-1.2.3-4.2 clementine-debuginfo-1.2.3-4.2 clementine-debugsource-1.2.3-4.2 - openSUSE 13.2 (i586 x86_64): clementine-1.2.3-3.3.2 clementine-debuginfo-1.2.3-3.3.2 clementine-debugsource-1.2.3-3.3.2 References: https://bugzilla.suse.com/904155

1 0

openSUSE-RU-2016:0811-1: moderate: Recommended update for i3
by maintenance＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Recommended Update: Recommended update for i3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0811-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for i3 fixes the following issues: - Backport XKB fixes from 4.11: * Bugfixes: - Translate bindsym bindings upon ISO_Next_Group - Use libxkbcommon for translating keysyms, support all XKB groups - bindings: invert shift bit, don't just remove it - sort bindings, re-ordering once is not enough Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-361=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): i3-4.10.4-3.1 i3-debuginfo-4.10.4-3.1 i3-devel-4.10.4-3.1 References:

1 0

openSUSE-RU-2016:0809-1: Recommended update for clamav-database
by maintenance＠opensuse.org 17 Mar '16

17 Mar '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0809-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh March 14th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-357=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201603140002-62.1 References:

1 0

openSUSE-SU-2016:0803-1: important: Security update for cgit
by opensuse-security＠opensuse.org 17 Mar '16

17 Mar '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0803-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for cgit fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-356=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-356=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): cgit-0.12-9.1 cgit-debuginfo-0.12-9.1 cgit-debugsource-0.12-9.1 - openSUSE 13.2 (i586 x86_64): cgit-0.12-13.9.1 cgit-debuginfo-0.12-13.9.1 cgit-debugsource-0.12-13.9.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-SU-2016:0802-1: important: Security update for git
by opensuse-security＠opensuse.org 17 Mar '16

17 Mar '16

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0802-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-355=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-355=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): git-2.6.2-3.1 git-arch-2.6.2-3.1 git-core-2.6.2-3.1 git-core-debuginfo-2.6.2-3.1 git-credential-gnome-keyring-2.6.2-3.1 git-credential-gnome-keyring-debuginfo-2.6.2-3.1 git-cvs-2.6.2-3.1 git-daemon-2.6.2-3.1 git-daemon-debuginfo-2.6.2-3.1 git-debugsource-2.6.2-3.1 git-email-2.6.2-3.1 git-gui-2.6.2-3.1 git-svn-2.6.2-3.1 git-svn-debuginfo-2.6.2-3.1 git-web-2.6.2-3.1 gitk-2.6.2-3.1 - openSUSE Leap 42.1 (noarch): git-doc-2.6.2-3.1 - openSUSE 13.2 (i586 x86_64): git-2.1.4-19.1 git-arch-2.1.4-19.1 git-core-2.1.4-19.1 git-core-debuginfo-2.1.4-19.1 git-cvs-2.1.4-19.1 git-daemon-2.1.4-19.1 git-daemon-debuginfo-2.1.4-19.1 git-debugsource-2.1.4-19.1 git-email-2.1.4-19.1 git-gui-2.1.4-19.1 git-svn-2.1.4-19.1 git-svn-debuginfo-2.1.4-19.1 git-web-2.1.4-19.1 gitk-2.1.4-19.1 - openSUSE 13.2 (noarch): git-doc-2.1.4-19.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-RU-2016:0801-1: important: Recommended update for grub2
by maintenance＠opensuse.org 17 Mar '16

17 Mar '16

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0801-1 Rating: important References: #904647 #926795 #957383 #960776 #962182 #968721 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for grub2 fixes the following issues: - Add configuration option ($SUSE_CMDLINE_XENEFI) to set command line options for the EFI Xen loader. (bsc#957383) - Fix failure to boot s390x guests when the root file system is on btrfs and spans multiple disks. (bsc#960776) - Support booting installer media as PV DomU. (bsc#926795) - Backport upstream patches for HyperV Gen2 TSC timer calibration without RTC. (bsc#904647, bsc#962182) - Prevents "attempt to seek outside of the file" error when parsing xen ELF notes, preventing XEN guests to boot when using kernel-xen-3.12.53-60.30.1 This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-353=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): grub2-2.02~beta2-80.1 grub2-branding-upstream-2.02~beta2-80.1 grub2-debuginfo-2.02~beta2-80.1 grub2-i386-pc-2.02~beta2-80.1 - openSUSE Leap 42.1 (x86_64): grub2-x86_64-efi-2.02~beta2-80.1 grub2-x86_64-xen-2.02~beta2-80.1 - openSUSE Leap 42.1 (noarch): grub2-snapper-plugin-2.02~beta2-80.1 - openSUSE Leap 42.1 (i586): grub2-i386-efi-2.02~beta2-80.1 References: https://bugzilla.suse.com/904647 https://bugzilla.suse.com/926795 https://bugzilla.suse.com/957383 https://bugzilla.suse.com/960776 https://bugzilla.suse.com/962182 https://bugzilla.suse.com/968721

1 0

openSUSE-RU-2016:0800-1: moderate: Recommended update for yast2-network
by maintenance＠opensuse.org 17 Mar '16

17 Mar '16

openSUSE Recommended Update: Recommended update for yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0800-1 Rating: moderate References: #903190 #944349 #950902 #951330 #954412 #955217 #956012 #956605 #957377 #960703 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for yast2-network provides the following fixes: - Fixed AutoYaST support to use the correct network management system (Wicked or NetworkManager) instead of leaving both in a "half-started" state. (bsc#960703) - Fixed an internal error when aborting the configuration of a wireless interface. (bsc#950902) - Write udev rules for renamed devices for non-ssh/vnc AutoYaST installations. (bsc#956605) - Drop entry from /etc/hosts when deleting NIC configuration. (bsc#951330) - Fix validation of AutoYaST profiles. (bsc#954412) - When exporting AutoYaST profile, it contains DNS and route definitions even when these were configured using linuxrc. (bsc#956012, bsc#957377) - Do not raise internal error during AutoYaST installation with profile containing device renaming rule for not configured interfaces. (bsc#955217) - Do not set links down when running AutoYaST installation over vnc. (bsc#944349) - Renaming network devices during ssh/vnc installation is supported. (bsc#944349) - Recognize NICs with sub_class_id 07 as InfiniBand devices. (bsc#903190) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-354=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): yast2-network-3.1.140.3-6.1 yast2-network-devel-doc-3.1.140.3-6.1 References: https://bugzilla.suse.com/903190 https://bugzilla.suse.com/944349 https://bugzilla.suse.com/950902 https://bugzilla.suse.com/951330 https://bugzilla.suse.com/954412 https://bugzilla.suse.com/955217 https://bugzilla.suse.com/956012 https://bugzilla.suse.com/956605 https://bugzilla.suse.com/957377 https://bugzilla.suse.com/960703

1 0

openSUSE-SU-2016:0791-1: important: Security update for graphite2
by opensuse-security＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Security Update: Security update for graphite2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0791-1 Rating: important References: #965803 #965806 #965807 #965810 Cross-References: CVE-2016-1521 CVE-2016-1522 CVE-2016-1523 CVE-2016-1526 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for graphite2 fixes the following issues: - CVE-2016-1521: The directrun function in directmachine.cpp in Libgraphite did not validate a certain skip operation, which allowed remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. - CVE-2016-1522: Code.cpp in Libgraphite did not consider recursive load calls during a size check, which allowed remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font. - CVE-2016-1523: The SillMap::readFace function in FeatureMap.cpp in Libgraphite mishandled a return value, which allowed remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font. - CVE-2016-1526: The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite incorrectly validated a size value, which allowed remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-349=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): graphite2-1.2.4-2.4.1 graphite2-debuginfo-1.2.4-2.4.1 graphite2-debugsource-1.2.4-2.4.1 graphite2-devel-1.2.4-2.4.1 libgraphite2-3-1.2.4-2.4.1 libgraphite2-3-debuginfo-1.2.4-2.4.1 - openSUSE 13.2 (x86_64): libgraphite2-3-32bit-1.2.4-2.4.1 libgraphite2-3-debuginfo-32bit-1.2.4-2.4.1 References: https://www.suse.com/security/cve/CVE-2016-1521.html https://www.suse.com/security/cve/CVE-2016-1522.html https://www.suse.com/security/cve/CVE-2016-1523.html https://www.suse.com/security/cve/CVE-2016-1526.html https://bugzilla.suse.com/965803 https://bugzilla.suse.com/965806 https://bugzilla.suse.com/965807 https://bugzilla.suse.com/965810

1 0

openSUSE-SU-2016:0790-1: important: Security update for rubygem-actionview-4_2
by opensuse-security＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Security Update: Security update for rubygem-actionview-4_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0790-1 Rating: important References: #968849 Cross-References: CVE-2016-2098 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-actionview-4_2 fixes the following issues: - CVE-2016-2098: rubygem-actionpack: Possible remote code execution vulnerability in Action Pack (boo#968849) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-352=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ruby2.1-rubygem-actionview-4_2-4.2.4-9.1 ruby2.1-rubygem-actionview-doc-4_2-4.2.4-9.1 References: https://www.suse.com/security/cve/CVE-2016-2098.html https://bugzilla.suse.com/968849

1 0

openSUSE-RU-2016:0789-1: moderate: Recommended update for perl-Net-IP
by maintenance＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Recommended Update: Recommended update for perl-Net-IP ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0789-1 Rating: moderate References: #942108 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-Net-IP fixes the following issues: - boo#942108: fix the use of + in the address range Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-350=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): perl-Net-IP-1.26-7.1 References: https://bugzilla.suse.com/942108

1 0

openSUSE-SU-2016:0788-1: important: Security update for bsh2
by opensuse-security＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Security Update: Security update for bsh2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0788-1 Rating: important References: #967593 Cross-References: CVE-2016-2510 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bsh2 fixes the following issues: - CVE-2016-2510: An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source. Please see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-351=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): bsh2-2.0.0.b5-30.1 bsh2-bsf-2.0.0.b5-30.1 bsh2-classgen-2.0.0.b5-30.1 bsh2-demo-2.0.0.b5-30.1 bsh2-javadoc-2.0.0.b5-30.1 bsh2-manual-2.0.0.b5-30.1 bsh2-src-2.0.0.b5-30.1 References: https://www.suse.com/security/cve/CVE-2016-2510.html https://bugzilla.suse.com/967593

1 0

openSUSE-OU-2016:0784-1: Optional update for sbc
by maintenance＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Optional Update: Optional update for sbc ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:0784-1 Rating: low References: #949416 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for sbc enables building of libsbc1-32bit. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-347=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libsbc1-1.0-9.1 libsbc1-debuginfo-1.0-9.1 sbc-1.0-9.1 sbc-debuginfo-1.0-9.1 sbc-debugsource-1.0-9.1 sbc-devel-1.0-9.1 - openSUSE Leap 42.1 (x86_64): libsbc1-32bit-1.0-9.1 libsbc1-debuginfo-32bit-1.0-9.1 References: https://bugzilla.suse.com/949416

1 0

openSUSE-OU-2016:0783-1: moderate: Optional update for yast2-cluster, hawk2
by maintenance＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Optional Update: Optional update for yast2-cluster, hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:0783-1 Rating: moderate References: #957305 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update contains hawk2, the successor of hawk. The hawk2 package is inherited from SLE 12 SP1 HA. The YaST2 Cluster module was also updated to use the version of Hawk. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-345=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): hawk2-1.0.1+git.1456406635.49e230d-2.2 hawk2-debuginfo-1.0.1+git.1456406635.49e230d-2.2 hawk2-debugsource-1.0.1+git.1456406635.49e230d-2.2 - openSUSE Leap 42.1 (noarch): yast2-cluster-3.1.22-5.1 References: https://bugzilla.suse.com/957305

1 0

openSUSE-RU-2016:0782-1: Recommended update for insserv-compat
by maintenance＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Recommended Update: Recommended update for insserv-compat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0782-1 Rating: low References: #960820 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for insserv-compat fixes the name of the ntpd service. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-346=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): insserv-compat-0.1-15.1 References: https://bugzilla.suse.com/960820

1 0

openSUSE-RU-2016:0781-1: Recommended update for SDL
by maintenance＠opensuse.org 16 Mar '16

16 Mar '16

openSUSE Recommended Update: Recommended update for SDL ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0781-1 Rating: low References: #953861 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for SDL disables usage of backing storage by default due to tearing effects. Users who would like to enable it can set the SDL_VIDEO_X11_BACKINGSTORE environment variable. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-348=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): SDL-debugsource-1.2.15-17.1 libSDL-1_2-0-1.2.15-17.1 libSDL-1_2-0-debuginfo-1.2.15-17.1 libSDL-devel-1.2.15-17.1 - openSUSE Leap 42.1 (x86_64): libSDL-1_2-0-32bit-1.2.15-17.1 libSDL-1_2-0-debuginfo-32bit-1.2.15-17.1 libSDL-devel-32bit-1.2.15-17.1 References: https://bugzilla.suse.com/953861

1 0

openSUSE-RU-2016:0768-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 15 Mar '16

15 Mar '16

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0768-1 Rating: moderate References: #954433 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for xorg-x11-server fixes the following issues: - Ignore file descriptor if socket or devices dies. This prevents the Xserver to loop at 100% when dbus dies (boo#954433). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-344=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xorg-x11-server-7.6_1.17.2-24.2 xorg-x11-server-debuginfo-7.6_1.17.2-24.2 xorg-x11-server-debugsource-7.6_1.17.2-24.2 xorg-x11-server-extra-7.6_1.17.2-24.2 xorg-x11-server-extra-debuginfo-7.6_1.17.2-24.2 xorg-x11-server-sdk-7.6_1.17.2-24.2 xorg-x11-server-source-7.6_1.17.2-24.2 References: https://bugzilla.suse.com/954433

1 0

openSUSE-RU-2016:0767-1: Recommended update for yast2-firstboot
by maintenance＠opensuse.org 15 Mar '16

15 Mar '16

openSUSE Recommended Update: Recommended update for yast2-firstboot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0767-1 Rating: low References: #960081 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-firstboot fixes firstboot.xml to call the correct client for LAN configuration. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-342=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): yast2-firstboot-3.1.11-3.1 References: https://bugzilla.suse.com/960081

1 0

openSUSE-RU-2016:0766-1: moderate: Recommended update for wicked
by maintenance＠opensuse.org 15 Mar '16

15 Mar '16

openSUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0766-1 Rating: moderate References: #927615 #936514 #944710 #953107 #955778 #955864 #957944 #959356 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update provides Wicked 0.6.30, which brings many fixes and enhancements: - wireless: Fix EAP inconsistencies and add missing auth method names to translation maps. (bsc#936514, bsc#927615) - fsm: Do not terminate with a segmentation fault on device hierarchy loops. (bsc#959356) - fsm: Handle down/step back events in ifup flow instead of trying to workaround in nanny. (bsc#955864) - ethtool: Map da,none,other port types. (bsc#957944) - ipv4: Remove pointless broadcast calculations and send to the kernel only if explicitly requested in ifcfg file or by dhcp options. The kernel has its own logic to automatically calculate related settings as needed. Also removed broadcast setting from ifcfg-lo to not override kernel's setup. (bsc#944710) - rpm: Do not use systemctl show in scripts. (bsc#955778) - nanny: Skip recheck when no policy configured. (bsc#953107) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-343=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libwicked-0-6-0.6.30-6.1 libwicked-0-6-debuginfo-0.6.30-6.1 wicked-0.6.30-6.1 wicked-debuginfo-0.6.30-6.1 wicked-debugsource-0.6.30-6.1 wicked-service-0.6.30-6.1 References: https://bugzilla.suse.com/927615 https://bugzilla.suse.com/936514 https://bugzilla.suse.com/944710 https://bugzilla.suse.com/953107 https://bugzilla.suse.com/955778 https://bugzilla.suse.com/955864 https://bugzilla.suse.com/957944 https://bugzilla.suse.com/959356

1 0

openSUSE-RU-2016:0764-1: Recommended update for dnsmasq
by maintenance＠opensuse.org 15 Mar '16

15 Mar '16

openSUSE Recommended Update: Recommended update for dnsmasq ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0764-1 Rating: low References: #902511 #904537 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dnsmasq fixes the following issues: - Drop PrivateDevices=yes from service file to fix logging. (bsc#902511, bsc#904537) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-341=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dnsmasq-2.71-6.1 dnsmasq-debuginfo-2.71-6.1 dnsmasq-debugsource-2.71-6.1 dnsmasq-utils-2.71-6.1 dnsmasq-utils-debuginfo-2.71-6.1 References: https://bugzilla.suse.com/902511 https://bugzilla.suse.com/904537

1 0

openSUSE-SU-2016:0762-1: moderate: Security update for python-Pillow
by opensuse-security＠opensuse.org 15 Mar '16

15 Mar '16

openSUSE Security Update: Security update for python-Pillow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0762-1 Rating: moderate References: #965579 #965582 Cross-References: CVE-2016-0740 CVE-2016-0775 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python-Pillow fixes the following issues: - backport security fixes from 3.1.1 (Pillow-overflows.patch): * Fixed an integer overflow in Resample.c causing writes in the Python heap. * Fixed a buffer overflow in PcdDecode.c causing a segfault when opening PhotoCD files. CVE-2016-TBD * Fixed a buffer overflow in FliDecode.c causing a segfault when opening FLI files. CVE-2016-0775 (fixes boo#965582) * Fixed a buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file. CVE-2016-0740 (fixes boo#965579) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-339=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-339=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): python-Pillow-2.9.0-6.1 python-Pillow-debuginfo-2.9.0-6.1 python-Pillow-debugsource-2.9.0-6.1 python-Pillow-tk-2.9.0-6.1 python-Pillow-tk-debuginfo-2.9.0-6.1 - openSUSE 13.2 (i586 x86_64): python-Pillow-2.8.1-3.6.1 python-Pillow-debuginfo-2.8.1-3.6.1 python-Pillow-debugsource-2.8.1-3.6.1 python-Pillow-tk-2.8.1-3.6.1 python-Pillow-tk-debuginfo-2.8.1-3.6.1 References: https://www.suse.com/security/cve/CVE-2016-0740.html https://www.suse.com/security/cve/CVE-2016-0775.html https://bugzilla.suse.com/965579 https://bugzilla.suse.com/965582

1 0

openSUSE-SU-2016:0761-1: moderate: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 15 Mar '16

15 Mar '16

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0761-1 Rating: moderate References: Cross-References: CVE-2015-1122 CVE-2015-1152 CVE-2015-1155 CVE-2015-3660 CVE-2015-3730 CVE-2015-3738 CVE-2015-3740 CVE-2015-3742 CVE-2015-3744 CVE-2015-3746 CVE-2015-3750 CVE-2015-3751 CVE-2015-3754 CVE-2015-3755 CVE-2015-5804 CVE-2015-5805 CVE-2015-5807 CVE-2015-5810 CVE-2015-5813 CVE-2015-5814 CVE-2015-5815 CVE-2015-5817 CVE-2015-5818 CVE-2015-5825 CVE-2015-5827 CVE-2015-5828 CVE-2015-5929 CVE-2015-5930 CVE-2015-5931 CVE-2015-7002 CVE-2015-7013 CVE-2015-7014 CVE-2015-7048 CVE-2015-7095 CVE-2015-7096 CVE-2015-7097 CVE-2015-7098 CVE-2015-7099 CVE-2015-7100 CVE-2015-7102 CVE-2015-7103 CVE-2015-7104 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 42 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - Update to version 2.10.7: + Fix the build with GTK+ < 3.16. - Changes from version 2.10.6: + Fix a deadlock in the Web Process when JavaScript garbage collector was running for a web worker thread that made google maps to hang. + Fix media controls displaying without controls attribute. + Fix a Web Process crash when quickly attempting many DnD operations. - Changes from version 2.10.5: + Disable DNS prefetch when a proxy is configured. + Reduce the maximum simultaneous network connections to match other browsers. + Make WebKitWebView always propagate motion-notify-event signal. + Add a way to force accelerating compositing mode at runtime using an environment variable. + Fix input elements and scrollbars rendering with GTK+ 3.19. + Fix rendering of lines when using solid colors. + Fix UI process crashes related to not having a main resource response when the load is committed for pages restored from the history cache. + Fix a WebProcess crash when loading large contents with custom URI schemes API. + Fix a crash in the UI process when the WebView is destroyed while the screensaver DBus proxy is being created. + Fix WebProcess crashes due to BadDrawable X errors in accelerated compositing mode. + Fix crashes on PPC64 due to mprotect() on address not aligned to the page size. + Fix std::bad_function_call exception raised in dispatchDecidePolicyForNavigationAction. + Fix downloads of data URLs. + Fix runtime critical warnings when closing a page containing windowed plugins. + Fix several crashes and rendering issues. + Translation updates: French, German, Italian, Turkish. + Security fixes: CVE-2015-7096, CVE-2015-7098. - Update to version 2.10.4, notable changes: + New HTTP disk cache for the Network Process. + New Web Inspector UI. + Automatic ScreenServer inhibition when playing fullscreen videos. + Initial Editor API. + Performance improvements. - This update addresses the following security issues: CVE-2015-1122, CVE-2015-1152, CVE-2015-1155, CVE-2015-3660, CVE-2015-3730, CVE-2015-3738, CVE-2015-3740, CVE-2015-3742, CVE-2015-3744, CVE-2015-3746, CVE-2015-3750, CVE-2015-3751, CVE-2015-3754, CVE-2015-3755, CVE-2015-5804, CVE-2015-5805, CVE-2015-5807, CVE-2015-5810, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5817, CVE-2015-5818, CVE-2015-5825, CVE-2015-5827, CVE-2015-5828, CVE-2015-5929, CVE-2015-5930, CVE-2015-5931, CVE-2015-7002, CVE-2015-7013, CVE-2015-7014, CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7099, CVE-2015-7100, CVE-2015-7102, CVE-2015-7103, CVE-2015-7104 - Add BuildRequires: hyphen-devel to pick up hyphenation support. Note this is broken upstream. - Build with -DENABLE_DATABASE_PROCESS=OFF and -DENABLE_INDEXED_DATABASE=OFF to avoid an issue with GCC 4.8. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-340=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.10.7-7.1 libjavascriptcoregtk-4_0-18-debuginfo-2.10.7-7.1 libwebkit2gtk-4_0-37-2.10.7-7.1 libwebkit2gtk-4_0-37-debuginfo-2.10.7-7.1 typelib-1_0-JavaScriptCore-4_0-2.10.7-7.1 typelib-1_0-WebKit2-4_0-2.10.7-7.1 typelib-1_0-WebKit2WebExtension-4_0-2.10.7-7.1 webkit-jsc-4-2.10.7-7.1 webkit-jsc-4-debuginfo-2.10.7-7.1 webkit2gtk-4_0-injected-bundles-2.10.7-7.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.10.7-7.1 webkit2gtk3-debugsource-2.10.7-7.1 webkit2gtk3-devel-2.10.7-7.1 - openSUSE Leap 42.1 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.10.7-7.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.10.7-7.1 libwebkit2gtk-4_0-37-32bit-2.10.7-7.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.10.7-7.1 - openSUSE Leap 42.1 (noarch): libwebkit2gtk3-lang-2.10.7-7.1 References: https://www.suse.com/security/cve/CVE-2015-1122.html https://www.suse.com/security/cve/CVE-2015-1152.html https://www.suse.com/security/cve/CVE-2015-1155.html https://www.suse.com/security/cve/CVE-2015-3660.html https://www.suse.com/security/cve/CVE-2015-3730.html https://www.suse.com/security/cve/CVE-2015-3738.html https://www.suse.com/security/cve/CVE-2015-3740.html https://www.suse.com/security/cve/CVE-2015-3742.html https://www.suse.com/security/cve/CVE-2015-3744.html https://www.suse.com/security/cve/CVE-2015-3746.html https://www.suse.com/security/cve/CVE-2015-3750.html https://www.suse.com/security/cve/CVE-2015-3751.html https://www.suse.com/security/cve/CVE-2015-3754.html https://www.suse.com/security/cve/CVE-2015-3755.html https://www.suse.com/security/cve/CVE-2015-5804.html https://www.suse.com/security/cve/CVE-2015-5805.html https://www.suse.com/security/cve/CVE-2015-5807.html https://www.suse.com/security/cve/CVE-2015-5810.html https://www.suse.com/security/cve/CVE-2015-5813.html https://www.suse.com/security/cve/CVE-2015-5814.html https://www.suse.com/security/cve/CVE-2015-5815.html https://www.suse.com/security/cve/CVE-2015-5817.html https://www.suse.com/security/cve/CVE-2015-5818.html https://www.suse.com/security/cve/CVE-2015-5825.html https://www.suse.com/security/cve/CVE-2015-5827.html https://www.suse.com/security/cve/CVE-2015-5828.html https://www.suse.com/security/cve/CVE-2015-5929.html https://www.suse.com/security/cve/CVE-2015-5930.html https://www.suse.com/security/cve/CVE-2015-5931.html https://www.suse.com/security/cve/CVE-2015-7002.html https://www.suse.com/security/cve/CVE-2015-7013.html https://www.suse.com/security/cve/CVE-2015-7014.html https://www.suse.com/security/cve/CVE-2015-7048.html https://www.suse.com/security/cve/CVE-2015-7095.html https://www.suse.com/security/cve/CVE-2015-7096.html https://www.suse.com/security/cve/CVE-2015-7097.html https://www.suse.com/security/cve/CVE-2015-7098.html https://www.suse.com/security/cve/CVE-2015-7099.html https://www.suse.com/security/cve/CVE-2015-7100.html https://www.suse.com/security/cve/CVE-2015-7102.html https://www.suse.com/security/cve/CVE-2015-7103.html https://www.suse.com/security/cve/CVE-2015-7104.html

1 0

openSUSE-RU-2016:0737-1: moderate: Recommended update for xdm
by maintenance＠opensuse.org 14 Mar '16

14 Mar '16

openSUSE Recommended Update: Recommended update for xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0737-1 Rating: moderate References: #967002 #968172 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue: * boo#968172: ~/.gnupg error in ~/.xsession-errors-:0, regression from boo#967002 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-338=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-338=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xdm-1.1.11-7.1 xdm-debuginfo-1.1.11-7.1 xdm-debugsource-1.1.11-7.1 - openSUSE 13.2 (i586 x86_64): xdm-1.1.11-3.17.1 xdm-debuginfo-1.1.11-3.17.1 xdm-debugsource-1.1.11-3.17.1 References: https://bugzilla.suse.com/967002 https://bugzilla.suse.com/968172

1 0

openSUSE-RU-2016:0736-1: Recommended update for spec-cleaner
by maintenance＠opensuse.org 14 Mar '16

14 Mar '16

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0736-1 Rating: low References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update to spec-cleaner 0.7.9 fixes the following issues: * Fix bug in %if detection if it was curlified * Add one more case of RPM_BUILD_ROOT replacement * Detect wrong Group values and suggest correct ones Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-337=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-337=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): spec-cleaner-0.7.9-9.1 spec-cleaner-format_spec_file-0.7.9-9.1 - openSUSE 13.2 (noarch): spec-cleaner-0.7.9-31.1 spec-cleaner-format_spec_file-0.7.9-31.1 References:

1 0

openSUSE-RU-2016:0735-1: Recommended update for spice-gtk
by maintenance＠opensuse.org 14 Mar '16

14 Mar '16

openSUSE Recommended Update: Recommended update for spice-gtk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0735-1 Rating: low References: #958306 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spice-gtk fixes the following issues: - When the audio backend is not initialized correctly or there isn't audio in the VM, don't try to sync the volume. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-336=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libspice-client-glib-2_0-8-0.29-7.1 libspice-client-glib-2_0-8-debuginfo-0.29-7.1 libspice-client-gtk-2_0-4-0.29-7.1 libspice-client-gtk-2_0-4-debuginfo-0.29-7.1 libspice-client-gtk-3_0-4-0.29-7.1 libspice-client-gtk-3_0-4-debuginfo-0.29-7.1 libspice-controller0-0.29-7.1 libspice-controller0-debuginfo-0.29-7.1 python-SpiceClientGtk-0.29-7.1 python-SpiceClientGtk-debuginfo-0.29-7.1 spice-gtk-0.29-7.1 spice-gtk-debuginfo-0.29-7.1 spice-gtk-debugsource-0.29-7.1 spice-gtk-devel-0.29-7.1 typelib-1_0-SpiceClientGlib-2_0-0.29-7.1 typelib-1_0-SpiceClientGtk-2_0-0.29-7.1 typelib-1_0-SpiceClientGtk-3_0-0.29-7.1 - openSUSE Leap 42.1 (noarch): spice-gtk-lang-0.29-7.1 References: https://bugzilla.suse.com/958306

1 0

openSUSE-SU-2016:0734-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 12 Mar '16

12 Mar '16

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0734-1 Rating: important References: #970547 Cross-References: CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. (boo#970547) * APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005, CVE-2016-1010 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-335=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.577-156.1 flash-player-gnome-11.2.202.577-156.1 flash-player-kde4-11.2.202.577-156.1 References: https://www.suse.com/security/cve/CVE-2016-0960.html https://www.suse.com/security/cve/CVE-2016-0961.html https://www.suse.com/security/cve/CVE-2016-0962.html https://www.suse.com/security/cve/CVE-2016-0963.html https://www.suse.com/security/cve/CVE-2016-0986.html https://www.suse.com/security/cve/CVE-2016-0987.html https://www.suse.com/security/cve/CVE-2016-0988.html https://www.suse.com/security/cve/CVE-2016-0989.html https://www.suse.com/security/cve/CVE-2016-0990.html https://www.suse.com/security/cve/CVE-2016-0991.html https://www.suse.com/security/cve/CVE-2016-0992.html https://www.suse.com/security/cve/CVE-2016-0993.html https://www.suse.com/security/cve/CVE-2016-0994.html https://www.suse.com/security/cve/CVE-2016-0995.html https://www.suse.com/security/cve/CVE-2016-0996.html https://www.suse.com/security/cve/CVE-2016-0997.html https://www.suse.com/security/cve/CVE-2016-0998.html https://www.suse.com/security/cve/CVE-2016-0999.html https://www.suse.com/security/cve/CVE-2016-1000.html https://www.suse.com/security/cve/CVE-2016-1001.html https://www.suse.com/security/cve/CVE-2016-1002.html https://www.suse.com/security/cve/CVE-2016-1005.html https://www.suse.com/security/cve/CVE-2016-1010.html https://bugzilla.suse.com/970547

1 0

openSUSE-SU-2016:0733-1: important: Security update for Firefox
by opensuse-security＠opensuse.org 12 Mar '16

12 Mar '16

openSUSE Security Update: Security update for Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0733-1 Rating: important References: #969894 Cross-References: CVE-2016-1950 CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1958 CVE-2016-1959 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1963 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1967 CVE-2016-1968 CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1973 CVE-2016-1974 CVE-2016-1975 CVE-2016-1976 CVE-2016-1977 CVE-2016-1979 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 40 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues: MozillaFirefox was updated to Firefox 45.0 (boo#969894) * requires NSPR 4.12 / NSS 3.21.1 * Instant browser tab sharing through Hello * Synced Tabs button in button bar * Tabs synced via Firefox Accounts from other devices are now shown in dropdown area of Awesome Bar when searching * Introduce a new preference (network.dns.blockDotOnion) to allow blocking .onion at the DNS level * Tab Groups (Panorama) feature removed * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-18/CVE-2016-1955 (bmo#1208946) CSP reports fail to strip location information for embedded iframe pages * MFSA 2016-19/CVE-2016-1956 (bmo#1199923) Linux video memory DOS with Intel drivers * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-22/CVE-2016-1959 (bmo#1234949) Service Worker Manager out-of-bounds read in Service Worker Manager * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-26/CVE-2016-1963 (bmo#1238440) Memory corruption when modifying a file being read by FileReader * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-29/CVE-2016-1967 (bmo#1246956) Same-origin policy violation using perfomance.getEntries and history navigation with session restore * MFSA 2016-30/CVE-2016-1968 (bmo#1246742) Buffer overflow in Brotli decompression * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/ CVE-2016-1976/CVE-2016-1972 WebRTC and LibVPX vulnerabilities found through code inspection * MFSA 2016-33/CVE-2016-1973 (bmo#1219339) Use-after-free in GetStaticInstance in WebRTC * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library mozilla-nspr was updated to version 4.12 * added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code. * fixed a memory allocation bug related to the PR_*printf functions * exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9 * added support for FreeBSD aarch64 * several minor correctness and compatibility fixes mozilla-nss was updated to NSS 3.21.1 (bmo#969894) * required for Firefox 45.0 * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-334=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-45.0-109.1 MozillaFirefox-branding-upstream-45.0-109.1 MozillaFirefox-buildsymbols-45.0-109.1 MozillaFirefox-debuginfo-45.0-109.1 MozillaFirefox-debugsource-45.0-109.1 MozillaFirefox-devel-45.0-109.1 MozillaFirefox-translations-common-45.0-109.1 MozillaFirefox-translations-other-45.0-109.1 libfreebl3-3.21.1-74.1 libfreebl3-debuginfo-3.21.1-74.1 libsoftokn3-3.21.1-74.1 libsoftokn3-debuginfo-3.21.1-74.1 mozilla-nspr-4.12-34.1 mozilla-nspr-debuginfo-4.12-34.1 mozilla-nspr-debugsource-4.12-34.1 mozilla-nspr-devel-4.12-34.1 mozilla-nss-3.21.1-74.1 mozilla-nss-certs-3.21.1-74.1 mozilla-nss-certs-debuginfo-3.21.1-74.1 mozilla-nss-debuginfo-3.21.1-74.1 mozilla-nss-debugsource-3.21.1-74.1 mozilla-nss-devel-3.21.1-74.1 mozilla-nss-sysinit-3.21.1-74.1 mozilla-nss-sysinit-debuginfo-3.21.1-74.1 mozilla-nss-tools-3.21.1-74.1 mozilla-nss-tools-debuginfo-3.21.1-74.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.21.1-74.1 libfreebl3-debuginfo-32bit-3.21.1-74.1 libsoftokn3-32bit-3.21.1-74.1 libsoftokn3-debuginfo-32bit-3.21.1-74.1 mozilla-nspr-32bit-4.12-34.1 mozilla-nspr-debuginfo-32bit-4.12-34.1 mozilla-nss-32bit-3.21.1-74.1 mozilla-nss-certs-32bit-3.21.1-74.1 mozilla-nss-certs-debuginfo-32bit-3.21.1-74.1 mozilla-nss-debuginfo-32bit-3.21.1-74.1 mozilla-nss-sysinit-32bit-3.21.1-74.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.1-74.1 References: https://www.suse.com/security/cve/CVE-2016-1950.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1955.html https://www.suse.com/security/cve/CVE-2016-1956.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1959.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1963.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1967.html https://www.suse.com/security/cve/CVE-2016-1968.html https://www.suse.com/security/cve/CVE-2016-1970.html https://www.suse.com/security/cve/CVE-2016-1971.html https://www.suse.com/security/cve/CVE-2016-1972.html https://www.suse.com/security/cve/CVE-2016-1973.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1975.html https://www.suse.com/security/cve/CVE-2016-1976.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-1979.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894

1 0

openSUSE-SU-2016:0732-1: important: Security update for libotr,libotr2
by opensuse-security＠opensuse.org 12 Mar '16

12 Mar '16

openSUSE Security Update: Security update for libotr,libotr2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0732-1 Rating: important References: #969785 Cross-References: CVE-2016-2851 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libotr and libotr2 were updated to fix one security issue: - CVE-2016-2851: Integer overflow vulnerability allowed remote attackers to execute arbitrary code on 64 bit platforms (boo#969785) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-333=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libotr-debugsource-4.0.0-5.7.1 libotr-devel-4.0.0-5.7.1 libotr-tools-4.0.0-5.7.1 libotr-tools-debuginfo-4.0.0-5.7.1 libotr2-3.2.1-5.3.1 libotr2-debuginfo-3.2.1-5.3.1 libotr2-debugsource-3.2.1-5.3.1 libotr2-devel-3.2.1-5.3.1 libotr2-tools-3.2.1-5.3.1 libotr2-tools-debuginfo-3.2.1-5.3.1 libotr5-4.0.0-5.7.1 libotr5-debuginfo-4.0.0-5.7.1 References: https://www.suse.com/security/cve/CVE-2016-2851.html https://bugzilla.suse.com/969785

1 0

openSUSE-SU-2016:0731-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0731-1 Rating: important References: #969894 Cross-References: CVE-2016-1950 CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1958 CVE-2016-1959 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1963 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1967 CVE-2016-1968 CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1973 CVE-2016-1974 CVE-2016-1975 CVE-2016-1976 CVE-2016-1977 CVE-2016-1979 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 40 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues: MozillaFirefox was updated to Firefox 45.0 (boo#969894) * requires NSPR 4.12 / NSS 3.21.1 * Instant browser tab sharing through Hello * Synced Tabs button in button bar * Tabs synced via Firefox Accounts from other devices are now shown in dropdown area of Awesome Bar when searching * Introduce a new preference (network.dns.blockDotOnion) to allow blocking .onion at the DNS level * Tab Groups (Panorama) feature removed * MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-18/CVE-2016-1955 (bmo#1208946) CSP reports fail to strip location information for embedded iframe pages * MFSA 2016-19/CVE-2016-1956 (bmo#1199923) Linux video memory DOS with Intel drivers * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-22/CVE-2016-1959 (bmo#1234949) Service Worker Manager out-of-bounds read in Service Worker Manager * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-26/CVE-2016-1963 (bmo#1238440) Memory corruption when modifying a file being read by FileReader * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-29/CVE-2016-1967 (bmo#1246956) Same-origin policy violation using perfomance.getEntries and history navigation with session restore * MFSA 2016-30/CVE-2016-1968 (bmo#1246742) Buffer overflow in Brotli decompression * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/ CVE-2016-1976/CVE-2016-1972 WebRTC and LibVPX vulnerabilities found through code inspection * MFSA 2016-33/CVE-2016-1973 (bmo#1219339) Use-after-free in GetStaticInstance in WebRTC * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library mozilla-nspr was updated to version 4.12 * added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code. * fixed a memory allocation bug related to the PR_*printf functions * exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9 * added support for FreeBSD aarch64 * several minor correctness and compatibility fixes mozilla-nss was updated to NSS 3.21.1 (bmo#969894) * required for Firefox 45.0 * MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1 decoding in NSS (fixed by requiring 3.21.1) * MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during processing of DER encoded keys in NSS (fixed by requiring 3.21.1) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-332=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-332=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-45.0-18.1 MozillaFirefox-branding-upstream-45.0-18.1 MozillaFirefox-buildsymbols-45.0-18.1 MozillaFirefox-debuginfo-45.0-18.1 MozillaFirefox-debugsource-45.0-18.1 MozillaFirefox-devel-45.0-18.1 MozillaFirefox-translations-common-45.0-18.1 MozillaFirefox-translations-other-45.0-18.1 libfreebl3-3.21.1-12.1 libfreebl3-debuginfo-3.21.1-12.1 libsoftokn3-3.21.1-12.1 libsoftokn3-debuginfo-3.21.1-12.1 mozilla-nspr-4.12-10.1 mozilla-nspr-debuginfo-4.12-10.1 mozilla-nspr-debugsource-4.12-10.1 mozilla-nspr-devel-4.12-10.1 mozilla-nss-3.21.1-12.1 mozilla-nss-certs-3.21.1-12.1 mozilla-nss-certs-debuginfo-3.21.1-12.1 mozilla-nss-debuginfo-3.21.1-12.1 mozilla-nss-debugsource-3.21.1-12.1 mozilla-nss-devel-3.21.1-12.1 mozilla-nss-sysinit-3.21.1-12.1 mozilla-nss-sysinit-debuginfo-3.21.1-12.1 mozilla-nss-tools-3.21.1-12.1 mozilla-nss-tools-debuginfo-3.21.1-12.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.21.1-12.1 libfreebl3-debuginfo-32bit-3.21.1-12.1 libsoftokn3-32bit-3.21.1-12.1 libsoftokn3-debuginfo-32bit-3.21.1-12.1 mozilla-nspr-32bit-4.12-10.1 mozilla-nspr-debuginfo-32bit-4.12-10.1 mozilla-nss-32bit-3.21.1-12.1 mozilla-nss-certs-32bit-3.21.1-12.1 mozilla-nss-certs-debuginfo-32bit-3.21.1-12.1 mozilla-nss-debuginfo-32bit-3.21.1-12.1 mozilla-nss-sysinit-32bit-3.21.1-12.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.1-12.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-45.0-65.1 MozillaFirefox-branding-upstream-45.0-65.1 MozillaFirefox-buildsymbols-45.0-65.1 MozillaFirefox-debuginfo-45.0-65.1 MozillaFirefox-debugsource-45.0-65.1 MozillaFirefox-devel-45.0-65.1 MozillaFirefox-translations-common-45.0-65.1 MozillaFirefox-translations-other-45.0-65.1 libfreebl3-3.21.1-28.1 libfreebl3-debuginfo-3.21.1-28.1 libsoftokn3-3.21.1-28.1 libsoftokn3-debuginfo-3.21.1-28.1 mozilla-nspr-4.12-15.1 mozilla-nspr-debuginfo-4.12-15.1 mozilla-nspr-debugsource-4.12-15.1 mozilla-nspr-devel-4.12-15.1 mozilla-nss-3.21.1-28.1 mozilla-nss-certs-3.21.1-28.1 mozilla-nss-certs-debuginfo-3.21.1-28.1 mozilla-nss-debuginfo-3.21.1-28.1 mozilla-nss-debugsource-3.21.1-28.1 mozilla-nss-devel-3.21.1-28.1 mozilla-nss-sysinit-3.21.1-28.1 mozilla-nss-sysinit-debuginfo-3.21.1-28.1 mozilla-nss-tools-3.21.1-28.1 mozilla-nss-tools-debuginfo-3.21.1-28.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.21.1-28.1 libfreebl3-debuginfo-32bit-3.21.1-28.1 libsoftokn3-32bit-3.21.1-28.1 libsoftokn3-debuginfo-32bit-3.21.1-28.1 mozilla-nspr-32bit-4.12-15.1 mozilla-nspr-debuginfo-32bit-4.12-15.1 mozilla-nss-32bit-3.21.1-28.1 mozilla-nss-certs-32bit-3.21.1-28.1 mozilla-nss-certs-debuginfo-32bit-3.21.1-28.1 mozilla-nss-debuginfo-32bit-3.21.1-28.1 mozilla-nss-sysinit-32bit-3.21.1-28.1 mozilla-nss-sysinit-debuginfo-32bit-3.21.1-28.1 References: https://www.suse.com/security/cve/CVE-2016-1950.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1955.html https://www.suse.com/security/cve/CVE-2016-1956.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1959.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1963.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1967.html https://www.suse.com/security/cve/CVE-2016-1968.html https://www.suse.com/security/cve/CVE-2016-1970.html https://www.suse.com/security/cve/CVE-2016-1971.html https://www.suse.com/security/cve/CVE-2016-1972.html https://www.suse.com/security/cve/CVE-2016-1973.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1975.html https://www.suse.com/security/cve/CVE-2016-1976.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-1979.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894

1 0

openSUSE-RU-2016:0730-1: moderate: Recommended update for fate
by maintenance＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0730-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for fate fixes the following issues: - update to version 1.5.5.4 * prioritytable: reenable editing of requester prio by himself Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-331=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): fate-1.5.5.4-9.1 fate-debuginfo-1.5.5.4-9.1 fate-debugsource-1.5.5.4-9.1 References:

1 0

openSUSE-SU-2016:0729-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0729-1 Rating: important References: #969333 Cross-References: CVE-2015-8126 CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333) - CVE-2016-1630: Same-origin bypass in Blink - CVE-2016-1631: Same-origin bypass in Pepper Plugin - CVE-2016-1632: Bad cast in Extensions - CVE-2016-1633: Use-after-free in Blink - CVE-2016-1634: Use-after-free in Blink - CVE-2016-1635: Use-after-free in Blink - CVE-2016-1636: SRI Validation Bypass - CVE-2015-8126: Out-of-bounds access in libpng - CVE-2016-1637: Information Leak in Skia - CVE-2016-1638: WebAPI Bypass - CVE-2016-1639: Use-after-free in WebRTC - CVE-2016-1640: Origin confusion in Extensions UI - CVE-2016-1641: Use-after-free in Favicon - CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch (currently 4.9.385.26) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-330=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-49.0.2623.75-81.2 chromedriver-debuginfo-49.0.2623.75-81.2 chromium-49.0.2623.75-81.2 chromium-debuginfo-49.0.2623.75-81.2 chromium-debugsource-49.0.2623.75-81.2 chromium-desktop-gnome-49.0.2623.75-81.2 chromium-desktop-kde-49.0.2623.75-81.2 chromium-ffmpegsumo-49.0.2623.75-81.2 chromium-ffmpegsumo-debuginfo-49.0.2623.75-81.2 References: https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2016-1630.html https://www.suse.com/security/cve/CVE-2016-1631.html https://www.suse.com/security/cve/CVE-2016-1632.html https://www.suse.com/security/cve/CVE-2016-1633.html https://www.suse.com/security/cve/CVE-2016-1634.html https://www.suse.com/security/cve/CVE-2016-1635.html https://www.suse.com/security/cve/CVE-2016-1636.html https://www.suse.com/security/cve/CVE-2016-1637.html https://www.suse.com/security/cve/CVE-2016-1638.html https://www.suse.com/security/cve/CVE-2016-1639.html https://www.suse.com/security/cve/CVE-2016-1640.html https://www.suse.com/security/cve/CVE-2016-1641.html https://www.suse.com/security/cve/CVE-2016-1642.html https://bugzilla.suse.com/969333

1 0

openSUSE-RU-2016:0724-1: moderate: Softwarestack update
by maintenance＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Recommended Update: Softwarestack update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0724-1 Rating: moderate References: #889363 #953214 #955801 #956443 #957606 #961738 #966760 #967673 #968006 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update contains bug fixes for the software management stack. The following issues were fixed: zypper: - boo#967673: Zypper export/import was not honoring autorefresh flag - boo#968006: Zypper returned non-success error code even when installation/patching succeeds - boo#966760: Error in addlock man page header - boo#953214: typo in man page () libsolv: - boo#961738: Issue with rule generation for linked packages - boo#957606: fix issues with multiversion orphan handling - bnc#956443: conflict on *-release packages on SP1 migration libzypp: - media: Send stats header to download.opensuse.org only (boo#955801) - rebuild to satisfy dependencies zypp-plugin: - boo#889363: Zypper failed when custom version of Python is additionally installed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-329=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsolv-debugsource-0.6.19-20.1 libsolv-demo-0.6.19-20.1 libsolv-demo-debuginfo-0.6.19-20.1 libsolv-devel-0.6.19-20.1 libsolv-devel-debuginfo-0.6.19-20.1 libsolv-tools-0.6.19-20.1 libsolv-tools-debuginfo-0.6.19-20.1 libzypp-14.42.4-36.1 libzypp-debuginfo-14.42.4-36.1 libzypp-debugsource-14.42.4-36.1 libzypp-devel-14.42.4-36.1 libzypp-devel-doc-14.42.4-36.1 perl-solv-0.6.19-20.1 perl-solv-debuginfo-0.6.19-20.1 python-solv-0.6.19-20.1 python-solv-debuginfo-0.6.19-20.1 ruby-solv-0.6.19-20.1 ruby-solv-debuginfo-0.6.19-20.1 zypp-plugin-python-0.5-2.3.1 zypper-1.11.51-37.2 zypper-debuginfo-1.11.51-37.2 zypper-debugsource-1.11.51-37.2 - openSUSE 13.2 (noarch): zypper-aptitude-1.11.51-37.2 zypper-log-1.11.51-37.2 References: https://bugzilla.suse.com/889363 https://bugzilla.suse.com/953214 https://bugzilla.suse.com/955801 https://bugzilla.suse.com/956443 https://bugzilla.suse.com/957606 https://bugzilla.suse.com/961738 https://bugzilla.suse.com/966760 https://bugzilla.suse.com/967673 https://bugzilla.suse.com/968006

1 0

openSUSE-SU-2016:0722-1: moderate: Security update for libssh
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0722-1 Rating: moderate References: #965875 Cross-References: CVE-2016-0739 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2016-0739: Fix Weakness in diffie-hellman secret key generation. (bsc#965875) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-328=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libssh-debugsource-0.6.3-10.1 libssh-devel-0.6.3-10.1 libssh-devel-doc-0.6.3-10.1 libssh4-0.6.3-10.1 libssh4-debuginfo-0.6.3-10.1 - openSUSE Leap 42.1 (x86_64): libssh4-32bit-0.6.3-10.1 libssh4-debuginfo-32bit-0.6.3-10.1 References: https://www.suse.com/security/cve/CVE-2016-0739.html https://bugzilla.suse.com/965875

1 0

openSUSE-SU-2016:0721-1: important: Security update for exim
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0721-1 Rating: important References: #968844 Cross-References: CVE-2016-1531 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to exim 4.86.2 fixes the following issues: * CVE-2016-1531: local privilege escalation for set-uid root exim when using 'perl_startup' (boo#968844) Important: Exim now cleans the complete execution environment by default. This affects Exim and subprocesses such as transports calling other programs. The following new options are supported to adjust this behaviour: * keep_environment * add_environment A warning will be printed upon startup if none of these are configured. Also includes upstream changes, improvements and bug fixes: * Support for using the system standard CA bundle. * New expansion items $config_file, $config_dir, containing the file and directory name of the main configuration file. Also $exim_version. * New "malware=" support for Avast. * New "spam=" variant option for Rspamd. * Assorted options on malware= and spam= scanners. * A commandline option to write a comment into the logfile. * A logging option for slow DNS lookups. * New ${env {<variable>}} expansion. * A non-SMTP authenticator using information from TLS client certificates. * Main option "tls_eccurve" for selecting an Elliptic Curve for TLS. * Main option "dns_trust_aa" for trusting your local nameserver at the same level as DNSSEC. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-326=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-326=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): exim-4.86.2-8.1 exim-debuginfo-4.86.2-8.1 exim-debugsource-4.86.2-8.1 eximon-4.86.2-8.1 eximon-debuginfo-4.86.2-8.1 eximstats-html-4.86.2-8.1 - openSUSE 13.2 (i586 x86_64): exim-4.86.2-3.10.1 exim-debuginfo-4.86.2-3.10.1 exim-debugsource-4.86.2-3.10.1 eximon-4.86.2-3.10.1 eximon-debuginfo-4.86.2-3.10.1 eximstats-html-4.86.2-3.10.1 References: https://www.suse.com/security/cve/CVE-2016-1531.html https://bugzilla.suse.com/968844

1 0

openSUSE-SU-2016:0720-1: important: Security update for openssl
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0720-1 Rating: important References: #952871 #963415 #968046 #968048 #968051 #968053 #968374 Cross-References: CVE-2015-3197 CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for compat-openssl098 fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Also fixes the following bug: - Avoid running OPENSSL_config twice. This avoids breaking engine loading and also fixes a memory leak in libssl. (bsc#952871) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-327=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-9.1 libopenssl0_9_8-0.9.8j-9.1 libopenssl0_9_8-debuginfo-0.9.8j-9.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-9.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-9.1 References: https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0703.html https://www.suse.com/security/cve/CVE-2016-0704.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/952871 https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968051 https://bugzilla.suse.com/968053 https://bugzilla.suse.com/968374

1 0

openSUSE-SU-2016:0719-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0719-1 Rating: important References: #970547 Cross-References: CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. (boo#970547) * APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005, CVE-2016-1010 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-325=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.577-2.91.1 flash-player-gnome-11.2.202.577-2.91.1 flash-player-kde4-11.2.202.577-2.91.1 References: https://www.suse.com/security/cve/CVE-2016-0960.html https://www.suse.com/security/cve/CVE-2016-0961.html https://www.suse.com/security/cve/CVE-2016-0962.html https://www.suse.com/security/cve/CVE-2016-0963.html https://www.suse.com/security/cve/CVE-2016-0986.html https://www.suse.com/security/cve/CVE-2016-0987.html https://www.suse.com/security/cve/CVE-2016-0988.html https://www.suse.com/security/cve/CVE-2016-0989.html https://www.suse.com/security/cve/CVE-2016-0990.html https://www.suse.com/security/cve/CVE-2016-0991.html https://www.suse.com/security/cve/CVE-2016-0992.html https://www.suse.com/security/cve/CVE-2016-0993.html https://www.suse.com/security/cve/CVE-2016-0994.html https://www.suse.com/security/cve/CVE-2016-0995.html https://www.suse.com/security/cve/CVE-2016-0996.html https://www.suse.com/security/cve/CVE-2016-0997.html https://www.suse.com/security/cve/CVE-2016-0998.html https://www.suse.com/security/cve/CVE-2016-0999.html https://www.suse.com/security/cve/CVE-2016-1000.html https://www.suse.com/security/cve/CVE-2016-1001.html https://www.suse.com/security/cve/CVE-2016-1002.html https://www.suse.com/security/cve/CVE-2016-1005.html https://www.suse.com/security/cve/CVE-2016-1010.html https://bugzilla.suse.com/970547

1 0

openSUSE-SU-2016:0710-1: moderate: Security update for OpenVPN
by opensuse-security＠opensuse.org 10 Mar '16

10 Mar '16

openSUSE Security Update: Security update for OpenVPN ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0710-1 Rating: moderate References: #934237 #959714 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for OpenVPN fixes the following vulnerabilities: * boo#959714: heap overflow on read accessing getaddrinfo result * boo#934237: multiple low severity issues Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-324=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): openvpn-2.3.4-2.10.1 openvpn-auth-pam-plugin-2.3.4-2.10.1 openvpn-auth-pam-plugin-debuginfo-2.3.4-2.10.1 openvpn-debuginfo-2.3.4-2.10.1 openvpn-debugsource-2.3.4-2.10.1 openvpn-down-root-plugin-2.3.4-2.10.1 openvpn-down-root-plugin-debuginfo-2.3.4-2.10.1 References: https://bugzilla.suse.com/934237 https://bugzilla.suse.com/959714

1 0

openSUSE-SU-2016:0709-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 10 Mar '16

10 Mar '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0709-1 Rating: moderate References: #968284 Cross-References: CVE-2016-2554 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: * CVE-2016-2554: A stack overflow vulnerability when decompressing tar phar archives was fixed. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-323=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-42.2 apache2-mod_php5-debuginfo-5.6.1-42.2 php5-5.6.1-42.2 php5-bcmath-5.6.1-42.2 php5-bcmath-debuginfo-5.6.1-42.2 php5-bz2-5.6.1-42.2 php5-bz2-debuginfo-5.6.1-42.2 php5-calendar-5.6.1-42.2 php5-calendar-debuginfo-5.6.1-42.2 php5-ctype-5.6.1-42.2 php5-ctype-debuginfo-5.6.1-42.2 php5-curl-5.6.1-42.2 php5-curl-debuginfo-5.6.1-42.2 php5-dba-5.6.1-42.2 php5-dba-debuginfo-5.6.1-42.2 php5-debuginfo-5.6.1-42.2 php5-debugsource-5.6.1-42.2 php5-devel-5.6.1-42.2 php5-dom-5.6.1-42.2 php5-dom-debuginfo-5.6.1-42.2 php5-enchant-5.6.1-42.2 php5-enchant-debuginfo-5.6.1-42.2 php5-exif-5.6.1-42.2 php5-exif-debuginfo-5.6.1-42.2 php5-fastcgi-5.6.1-42.2 php5-fastcgi-debuginfo-5.6.1-42.2 php5-fileinfo-5.6.1-42.2 php5-fileinfo-debuginfo-5.6.1-42.2 php5-firebird-5.6.1-42.2 php5-firebird-debuginfo-5.6.1-42.2 php5-fpm-5.6.1-42.2 php5-fpm-debuginfo-5.6.1-42.2 php5-ftp-5.6.1-42.2 php5-ftp-debuginfo-5.6.1-42.2 php5-gd-5.6.1-42.2 php5-gd-debuginfo-5.6.1-42.2 php5-gettext-5.6.1-42.2 php5-gettext-debuginfo-5.6.1-42.2 php5-gmp-5.6.1-42.2 php5-gmp-debuginfo-5.6.1-42.2 php5-iconv-5.6.1-42.2 php5-iconv-debuginfo-5.6.1-42.2 php5-imap-5.6.1-42.2 php5-imap-debuginfo-5.6.1-42.2 php5-intl-5.6.1-42.2 php5-intl-debuginfo-5.6.1-42.2 php5-json-5.6.1-42.2 php5-json-debuginfo-5.6.1-42.2 php5-ldap-5.6.1-42.2 php5-ldap-debuginfo-5.6.1-42.2 php5-mbstring-5.6.1-42.2 php5-mbstring-debuginfo-5.6.1-42.2 php5-mcrypt-5.6.1-42.2 php5-mcrypt-debuginfo-5.6.1-42.2 php5-mssql-5.6.1-42.2 php5-mssql-debuginfo-5.6.1-42.2 php5-mysql-5.6.1-42.2 php5-mysql-debuginfo-5.6.1-42.2 php5-odbc-5.6.1-42.2 php5-odbc-debuginfo-5.6.1-42.2 php5-opcache-5.6.1-42.2 php5-opcache-debuginfo-5.6.1-42.2 php5-openssl-5.6.1-42.2 php5-openssl-debuginfo-5.6.1-42.2 php5-pcntl-5.6.1-42.2 php5-pcntl-debuginfo-5.6.1-42.2 php5-pdo-5.6.1-42.2 php5-pdo-debuginfo-5.6.1-42.2 php5-pgsql-5.6.1-42.2 php5-pgsql-debuginfo-5.6.1-42.2 php5-phar-5.6.1-42.2 php5-phar-debuginfo-5.6.1-42.2 php5-posix-5.6.1-42.2 php5-posix-debuginfo-5.6.1-42.2 php5-pspell-5.6.1-42.2 php5-pspell-debuginfo-5.6.1-42.2 php5-readline-5.6.1-42.2 php5-readline-debuginfo-5.6.1-42.2 php5-shmop-5.6.1-42.2 php5-shmop-debuginfo-5.6.1-42.2 php5-snmp-5.6.1-42.2 php5-snmp-debuginfo-5.6.1-42.2 php5-soap-5.6.1-42.2 php5-soap-debuginfo-5.6.1-42.2 php5-sockets-5.6.1-42.2 php5-sockets-debuginfo-5.6.1-42.2 php5-sqlite-5.6.1-42.2 php5-sqlite-debuginfo-5.6.1-42.2 php5-suhosin-5.6.1-42.2 php5-suhosin-debuginfo-5.6.1-42.2 php5-sysvmsg-5.6.1-42.2 php5-sysvmsg-debuginfo-5.6.1-42.2 php5-sysvsem-5.6.1-42.2 php5-sysvsem-debuginfo-5.6.1-42.2 php5-sysvshm-5.6.1-42.2 php5-sysvshm-debuginfo-5.6.1-42.2 php5-tidy-5.6.1-42.2 php5-tidy-debuginfo-5.6.1-42.2 php5-tokenizer-5.6.1-42.2 php5-tokenizer-debuginfo-5.6.1-42.2 php5-wddx-5.6.1-42.2 php5-wddx-debuginfo-5.6.1-42.2 php5-xmlreader-5.6.1-42.2 php5-xmlreader-debuginfo-5.6.1-42.2 php5-xmlrpc-5.6.1-42.2 php5-xmlrpc-debuginfo-5.6.1-42.2 php5-xmlwriter-5.6.1-42.2 php5-xmlwriter-debuginfo-5.6.1-42.2 php5-xsl-5.6.1-42.2 php5-xsl-debuginfo-5.6.1-42.2 php5-zip-5.6.1-42.2 php5-zip-debuginfo-5.6.1-42.2 php5-zlib-5.6.1-42.2 php5-zlib-debuginfo-5.6.1-42.2 - openSUSE 13.2 (noarch): php5-pear-5.6.1-42.2 References: https://www.suse.com/security/cve/CVE-2016-2554.html https://bugzilla.suse.com/968284

1 0

openSUSE-SU-2016:0708-1: important: Security update for libotr,libotr2
by opensuse-security＠opensuse.org 10 Mar '16

10 Mar '16

openSUSE Security Update: Security update for libotr,libotr2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0708-1 Rating: important References: #969785 Cross-References: CVE-2016-2851 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libotr and libotr2 were updated to fix one security issue: - CVE-2016-2851: Integer overflow vulnerability allowed remote attackers to execute arbitrary code on 64 bit platforms (boo#969785) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-322=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-322=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libotr-debugsource-4.1.1-4.1 libotr-devel-4.1.1-4.1 libotr-tools-4.1.1-4.1 libotr-tools-debuginfo-4.1.1-4.1 libotr2-3.2.1-13.1 libotr2-debuginfo-3.2.1-13.1 libotr2-debugsource-3.2.1-13.1 libotr2-devel-3.2.1-13.1 libotr2-tools-3.2.1-13.1 libotr2-tools-debuginfo-3.2.1-13.1 libotr5-4.1.1-4.1 libotr5-debuginfo-4.1.1-4.1 - openSUSE 13.2 (i586 x86_64): libotr-debugsource-4.0.0-8.3.1 libotr-devel-4.0.0-8.3.1 libotr-tools-4.0.0-8.3.1 libotr-tools-debuginfo-4.0.0-8.3.1 libotr2-3.2.1-7.3.1 libotr2-debuginfo-3.2.1-7.3.1 libotr2-debugsource-3.2.1-7.3.1 libotr2-devel-3.2.1-7.3.1 libotr2-tools-3.2.1-7.3.1 libotr2-tools-debuginfo-3.2.1-7.3.1 libotr5-4.0.0-8.3.1 libotr5-debuginfo-4.0.0-8.3.1 References: https://www.suse.com/security/cve/CVE-2016-2851.html https://bugzilla.suse.com/969785

1 0

openSUSE-RU-2016:0702-1: Recommended update for fontforge
by maintenance＠opensuse.org 09 Mar '16

09 Mar '16

openSUSE Recommended Update: Recommended update for fontforge ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0702-1 Rating: low References: #963023 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fontforge provides the following fixes: - Do not crash on invalid input data when EOF is reached. (bsc#963023) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-321=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): fontforge-20120731-15.1 fontforge-debuginfo-20120731-15.1 fontforge-debugsource-20120731-15.1 fontforge-devel-20120731-15.1 - openSUSE Leap 42.1 (noarch): fontforge-doc-20120731-15.1 References: https://bugzilla.suse.com/963023

1 0

openSUSE-RU-2016:0701-1: moderate: Recommended update for ufraw
by maintenance＠opensuse.org 09 Mar '16

09 Mar '16

openSUSE Recommended Update: Recommended update for ufraw ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0701-1 Rating: moderate References: #968652 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ufraw fixes the following issues: - boo#968652: The ufraw would ship binaries intended as testing code only. Remove them and the conflicts with dcraw, preventing problems when upgrading from openSUSE 13.2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-320=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gimp-ufraw-0.22-4.1 gimp-ufraw-debuginfo-0.22-4.1 ufraw-0.22-4.1 ufraw-debuginfo-0.22-4.1 ufraw-debugsource-0.22-4.1 - openSUSE Leap 42.1 (noarch): ufraw-lang-0.22-4.1 References: https://bugzilla.suse.com/968652

1 0

openSUSE-SU-2016:0694-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 08 Mar '16

08 Mar '16

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0694-1 Rating: moderate References: #958350 #959572 #963322 #965403 Cross-References: CVE-2016-1866 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for salt fixes the following issues: - CVE-2016-1866: Improper handling of clear messages on the minion remote code execution (boo#965403) The following bugs were fixed: - boo#958350: Salt crashes on invalid UTF-8 in package data - boo#959572: "salt '*' pkg.info_installed" causes exception on sles12sp1 client - boo#963322: salt-api cannot be stopped correctly Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-318=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): salt-2015.8.7-13.1 salt-api-2015.8.7-13.1 salt-cloud-2015.8.7-13.1 salt-doc-2015.8.7-13.1 salt-master-2015.8.7-13.1 salt-minion-2015.8.7-13.1 salt-proxy-2015.8.7-13.1 salt-raet-2015.8.7-13.1 salt-ssh-2015.8.7-13.1 salt-syndic-2015.8.7-13.1 - openSUSE Leap 42.1 (noarch): salt-bash-completion-2015.8.7-13.1 salt-fish-completion-2015.8.7-13.1 salt-zsh-completion-2015.8.7-13.1 References: https://www.suse.com/security/cve/CVE-2016-1866.html https://bugzilla.suse.com/958350 https://bugzilla.suse.com/959572 https://bugzilla.suse.com/963322 https://bugzilla.suse.com/965403

1 0

openSUSE-RU-2016:0692-1: Recommended update for clamav-database
by maintenance＠opensuse.org 08 Mar '16

08 Mar '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0692-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh March 7th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-319=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201603070002-59.1 References:

1 0

openSUSE-RU-2016:0691-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 08 Mar '16

08 Mar '16

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0691-1 Rating: moderate References: #942946 #955469 #955770 #958295 #958935 #958937 #961226 #962080 #964355 #965475 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update of systemd fixes some issues partly introduced by the last update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-317=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libgudev-1_0-0-210-43.1 libgudev-1_0-0-debuginfo-210-43.1 libgudev-1_0-devel-210-43.1 libudev-devel-210-43.1 libudev-mini-devel-210-43.2 libudev-mini1-210-43.2 libudev-mini1-debuginfo-210-43.2 libudev1-210-43.1 libudev1-debuginfo-210-43.1 nss-myhostname-210-43.1 nss-myhostname-debuginfo-210-43.1 systemd-210-43.1 systemd-debuginfo-210-43.1 systemd-debugsource-210-43.1 systemd-devel-210-43.1 systemd-journal-gateway-210-43.1 systemd-journal-gateway-debuginfo-210-43.1 systemd-logger-210-43.1 systemd-mini-210-43.2 systemd-mini-debuginfo-210-43.2 systemd-mini-debugsource-210-43.2 systemd-mini-devel-210-43.2 systemd-mini-sysvinit-210-43.2 systemd-sysvinit-210-43.1 typelib-1_0-GUdev-1_0-210-43.1 udev-210-43.1 udev-debuginfo-210-43.1 udev-mini-210-43.2 udev-mini-debuginfo-210-43.2 - openSUSE 13.1 (x86_64): libgudev-1_0-0-32bit-210-43.1 libgudev-1_0-0-debuginfo-32bit-210-43.1 libudev1-32bit-210-43.1 libudev1-debuginfo-32bit-210-43.1 nss-myhostname-32bit-210-43.1 nss-myhostname-debuginfo-32bit-210-43.1 systemd-32bit-210-43.1 systemd-debuginfo-32bit-210-43.1 - openSUSE 13.1 (noarch): systemd-bash-completion-210-43.1 References: https://bugzilla.suse.com/942946 https://bugzilla.suse.com/955469 https://bugzilla.suse.com/955770 https://bugzilla.suse.com/958295 https://bugzilla.suse.com/958935 https://bugzilla.suse.com/958937 https://bugzilla.suse.com/961226 https://bugzilla.suse.com/962080 https://bugzilla.suse.com/964355 https://bugzilla.suse.com/965475

1 0

openSUSE-SU-2016:0684-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 08 Mar '16

08 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0684-1 Rating: important References: #969333 Cross-References: CVE-2015-8126 CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333) - CVE-2016-1630: Same-origin bypass in Blink - CVE-2016-1631: Same-origin bypass in Pepper Plugin - CVE-2016-1632: Bad cast in Extensions - CVE-2016-1633: Use-after-free in Blink - CVE-2016-1634: Use-after-free in Blink - CVE-2016-1635: Use-after-free in Blink - CVE-2016-1636: SRI Validation Bypass - CVE-2015-8126: Out-of-bounds access in libpng - CVE-2016-1637: Information Leak in Skia - CVE-2016-1638: WebAPI Bypass - CVE-2016-1639: Use-after-free in WebRTC - CVE-2016-1640: Origin confusion in Extensions UI - CVE-2016-1641: Use-after-free in Favicon - CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch (currently 4.9.385.26) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-316=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-49.0.2623.75-135.1 chromedriver-debuginfo-49.0.2623.75-135.1 chromium-49.0.2623.75-135.1 chromium-debuginfo-49.0.2623.75-135.1 chromium-debugsource-49.0.2623.75-135.1 chromium-desktop-gnome-49.0.2623.75-135.1 chromium-desktop-kde-49.0.2623.75-135.1 chromium-ffmpegsumo-49.0.2623.75-135.1 chromium-ffmpegsumo-debuginfo-49.0.2623.75-135.1 References: https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2016-1630.html https://www.suse.com/security/cve/CVE-2016-1631.html https://www.suse.com/security/cve/CVE-2016-1632.html https://www.suse.com/security/cve/CVE-2016-1633.html https://www.suse.com/security/cve/CVE-2016-1634.html https://www.suse.com/security/cve/CVE-2016-1635.html https://www.suse.com/security/cve/CVE-2016-1636.html https://www.suse.com/security/cve/CVE-2016-1637.html https://www.suse.com/security/cve/CVE-2016-1638.html https://www.suse.com/security/cve/CVE-2016-1639.html https://www.suse.com/security/cve/CVE-2016-1640.html https://www.suse.com/security/cve/CVE-2016-1641.html https://www.suse.com/security/cve/CVE-2016-1642.html https://bugzilla.suse.com/969333

1 0

openSUSE-RU-2016:0681-1: moderate: Linux kernel 3.12 version upgrade
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Linux kernel 3.12 version upgrade ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0681-1 Rating: moderate References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update brings the Linux Kernel in openSUSE 13.1 Evergreen to a 3.12.53 based kernel. The kernel uses the SUSE Linux Enterprise 12 SP1 kernel sources. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2016-315=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cloop-2.639-11.25.4 cloop-debuginfo-2.639-11.25.4 cloop-debugsource-2.639-11.25.4 cloop-kmp-default-2.639_k3.12.53_40-11.25.4 cloop-kmp-default-debuginfo-2.639_k3.12.53_40-11.25.4 cloop-kmp-desktop-2.639_k3.12.53_40-11.25.4 cloop-kmp-desktop-debuginfo-2.639_k3.12.53_40-11.25.4 cloop-kmp-xen-2.639_k3.12.53_40-11.25.4 cloop-kmp-xen-debuginfo-2.639_k3.12.53_40-11.25.4 crash-7.0.2-2.25.8 crash-debuginfo-7.0.2-2.25.8 crash-debugsource-7.0.2-2.25.8 crash-devel-7.0.2-2.25.8 crash-doc-7.0.2-2.25.8 crash-eppic-7.0.2-2.25.8 crash-eppic-debuginfo-7.0.2-2.25.8 crash-gcore-7.0.2-2.25.8 crash-gcore-debuginfo-7.0.2-2.25.8 crash-kmp-default-7.0.2_k3.12.53_40-2.25.8 crash-kmp-default-debuginfo-7.0.2_k3.12.53_40-2.25.8 crash-kmp-desktop-7.0.2_k3.12.53_40-2.25.8 crash-kmp-desktop-debuginfo-7.0.2_k3.12.53_40-2.25.8 crash-kmp-xen-7.0.2_k3.12.53_40-2.25.8 crash-kmp-xen-debuginfo-7.0.2_k3.12.53_40-2.25.8 hdjmod-debugsource-1.28-16.25.4 hdjmod-kmp-default-1.28_k3.12.53_40-16.25.4 hdjmod-kmp-default-debuginfo-1.28_k3.12.53_40-16.25.4 hdjmod-kmp-desktop-1.28_k3.12.53_40-16.25.4 hdjmod-kmp-desktop-debuginfo-1.28_k3.12.53_40-16.25.4 hdjmod-kmp-xen-1.28_k3.12.53_40-16.25.4 hdjmod-kmp-xen-debuginfo-1.28_k3.12.53_40-16.25.4 ipset-6.21.1-2.29.4 ipset-debuginfo-6.21.1-2.29.4 ipset-debugsource-6.21.1-2.29.4 ipset-devel-6.21.1-2.29.4 ipset-kmp-default-6.21.1_k3.12.53_40-2.29.4 ipset-kmp-default-debuginfo-6.21.1_k3.12.53_40-2.29.4 ipset-kmp-desktop-6.21.1_k3.12.53_40-2.29.4 ipset-kmp-desktop-debuginfo-6.21.1_k3.12.53_40-2.29.4 ipset-kmp-xen-6.21.1_k3.12.53_40-2.29.4 ipset-kmp-xen-debuginfo-6.21.1_k3.12.53_40-2.29.4 iscsitarget-1.4.20.3-13.25.4 iscsitarget-debuginfo-1.4.20.3-13.25.4 iscsitarget-debugsource-1.4.20.3-13.25.4 iscsitarget-kmp-default-1.4.20.3_k3.12.53_40-13.25.4 iscsitarget-kmp-default-debuginfo-1.4.20.3_k3.12.53_40-13.25.4 iscsitarget-kmp-desktop-1.4.20.3_k3.12.53_40-13.25.4 iscsitarget-kmp-desktop-debuginfo-1.4.20.3_k3.12.53_40-13.25.4 iscsitarget-kmp-xen-1.4.20.3_k3.12.53_40-13.25.4 iscsitarget-kmp-xen-debuginfo-1.4.20.3_k3.12.53_40-13.25.4 kernel-default-3.12.53-40.1 kernel-default-base-3.12.53-40.1 kernel-default-base-debuginfo-3.12.53-40.1 kernel-default-debuginfo-3.12.53-40.1 kernel-default-debugsource-3.12.53-40.1 kernel-default-devel-3.12.53-40.1 kernel-syms-3.12.53-40.1 libipset3-6.21.1-2.29.4 libipset3-debuginfo-6.21.1-2.29.4 ndiswrapper-1.58-26.3 ndiswrapper-debuginfo-1.58-26.3 ndiswrapper-debugsource-1.58-26.3 ndiswrapper-kmp-default-1.58_k3.12.53_40-26.3 ndiswrapper-kmp-default-debuginfo-1.58_k3.12.53_40-26.3 ndiswrapper-kmp-desktop-1.58_k3.12.53_40-26.3 ndiswrapper-kmp-desktop-debuginfo-1.58_k3.12.53_40-26.3 openvswitch-1.11.0-0.32.5 openvswitch-controller-1.11.0-0.32.5 openvswitch-controller-debuginfo-1.11.0-0.32.5 openvswitch-debuginfo-1.11.0-0.32.5 openvswitch-debugsource-1.11.0-0.32.5 openvswitch-kmp-default-1.11.0_k3.12.53_40-0.32.5 openvswitch-kmp-default-debuginfo-1.11.0_k3.12.53_40-0.32.5 openvswitch-kmp-desktop-1.11.0_k3.12.53_40-0.32.5 openvswitch-kmp-desktop-debuginfo-1.11.0_k3.12.53_40-0.32.5 openvswitch-kmp-xen-1.11.0_k3.12.53_40-0.32.5 openvswitch-kmp-xen-debuginfo-1.11.0_k3.12.53_40-0.32.5 openvswitch-pki-1.11.0-0.32.5 openvswitch-switch-1.11.0-0.32.5 openvswitch-switch-debuginfo-1.11.0-0.32.5 openvswitch-test-1.11.0-0.32.5 pcfclock-0.44-258.26.3 pcfclock-debuginfo-0.44-258.26.3 pcfclock-debugsource-0.44-258.26.3 pcfclock-kmp-default-0.44_k3.12.53_40-258.26.3 pcfclock-kmp-default-debuginfo-0.44_k3.12.53_40-258.26.3 pcfclock-kmp-desktop-0.44_k3.12.53_40-258.26.3 pcfclock-kmp-desktop-debuginfo-0.44_k3.12.53_40-258.26.3 python-openvswitch-1.11.0-0.32.5 python-openvswitch-test-1.11.0-0.32.5 python-virtualbox-4.2.36-2.58.5 python-virtualbox-debuginfo-4.2.36-2.58.5 vhba-kmp-debugsource-20130607-2.26.3 vhba-kmp-default-20130607_k3.12.53_40-2.26.3 vhba-kmp-default-debuginfo-20130607_k3.12.53_40-2.26.3 vhba-kmp-desktop-20130607_k3.12.53_40-2.26.3 vhba-kmp-desktop-debuginfo-20130607_k3.12.53_40-2.26.3 vhba-kmp-xen-20130607_k3.12.53_40-2.26.3 vhba-kmp-xen-debuginfo-20130607_k3.12.53_40-2.26.3 virtualbox-4.2.36-2.58.5 virtualbox-debuginfo-4.2.36-2.58.5 virtualbox-debugsource-4.2.36-2.58.5 virtualbox-devel-4.2.36-2.58.5 virtualbox-guest-kmp-default-4.2.36_k3.12.53_40-2.58.5 virtualbox-guest-kmp-default-debuginfo-4.2.36_k3.12.53_40-2.58.5 virtualbox-guest-kmp-desktop-4.2.36_k3.12.53_40-2.58.5 virtualbox-guest-kmp-desktop-debuginfo-4.2.36_k3.12.53_40-2.58.5 virtualbox-guest-tools-4.2.36-2.58.5 virtualbox-guest-tools-debuginfo-4.2.36-2.58.5 virtualbox-guest-x11-4.2.36-2.58.5 virtualbox-guest-x11-debuginfo-4.2.36-2.58.5 virtualbox-host-kmp-default-4.2.36_k3.12.53_40-2.58.5 virtualbox-host-kmp-default-debuginfo-4.2.36_k3.12.53_40-2.58.5 virtualbox-host-kmp-desktop-4.2.36_k3.12.53_40-2.58.5 virtualbox-host-kmp-desktop-debuginfo-4.2.36_k3.12.53_40-2.58.5 virtualbox-qt-4.2.36-2.58.5 virtualbox-qt-debuginfo-4.2.36-2.58.5 virtualbox-websrv-4.2.36-2.58.5 virtualbox-websrv-debuginfo-4.2.36-2.58.5 xen-debugsource-4.3.4_10-59.5 xen-devel-4.3.4_10-59.5 xen-kmp-default-4.3.4_10_k3.12.53_40-59.5 xen-kmp-default-debuginfo-4.3.4_10_k3.12.53_40-59.5 xen-kmp-desktop-4.3.4_10_k3.12.53_40-59.5 xen-kmp-desktop-debuginfo-4.3.4_10_k3.12.53_40-59.5 xen-libs-4.3.4_10-59.5 xen-libs-debuginfo-4.3.4_10-59.5 xen-tools-domU-4.3.4_10-59.5 xen-tools-domU-debuginfo-4.3.4_10-59.5 xtables-addons-2.3-2.25.3 xtables-addons-debuginfo-2.3-2.25.3 xtables-addons-debugsource-2.3-2.25.3 xtables-addons-kmp-default-2.3_k3.12.53_40-2.25.3 xtables-addons-kmp-default-debuginfo-2.3_k3.12.53_40-2.25.3 xtables-addons-kmp-desktop-2.3_k3.12.53_40-2.25.3 xtables-addons-kmp-desktop-debuginfo-2.3_k3.12.53_40-2.25.3 xtables-addons-kmp-xen-2.3_k3.12.53_40-2.25.3 xtables-addons-kmp-xen-debuginfo-2.3_k3.12.53_40-2.25.3 - openSUSE 13.1 (i686 x86_64): kernel-debug-3.12.53-40.1 kernel-debug-base-3.12.53-40.1 kernel-debug-base-debuginfo-3.12.53-40.1 kernel-debug-debuginfo-3.12.53-40.1 kernel-debug-debugsource-3.12.53-40.1 kernel-debug-devel-3.12.53-40.1 kernel-debug-devel-debuginfo-3.12.53-40.1 kernel-desktop-3.12.53-40.1 kernel-desktop-base-3.12.53-40.1 kernel-desktop-base-debuginfo-3.12.53-40.1 kernel-desktop-debuginfo-3.12.53-40.1 kernel-desktop-debugsource-3.12.53-40.1 kernel-desktop-devel-3.12.53-40.1 kernel-ec2-3.12.53-40.1 kernel-ec2-base-3.12.53-40.1 kernel-ec2-base-debuginfo-3.12.53-40.1 kernel-ec2-debuginfo-3.12.53-40.1 kernel-ec2-debugsource-3.12.53-40.1 kernel-ec2-devel-3.12.53-40.1 kernel-trace-3.12.53-40.1 kernel-trace-base-3.12.53-40.1 kernel-trace-base-debuginfo-3.12.53-40.1 kernel-trace-debuginfo-3.12.53-40.1 kernel-trace-debugsource-3.12.53-40.1 kernel-trace-devel-3.12.53-40.1 kernel-vanilla-3.12.53-40.1 kernel-vanilla-debuginfo-3.12.53-40.1 kernel-vanilla-debugsource-3.12.53-40.1 kernel-vanilla-devel-3.12.53-40.1 kernel-xen-3.12.53-40.1 kernel-xen-base-3.12.53-40.1 kernel-xen-base-debuginfo-3.12.53-40.1 kernel-xen-debuginfo-3.12.53-40.1 kernel-xen-debugsource-3.12.53-40.1 kernel-xen-devel-3.12.53-40.1 - openSUSE 13.1 (x86_64): xen-4.3.4_10-59.5 xen-doc-html-4.3.4_10-59.5 xen-libs-32bit-4.3.4_10-59.5 xen-libs-debuginfo-32bit-4.3.4_10-59.5 xen-tools-4.3.4_10-59.5 xen-tools-debuginfo-4.3.4_10-59.5 xen-xend-tools-4.3.4_10-59.5 xen-xend-tools-debuginfo-4.3.4_10-59.5 - openSUSE 13.1 (noarch): kernel-devel-3.12.53-40.1 kernel-docs-3.12.53-40.2 kernel-firmware-20140807git-2.24.2 kernel-macros-3.12.53-40.1 kernel-source-3.12.53-40.1 kernel-source-vanilla-3.12.53-40.1 ucode-amd-20140807git-2.24.2 virtualbox-host-source-4.2.36-2.58.5 - openSUSE 13.1 (i686): kernel-pae-3.12.53-40.1 kernel-pae-base-3.12.53-40.1 kernel-pae-base-debuginfo-3.12.53-40.1 kernel-pae-debuginfo-3.12.53-40.1 kernel-pae-debugsource-3.12.53-40.1 kernel-pae-devel-3.12.53-40.1 - openSUSE 13.1 (i586): cloop-kmp-pae-2.639_k3.12.53_40-11.25.4 cloop-kmp-pae-debuginfo-2.639_k3.12.53_40-11.25.4 crash-kmp-pae-7.0.2_k3.12.53_40-2.25.8 crash-kmp-pae-debuginfo-7.0.2_k3.12.53_40-2.25.8 hdjmod-kmp-pae-1.28_k3.12.53_40-16.25.4 hdjmod-kmp-pae-debuginfo-1.28_k3.12.53_40-16.25.4 ipset-kmp-pae-6.21.1_k3.12.53_40-2.29.4 ipset-kmp-pae-debuginfo-6.21.1_k3.12.53_40-2.29.4 iscsitarget-kmp-pae-1.4.20.3_k3.12.53_40-13.25.4 iscsitarget-kmp-pae-debuginfo-1.4.20.3_k3.12.53_40-13.25.4 ndiswrapper-kmp-pae-1.58_k3.12.53_40-26.3 ndiswrapper-kmp-pae-debuginfo-1.58_k3.12.53_40-26.3 openvswitch-kmp-pae-1.11.0_k3.12.53_40-0.32.5 openvswitch-kmp-pae-debuginfo-1.11.0_k3.12.53_40-0.32.5 pcfclock-kmp-pae-0.44_k3.12.53_40-258.26.3 pcfclock-kmp-pae-debuginfo-0.44_k3.12.53_40-258.26.3 vhba-kmp-pae-20130607_k3.12.53_40-2.26.3 vhba-kmp-pae-debuginfo-20130607_k3.12.53_40-2.26.3 virtualbox-guest-kmp-pae-4.2.36_k3.12.53_40-2.58.5 virtualbox-guest-kmp-pae-debuginfo-4.2.36_k3.12.53_40-2.58.5 virtualbox-host-kmp-pae-4.2.36_k3.12.53_40-2.58.5 virtualbox-host-kmp-pae-debuginfo-4.2.36_k3.12.53_40-2.58.5 xen-kmp-pae-4.3.4_10_k3.12.53_40-59.5 xen-kmp-pae-debuginfo-4.3.4_10_k3.12.53_40-59.5 xtables-addons-kmp-pae-2.3_k3.12.53_40-2.25.3 xtables-addons-kmp-pae-debuginfo-2.3_k3.12.53_40-2.25.3 References:

1 0

openSUSE-SU-2016:0675-1: Security update for nghttp2
by opensuse-security＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Security Update: Security update for nghttp2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0675-1 Rating: low References: #966514 Cross-References: CVE-2016-1544 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nghttp2 fixes the following vulnerabilities: * CVE-2016-1544: A malicious remote attacker could have caused an Out of memory condition due to unlimited incoming HTTP header fields (boo#966514) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-314=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libnghttp2-14-1.3.4-3.1 libnghttp2-14-debuginfo-1.3.4-3.1 libnghttp2-devel-1.3.4-3.1 libnghttp2_asio-devel-1.3.4-3.1 libnghttp2_asio1-1.3.4-3.1 libnghttp2_asio1-debuginfo-1.3.4-3.1 nghttp2-1.3.4-3.1 nghttp2-debuginfo-1.3.4-3.1 nghttp2-debugsource-1.3.4-3.1 nghttp2-doc-1.3.4-3.1 python-nghttp2-1.3.4-3.1 python-nghttp2-debuginfo-1.3.4-3.1 References: https://www.suse.com/security/cve/CVE-2016-1544.html https://bugzilla.suse.com/966514

1 0

openSUSE-RU-2016:0674-1: moderate: Recommended update for suse-module-tools
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for suse-module-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0674-1 Rating: moderate References: #965830 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-module-tools contains the following change: - Add missing RPM Requires for module-init-tools, findutils, gzip, and mkinitrd (bnc#965830). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-307=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): suse-module-tools-12.3-14.7.1 References: https://bugzilla.suse.com/965830

1 0

openSUSE-RU-2016:0673-1: moderate: Recommended update for suse-module-tools
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for suse-module-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0673-1 Rating: moderate References: #965830 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-module-tools contains the following change: - Add missing RPM Requires for module-init-tools, findutils, gzip, and mkinitrd (bnc#965830). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-306=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): suse-module-tools-12.3-18.1 References: https://bugzilla.suse.com/965830

1 0

openSUSE-RU-2016:0672-1: moderate: Recommended update for ibus
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for ibus ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0672-1 Rating: moderate References: #968486 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ibus fixes the following issues: - boo#968486: Fix invocation of ibus service, ibus now started via XDG autostart to avoid race - INPUT_METHOD environment variable is set explicitly in xim script at startup - explicit dbus-launch invocation was dropped Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-310=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ibus-1.5.11-5.1 ibus-debuginfo-1.5.11-5.1 ibus-debugsource-1.5.11-5.1 ibus-devel-1.5.11-5.1 ibus-gtk-1.5.11-5.1 ibus-gtk-debuginfo-1.5.11-5.1 ibus-gtk3-1.5.11-5.1 ibus-gtk3-debuginfo-1.5.11-5.1 libibus-1_0-5-1.5.11-5.1 libibus-1_0-5-debuginfo-1.5.11-5.1 python-ibus-1.5.11-5.1 typelib-1_0-IBus-1_0-1.5.11-5.1 - openSUSE Leap 42.1 (x86_64): ibus-gtk-32bit-1.5.11-5.1 ibus-gtk-debuginfo-32bit-1.5.11-5.1 ibus-gtk3-32bit-1.5.11-5.1 ibus-gtk3-debuginfo-32bit-1.5.11-5.1 libibus-1_0-5-32bit-1.5.11-5.1 libibus-1_0-5-debuginfo-32bit-1.5.11-5.1 - openSUSE Leap 42.1 (noarch): ibus-branding-openSUSE-KDE-1.5.11-5.1 ibus-lang-1.5.11-5.1 References: https://bugzilla.suse.com/968486

1 0

openSUSE-RU-2016:0671-1: moderate: Recommended update for xf86-video-intel
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for xf86-video-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0671-1 Rating: moderate References: #968598 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xf86-video-intel fixes the following issues: - boo#968598: Fix intel intel-virtual-output: check more carefully for DRI3 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-311=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xf86-video-intel-2.99.917-12.1 xf86-video-intel-debuginfo-2.99.917-12.1 xf86-video-intel-debugsource-2.99.917-12.1 - openSUSE Leap 42.1 (x86_64): xf86-video-intel-32bit-2.99.917-12.1 xf86-video-intel-debuginfo-32bit-2.99.917-12.1 References: https://bugzilla.suse.com/968598

1 0

openSUSE-RU-2016:0670-1: moderate: Recommended update for NetworkManager
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0670-1 Rating: moderate References: #962054 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for NetworkManager fixes the following issues: - increase the quit timer for vpn plugin service from 20 sec to 3 mins, so that it doesn't quit whilst asking for secrets (fixes boo#962054). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-309=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): NetworkManager-1.0.6-7.1 NetworkManager-debuginfo-1.0.6-7.1 NetworkManager-debugsource-1.0.6-7.1 NetworkManager-devel-1.0.6-7.1 libnm-glib-vpn1-1.0.6-7.1 libnm-glib-vpn1-debuginfo-1.0.6-7.1 libnm-glib4-1.0.6-7.1 libnm-glib4-debuginfo-1.0.6-7.1 libnm-util2-1.0.6-7.1 libnm-util2-debuginfo-1.0.6-7.1 libnm0-1.0.6-7.1 libnm0-debuginfo-1.0.6-7.1 typelib-1_0-NM-1_0-1.0.6-7.1 typelib-1_0-NMClient-1_0-1.0.6-7.1 typelib-1_0-NetworkManager-1_0-1.0.6-7.1 - openSUSE Leap 42.1 (x86_64): NetworkManager-devel-32bit-1.0.6-7.1 libnm-glib-vpn1-32bit-1.0.6-7.1 libnm-glib-vpn1-debuginfo-32bit-1.0.6-7.1 libnm-glib4-32bit-1.0.6-7.1 libnm-glib4-debuginfo-32bit-1.0.6-7.1 libnm-util2-32bit-1.0.6-7.1 libnm-util2-debuginfo-32bit-1.0.6-7.1 - openSUSE Leap 42.1 (noarch): NetworkManager-lang-1.0.6-7.1 References: https://bugzilla.suse.com/962054

1 0

openSUSE-RU-2016:0669-1: Recommended update for biosdevname
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for biosdevname ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0669-1 Rating: low References: #965581 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for biosdevname provides the following fixes: - In ConnectX-4 based devices, each physical port has a dedicated PCI function. Apply special handling for only ConnectX-3 based devices where single PCI function is shared by multiple physical ports. (bsc#965581) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-312=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): biosdevname-0.6.2-7.1 biosdevname-debuginfo-0.6.2-7.1 biosdevname-debugsource-0.6.2-7.1 References: https://bugzilla.suse.com/965581

1 0

openSUSE-RU-2016:0668-1: moderate: Recommended update for dolphin
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for dolphin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0668-1 Rating: moderate References: #965514 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dolphin fixes the following issues: - boo#965514: Dolphin would crash on exit due to an unneccessary icon parameter in the dolphinsu.desktop file Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-308=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dolphin-15.12.2-16.1 dolphin-debuginfo-15.12.2-16.1 dolphin-debugsource-15.12.2-16.1 dolphin-devel-15.12.2-16.1 dolphin-part-15.12.2-16.1 dolphin-part-debuginfo-15.12.2-16.1 libdolphinvcs5-15.12.2-16.1 libdolphinvcs5-debuginfo-15.12.2-16.1 References: https://bugzilla.suse.com/965514

1 0

openSUSE-RU-2016:0667-1: moderate: Recommended update for fcitx
by maintenance＠opensuse.org 07 Mar '16

07 Mar '16

openSUSE Recommended Update: Recommended update for fcitx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0667-1 Rating: moderate References: #968486 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fcitx fixes the following issues: - boo#968486: Delay invocation of fcitx inat session start - Add NoDisplay=true in autostart desktop file so that it won't be shown Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-313=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): fcitx-4.2.9-8.1 fcitx-debuginfo-4.2.9-8.1 fcitx-debugsource-4.2.9-8.1 fcitx-devel-4.2.9-8.1 fcitx-devel-debuginfo-4.2.9-8.1 fcitx-gtk2-4.2.9-8.1 fcitx-gtk2-debuginfo-4.2.9-8.1 fcitx-gtk3-4.2.9-8.1 fcitx-gtk3-debuginfo-4.2.9-8.1 fcitx-pinyin-4.2.9-8.1 fcitx-pinyin-debuginfo-4.2.9-8.1 fcitx-pinyin-tools-4.2.9-8.1 fcitx-pinyin-tools-debuginfo-4.2.9-8.1 fcitx-qt4-4.2.9-8.1 fcitx-qt4-debuginfo-4.2.9-8.1 fcitx-quwei-4.2.9-8.1 fcitx-quwei-debuginfo-4.2.9-8.1 fcitx-table-4.2.9-8.1 fcitx-table-debuginfo-4.2.9-8.1 fcitx-table-tools-4.2.9-8.1 fcitx-table-tools-debuginfo-4.2.9-8.1 libfcitx-4_2_9-4.2.9-8.1 libfcitx-4_2_9-debuginfo-4.2.9-8.1 typelib-1_0-Fcitx-1_0-4.2.9-8.1 - openSUSE Leap 42.1 (x86_64): fcitx-gtk2-32bit-4.2.9-8.1 fcitx-gtk2-debuginfo-32bit-4.2.9-8.1 fcitx-gtk3-32bit-4.2.9-8.1 fcitx-gtk3-debuginfo-32bit-4.2.9-8.1 fcitx-qt4-32bit-4.2.9-8.1 fcitx-qt4-debuginfo-32bit-4.2.9-8.1 libfcitx-4_2_9-32bit-4.2.9-8.1 libfcitx-4_2_9-debuginfo-32bit-4.2.9-8.1 - openSUSE Leap 42.1 (noarch): fcitx-branding-openSUSE-4.2.9-8.1 fcitx-skin-classic-4.2.9-8.1 fcitx-skin-dark-4.2.9-8.1 fcitx-skin-new-air-4.2.9-8.1 fcitx-table-cn-bingchan-4.2.9-8.1 fcitx-table-cn-cangjie-4.2.9-8.1 fcitx-table-cn-dianbao-4.2.9-8.1 fcitx-table-cn-erbi-4.2.9-8.1 fcitx-table-cn-wanfeng-4.2.9-8.1 fcitx-table-cn-wubi-4.2.9-8.1 fcitx-table-cn-wubi-pinyin-4.2.9-8.1 fcitx-table-cn-ziran-4.2.9-8.1 References: https://bugzilla.suse.com/968486

1 0

openSUSE-SU-2016:0666-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 06 Mar '16

06 Mar '16

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0666-1 Rating: moderate References: #968938 #968941 Cross-References: CVE-2016-2560 CVE-2016-2561 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to phpMyAdmin 4.4.15.4 fixes the following security issues: - CVE-2016-2560: Multiple XSS vulnerabilities (PMASA-2016-11 boo#968938) - CVE-2016-2561: Multiple XSS vulnerabilities (PMASA-2016-12 boo#968941) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-305=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): phpMyAdmin-4.4.15.5-52.1 References: https://www.suse.com/security/cve/CVE-2016-2560.html https://www.suse.com/security/cve/CVE-2016-2561.html https://bugzilla.suse.com/968938 https://bugzilla.suse.com/968941

1 0

openSUSE-SU-2016:0664-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 06 Mar '16

06 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0664-1 Rating: important References: #969333 Cross-References: CVE-2015-8126 CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333) - CVE-2016-1630: Same-origin bypass in Blink - CVE-2016-1631: Same-origin bypass in Pepper Plugin - CVE-2016-1632: Bad cast in Extensions - CVE-2016-1633: Use-after-free in Blink - CVE-2016-1634: Use-after-free in Blink - CVE-2016-1635: Use-after-free in Blink - CVE-2016-1636: SRI Validation Bypass - CVE-2015-8126: Out-of-bounds access in libpng - CVE-2016-1637: Information Leak in Skia - CVE-2016-1638: WebAPI Bypass - CVE-2016-1639: Use-after-free in WebRTC - CVE-2016-1640: Origin confusion in Extensions UI - CVE-2016-1641: Use-after-free in Favicon - CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch (currently 4.9.385.26) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 4789=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-49.0.2623.75-27.1 chromedriver-debuginfo-49.0.2623.75-27.1 chromium-49.0.2623.75-27.1 chromium-debuginfo-49.0.2623.75-27.1 chromium-debugsource-49.0.2623.75-27.1 chromium-desktop-gnome-49.0.2623.75-27.1 chromium-desktop-kde-49.0.2623.75-27.1 chromium-ffmpegsumo-49.0.2623.75-27.1 chromium-ffmpegsumo-debuginfo-49.0.2623.75-27.1 References: https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2016-1630.html https://www.suse.com/security/cve/CVE-2016-1631.html https://www.suse.com/security/cve/CVE-2016-1632.html https://www.suse.com/security/cve/CVE-2016-1633.html https://www.suse.com/security/cve/CVE-2016-1634.html https://www.suse.com/security/cve/CVE-2016-1635.html https://www.suse.com/security/cve/CVE-2016-1636.html https://www.suse.com/security/cve/CVE-2016-1637.html https://www.suse.com/security/cve/CVE-2016-1638.html https://www.suse.com/security/cve/CVE-2016-1639.html https://www.suse.com/security/cve/CVE-2016-1640.html https://www.suse.com/security/cve/CVE-2016-1641.html https://www.suse.com/security/cve/CVE-2016-1642.html https://bugzilla.suse.com/969333

1 0

openSUSE-SU-2016:0663-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 06 Mar '16

06 Mar '16

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0663-1 Rating: moderate References: #968938 #968941 Cross-References: CVE-2016-2560 CVE-2016-2561 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to phpMyAdmin 4.4.15.4 fixes the following security issues: - CVE-2016-2560: Multiple XSS vulnerabilities (PMASA-2016-11 boo#968938) - CVE-2016-2561: Multiple XSS vulnerabilities (PMASA-2016-12 boo#968941) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-304=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-304=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): phpMyAdmin-4.4.15.5-16.1 - openSUSE 13.2 (noarch): phpMyAdmin-4.4.15.5-30.1 References: https://www.suse.com/security/cve/CVE-2016-2560.html https://www.suse.com/security/cve/CVE-2016-2561.html https://bugzilla.suse.com/968938 https://bugzilla.suse.com/968941

1 0

openSUSE-SU-2016:0662-1: moderate: Security update for pigz
by opensuse-security＠opensuse.org 06 Mar '16

06 Mar '16

openSUSE Security Update: Security update for pigz ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0662-1 Rating: moderate References: #913627 Cross-References: CVE-2015-1191 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Pigz, a multi-threaded implementation of gzip, was updated to fix one vulnerability. The following vulnerability was fixed: * A crafted file could have caused an unwanted directory traversal on extract (CVE-2015-1191) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-303=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): pigz-2.3-2.3.1 pigz-debuginfo-2.3-2.3.1 pigz-debugsource-2.3-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-1191.html https://bugzilla.suse.com/913627

1 0

openSUSE-SU-2016:0661-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 06 Mar '16

06 Mar '16

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0661-1 Rating: moderate References: #961170 #968565 Cross-References: CVE-2016-2523 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Wireshark was updated to 1.12.10, fixing a number issues in protocol dissectors that could have allowed a remote attacker to crash Wireshark or cause excessive CPU usage through specially crafted packages inserted into the network or a capture file, specifically: - CVE-2016-2523: DNP dissector infinite loop (wnpa-sec-2016-03) - CVE-2016-2530: RSL dissector crash (wnpa-sec-2016-10) - CVE-2016-2531: RSL dissector crash (wnpa-sec-2016-10) - CVE-2016-2532: LLRP dissector crash (wnpa-sec-2016-11) - GSM A-bis OML dissector crash (wnpa-sec-2016-14) - ASN.1 BER dissector crash (wnpa-sec-2016-15) - ASN.1 BER dissector crash (wnpa-sec-2016-18) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.10.html The following non-security bugs were fixed: - boo#961170: Recommend wireshark-ui instead of requiring it to support text-only used Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-302=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): wireshark-1.12.10-50.1 wireshark-debuginfo-1.12.10-50.1 wireshark-debugsource-1.12.10-50.1 wireshark-devel-1.12.10-50.1 wireshark-ui-gtk-1.12.10-50.1 wireshark-ui-gtk-debuginfo-1.12.10-50.1 wireshark-ui-qt-1.12.10-50.1 wireshark-ui-qt-debuginfo-1.12.10-50.1 References: https://www.suse.com/security/cve/CVE-2016-2523.html https://www.suse.com/security/cve/CVE-2016-2530.html https://www.suse.com/security/cve/CVE-2016-2531.html https://www.suse.com/security/cve/CVE-2016-2532.html https://bugzilla.suse.com/961170 https://bugzilla.suse.com/968565

1 0

openSUSE-SU-2016:0660-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 05 Mar '16

05 Mar '16

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0660-1 Rating: moderate References: #961170 #968565 Cross-References: CVE-2016-2523 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Wireshark was updated to 1.12.10, fixing a number issues in protocol dissectors that could have allowed a remote attacker to crash Wireshark or cause excessive CPU usage through specially crafted packages inserted into the network or a capture file, specifically: - CVE-2016-2523: DNP dissector infinite loop (wnpa-sec-2016-03) - CVE-2016-2530: RSL dissector crash (wnpa-sec-2016-10) - CVE-2016-2531: RSL dissector crash (wnpa-sec-2016-10) - CVE-2016-2532: LLRP dissector crash (wnpa-sec-2016-11) - GSM A-bis OML dissector crash (wnpa-sec-2016-14) - ASN.1 BER dissector crash (wnpa-sec-2016-15) - ASN.1 BER dissector crash (wnpa-sec-2016-18) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.10.html The following non-security bugs were fixed: - boo#961170: Recommend wireshark-ui instead of requiring it to support text-only used Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-301=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-301=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): wireshark-1.12.10-17.1 wireshark-debuginfo-1.12.10-17.1 wireshark-debugsource-1.12.10-17.1 wireshark-devel-1.12.10-17.1 wireshark-ui-gtk-1.12.10-17.1 wireshark-ui-gtk-debuginfo-1.12.10-17.1 wireshark-ui-qt-1.12.10-17.1 wireshark-ui-qt-debuginfo-1.12.10-17.1 - openSUSE 13.2 (i586 x86_64): wireshark-1.12.10-32.1 wireshark-debuginfo-1.12.10-32.1 wireshark-debugsource-1.12.10-32.1 wireshark-devel-1.12.10-32.1 wireshark-ui-gtk-1.12.10-32.1 wireshark-ui-gtk-debuginfo-1.12.10-32.1 wireshark-ui-qt-1.12.10-32.1 wireshark-ui-qt-debuginfo-1.12.10-32.1 References: https://www.suse.com/security/cve/CVE-2016-2523.html https://www.suse.com/security/cve/CVE-2016-2530.html https://www.suse.com/security/cve/CVE-2016-2531.html https://www.suse.com/security/cve/CVE-2016-2532.html https://bugzilla.suse.com/961170 https://bugzilla.suse.com/968565

1 0

openSUSE-RU-2016:0651-1: Recommended update for jack
by maintenance＠opensuse.org 04 Mar '16

04 Mar '16

openSUSE Recommended Update: Recommended update for jack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0651-1 Rating: low References: #951213 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Jack was updated to no longer rely on CPU cycles to measure time. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-300=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): jack-1.9.9.5-5.1 jack-debuginfo-1.9.9.5-5.1 jack-debugsource-1.9.9.5-5.1 libjack-devel-1.9.9.5-5.1 libjack0-1.9.9.5-5.1 libjack0-debuginfo-1.9.9.5-5.1 - openSUSE Leap 42.1 (x86_64): jack-32bit-1.9.9.5-5.1 jack-debuginfo-32bit-1.9.9.5-5.1 libjack0-32bit-1.9.9.5-5.1 libjack0-debuginfo-32bit-1.9.9.5-5.1 References: https://bugzilla.suse.com/951213

1 0

openSUSE-SU-2016:0650-1: moderate: Security update for pigz
by opensuse-security＠opensuse.org 04 Mar '16

04 Mar '16

openSUSE Security Update: Security update for pigz ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0650-1 Rating: moderate References: #913627 Cross-References: CVE-2015-1191 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Pigz, a multi-threaded implementation of gzip, was updated to fix one vulnerability. The following vulnerability was fixed: * A crafted file could have caused an unwanted directory traversal on extract (CVE-2015-1191) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-299=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): pigz-2.3-4.3.1 pigz-debuginfo-2.3-4.3.1 pigz-debugsource-2.3-4.3.1 References: https://www.suse.com/security/cve/CVE-2015-1191.html https://bugzilla.suse.com/913627

1 0

openSUSE-FU-2016:0649-1: moderate: Add iptraf to the SLE 12 Backports project
by maintenance＠opensuse.org 04 Mar '16

04 Mar '16

openSUSE Feature Update: Add iptraf to the SLE 12 Backports project ______________________________________________________________________________ Announcement ID: openSUSE-FU-2016:0649-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update adds iptraf to the SLE 12 Backports project Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-298=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): iptraf-debugsource-1.1.4-2.1 iptraf-ng-1.1.4-2.1 iptraf-ng-debuginfo-1.1.4-2.1 References:

1 0

openSUSE-OU-2016:0648-1: moderate: Optional update for openSUSE-EULAs
by maintenance＠opensuse.org 04 Mar '16

04 Mar '16

openSUSE Optional Update: Optional update for openSUSE-EULAs ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:0648-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update for openSUSE-EULAs adds a missing license file for redistributed Adobe ICC Profiles. * Add AdobeICCProfiles.en Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-297=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-297=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): openSUSE-EULAs-13.2-5.1 - openSUSE 13.2 (noarch): openSUSE-EULAs-13.2-2.3.1 References:

1 0

openSUSE-SU-2016:0647-1: moderate: Security update for eog
by opensuse-security＠opensuse.org 03 Mar '16

03 Mar '16

openSUSE Security Update: Security update for eog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0647-1 Rating: moderate References: #966682 Cross-References: CVE-2013-7447 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for eog fixes the following issues: - Update to version 3.14.5 (CVE-2013-7447 boo#966682): + bgo#762028, >=eog-3.16 is affected by CVE-2013-7447. + Updated translations. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-296=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-296=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): eog-3.16.4-6.1 eog-debuginfo-3.16.4-6.1 eog-debugsource-3.16.4-6.1 eog-devel-3.16.4-6.1 - openSUSE Leap 42.1 (noarch): eog-lang-3.16.4-6.1 - openSUSE 13.2 (i586 x86_64): eog-3.14.5-10.1 eog-debuginfo-3.14.5-10.1 eog-debugsource-3.14.5-10.1 eog-devel-3.14.5-10.1 - openSUSE 13.2 (noarch): eog-lang-3.14.5-10.1 References: https://www.suse.com/security/cve/CVE-2013-7447.html https://bugzilla.suse.com/966682

1 0

openSUSE-SU-2016:0640-1: important: Security update for libopenssl0_9_8
by opensuse-security＠opensuse.org 03 Mar '16

03 Mar '16

openSUSE Security Update: Security update for libopenssl0_9_8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0640-1 Rating: important References: #952871 #963415 #967787 #968046 #968048 #968374 Cross-References: CVE-2013-0166 CVE-2013-0169 CVE-2014-0076 CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3510 CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 CVE-2014-3569 CVE-2014-3570 CVE-2014-3571 CVE-2014-3572 CVE-2014-8275 CVE-2015-0204 CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-0293 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3195 CVE-2015-3197 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 37 vulnerabilities is now available. Description: This update for libopenssl0_9_8 fixes the following issues: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - The package was updated to 0.9.8zh: * fixes many security vulnerabilities (not seperately listed): CVE-2015-3195, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1792, CVE-2015-1791, CVE-2015-0286, CVE-2015-0287, CVE-2015-0289, CVE-2015-0293, CVE-2015-0209, CVE-2015-0288, CVE-2014-3571, CVE-2014-3569, CVE-2014-3572, CVE-2015-0204, CVE-2014-8275, CVE-2014-3570, CVE-2014-3567, CVE-2014-3568, CVE-2014-3566, CVE-2014-3510, CVE-2014-3507, CVE-2014-3506, CVE-2014-3505, CVE-2014-3508, CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-3470, CVE-2014-0076, CVE-2013-0169, CVE-2013-0166 - avoid running OPENSSL_config twice. This avoids breaking engine loading. (boo#952871, boo#967787) - fix CVE-2015-3197 (boo#963415) * SSLv2 doesn't block disabled ciphers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-294=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-294=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl0_9_8-0.9.8zh-14.1 libopenssl0_9_8-debuginfo-0.9.8zh-14.1 libopenssl0_9_8-debugsource-0.9.8zh-14.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-14.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-14.1 - openSUSE 13.2 (i586 x86_64): libopenssl0_9_8-0.9.8zh-9.3.1 libopenssl0_9_8-debuginfo-0.9.8zh-9.3.1 libopenssl0_9_8-debugsource-0.9.8zh-9.3.1 - openSUSE 13.2 (x86_64): libopenssl0_9_8-32bit-0.9.8zh-9.3.1 libopenssl0_9_8-debuginfo-32bit-0.9.8zh-9.3.1 References: https://www.suse.com/security/cve/CVE-2013-0166.html https://www.suse.com/security/cve/CVE-2013-0169.html https://www.suse.com/security/cve/CVE-2014-0076.html https://www.suse.com/security/cve/CVE-2014-0195.html https://www.suse.com/security/cve/CVE-2014-0221.html https://www.suse.com/security/cve/CVE-2014-0224.html https://www.suse.com/security/cve/CVE-2014-3470.html https://www.suse.com/security/cve/CVE-2014-3505.html https://www.suse.com/security/cve/CVE-2014-3506.html https://www.suse.com/security/cve/CVE-2014-3507.html https://www.suse.com/security/cve/CVE-2014-3508.html https://www.suse.com/security/cve/CVE-2014-3510.html https://www.suse.com/security/cve/CVE-2014-3566.html https://www.suse.com/security/cve/CVE-2014-3567.html https://www.suse.com/security/cve/CVE-2014-3568.html https://www.suse.com/security/cve/CVE-2014-3569.html https://www.suse.com/security/cve/CVE-2014-3570.html https://www.suse.com/security/cve/CVE-2014-3571.html https://www.suse.com/security/cve/CVE-2014-3572.html https://www.suse.com/security/cve/CVE-2014-8275.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0209.html https://www.suse.com/security/cve/CVE-2015-0286.html https://www.suse.com/security/cve/CVE-2015-0287.html https://www.suse.com/security/cve/CVE-2015-0288.html https://www.suse.com/security/cve/CVE-2015-0289.html https://www.suse.com/security/cve/CVE-2015-0293.html https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3195.html https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/952871 https://bugzilla.suse.com/963415 https://bugzilla.suse.com/967787 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968374

1 0

openSUSE-SU-2016:0639-1: moderate: Security update for libssh2_org
by opensuse-security＠opensuse.org 03 Mar '16

03 Mar '16

openSUSE Security Update: Security update for libssh2_org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0639-1 Rating: moderate References: #967026 Cross-References: CVE-2016-0787 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh2_org fixes the following issues: - fix CVE-2016-0787 (boo#967026) * Weakness in diffie-hellman secret key generation * add CVE-2016-0787.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-295=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libssh2-1-1.5.0-9.7.1 libssh2-1-debuginfo-1.5.0-9.7.1 libssh2-devel-1.5.0-9.7.1 libssh2_org-debugsource-1.5.0-9.7.1 - openSUSE 13.2 (x86_64): libssh2-1-32bit-1.5.0-9.7.1 libssh2-1-debuginfo-32bit-1.5.0-9.7.1 References: https://www.suse.com/security/cve/CVE-2016-0787.html https://bugzilla.suse.com/967026

1 0

openSUSE-SU-2016:0638-1: important: Security update for openssl
by opensuse-security＠opensuse.org 02 Mar '16

02 Mar '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0638-1 Rating: important References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for openssl fixes various security issues: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0702 aka the "CacheBleed" attack. (bsc#968050) Various changes in the modular exponentation code were added that make sure that it is not possible to recover RSA secret keys by analyzing cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. Note that this was only exploitable if the malicious code was running on the same hyper threaded Intel Sandy Bridge processor as the victim thread performing decryptions. - CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser code was fixed that could be abused to facilitate a denial-of-service attack. - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0798 (bnc#968265) The SRP user database lookup method SRP_VBASE_get_by_user() had a memory leak that attackers could abuse to facility DoS attacks. To mitigate the issue, the seed handling in SRP_VBASE_get_by_user() was disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user(). - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-292=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.84.1 libopenssl1_0_0-1.0.1k-11.84.1 libopenssl1_0_0-debuginfo-1.0.1k-11.84.1 openssl-1.0.1k-11.84.1 openssl-debuginfo-1.0.1k-11.84.1 openssl-debugsource-1.0.1k-11.84.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.84.1 libopenssl1_0_0-32bit-1.0.1k-11.84.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.84.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.84.1 References:

1 0

openSUSE-SU-2016:0637-1: important: Security update for openssl
by opensuse-security＠opensuse.org 02 Mar '16

02 Mar '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0637-1 Rating: important References: #957812 #957815 #963415 #968046 #968047 #968048 #968050 #968265 #968374 Cross-References: CVE-2015-1794 CVE-2015-3194 CVE-2015-3195 CVE-2015-3197 CVE-2016-0701 CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for openssl fixes various security issues: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0702 aka the "CacheBleed" attack. (bsc#968050) Various changes in the modular exponentation code were added that make sure that it is not possible to recover RSA secret keys by analyzing cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. Note that this was only exploitable if the malicious code was running on the same hyper threaded Intel Sandy Bridge processor as the victim thread performing decryptions. - CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser code was fixed that could be abused to facilitate a denial-of-service attack. - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0798 (bnc#968265) The SRP user database lookup method SRP_VBASE_get_by_user() had a memory leak that attackers could abuse to facility DoS attacks. To mitigate the issue, the seed handling in SRP_VBASE_get_by_user() was disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user(). - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Older issues fixed: - CVE-2015-1794 follow-up to CVE-2015-1794 (the CVE bug as such doesn't affect 1.0.1 but use these patches to prevent potential attacks - CVE-2015-3195 fix leak with ASN.1 combine (bsc#957812) - CVE-2015-3194 add PSS parameter check (bsc#957815) - CVE-2015-3197 better SSLv2 cipher-suite enforcement (bsc#963415) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-293=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): libopenssl-devel-1.0.1p-71.1 libopenssl1_0_0-1.0.1p-71.1 libopenssl1_0_0-debuginfo-1.0.1p-71.1 openssl-1.0.1p-71.1 openssl-debuginfo-1.0.1p-71.1 openssl-debugsource-1.0.1p-71.1 - openSUSE Evergreen 11.4 (x86_64): libopenssl-devel-32bit-1.0.1p-71.1 libopenssl1_0_0-32bit-1.0.1p-71.1 libopenssl1_0_0-debuginfo-32bit-1.0.1p-71.1 - openSUSE Evergreen 11.4 (noarch): openssl-doc-1.0.1p-71.1 - openSUSE Evergreen 11.4 (ia64): libopenssl1_0_0-debuginfo-x86-1.0.1p-71.1 libopenssl1_0_0-x86-1.0.1p-71.1 References: https://www.suse.com/security/cve/CVE-2015-1794.html https://www.suse.com/security/cve/CVE-2015-3194.html https://www.suse.com/security/cve/CVE-2015-3195.html https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0701.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0798.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/957812 https://bugzilla.suse.com/957815 https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968047 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/968265 https://bugzilla.suse.com/968374

1 0

openSUSE-OU-2016:0635-1: moderate: Add pandoc to SLE 12 Backports
by maintenance＠opensuse.org 02 Mar '16

02 Mar '16

openSUSE Optional Update: Add pandoc to SLE 12 Backports ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:0635-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds pandoc to the SLE 12 Backports project. It also adds pandoc's dependencies: ghc (Glasgow Haskell Compiler). Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-291=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): ghc-HTTP-4000.3.3-2.1 ghc-HTTP-devel-4000.3.3-2.1 ghc-JuicyPixels-3.2.7-2.1 ghc-JuicyPixels-devel-3.2.7-2.1 ghc-SHA-1.6.4.2-2.2 ghc-SHA-devel-1.6.4.2-2.2 ghc-aeson-0.9.0.1-2.1 ghc-aeson-devel-0.9.0.1-2.1 ghc-asn1-encoding-0.9.3-2.2 ghc-asn1-encoding-devel-0.9.3-2.2 ghc-asn1-parse-0.9.4-2.2 ghc-asn1-parse-devel-0.9.4-2.2 ghc-asn1-types-0.3.1-2.2 ghc-asn1-types-devel-0.3.1-2.2 ghc-async-2.1.0-2.1 ghc-async-devel-2.1.0-2.1 ghc-attoparsec-0.13.0.1-2.1 ghc-attoparsec-devel-0.13.0.1-2.1 ghc-base64-bytestring-1.0.0.1-2.2 ghc-base64-bytestring-devel-1.0.0.1-2.2 ghc-blaze-builder-0.4.0.1-2.2 ghc-blaze-builder-devel-0.4.0.1-2.2 ghc-blaze-html-0.8.1.1-2.2 ghc-blaze-html-devel-0.8.1.1-2.2 ghc-blaze-markup-0.7.0.3-2.2 ghc-blaze-markup-devel-0.7.0.3-2.2 ghc-byteable-0.1.1-2.2 ghc-byteable-devel-0.1.1-2.2 ghc-case-insensitive-1.2.0.5-2.2 ghc-case-insensitive-devel-1.2.0.5-2.2 ghc-cereal-0.5.1.0-2.2 ghc-cereal-devel-0.5.1.0-2.2 ghc-clock-0.6.0.1-2.2 ghc-clock-devel-0.6.0.1-2.2 ghc-cmark-0.5.1-2.2 ghc-cmark-devel-0.5.1-2.2 ghc-conduit-1.2.6.2-2.1 ghc-conduit-devel-1.2.6.2-2.1 ghc-connection-0.2.5-2.1 ghc-connection-devel-0.2.5-2.1 ghc-cookie-0.4.1.6-2.1 ghc-cookie-devel-0.4.1.6-2.1 ghc-cryptonite-0.10-2.2 ghc-cryptonite-devel-0.10-2.2 ghc-data-default-0.5.3-2.1 ghc-data-default-class-0.0.1-2.2 ghc-data-default-class-devel-0.0.1-2.2 ghc-data-default-devel-0.5.3-2.1 ghc-data-default-instances-base-0.0.1-2.2 ghc-data-default-instances-base-devel-0.0.1-2.2 ghc-data-default-instances-containers-0.0.1-2.2 ghc-data-default-instances-containers-devel-0.0.1-2.2 ghc-data-default-instances-dlist-0.0.1-2.2 ghc-data-default-instances-dlist-devel-0.0.1-2.2 ghc-data-default-instances-old-locale-0.0.1-2.2 ghc-data-default-instances-old-locale-devel-0.0.1-2.2 ghc-deepseq-generics-0.1.1.2-2.2 ghc-deepseq-generics-devel-0.1.1.2-2.2 ghc-digest-0.0.1.2-2.2 ghc-digest-devel-0.0.1.2-2.2 ghc-dlist-0.7.1.2-2.2 ghc-dlist-devel-0.7.1.2-2.2 ghc-enclosed-exceptions-1.0.1.1-2.1 ghc-enclosed-exceptions-devel-1.0.1.1-2.1 ghc-exceptions-0.8.2.1-2.2 ghc-exceptions-devel-0.8.2.1-2.2 ghc-extensible-exceptions-0.1.1.4-2.2 ghc-extensible-exceptions-devel-0.1.1.4-2.2 ghc-filemanip-0.3.6.3-2.2 ghc-filemanip-devel-0.3.6.3-2.2 ghc-haddock-library-1.2.1-2.2 ghc-haddock-library-devel-1.2.1-2.2 ghc-hashable-1.2.4.0-2.2 ghc-hashable-devel-1.2.4.0-2.2 ghc-highlighting-kate-0.6.1-2.1 ghc-highlighting-kate-devel-0.6.1-2.1 ghc-hourglass-0.2.9-2.2 ghc-hourglass-devel-0.2.9-2.2 ghc-hslua-0.4.1-2.2 ghc-hslua-devel-0.4.1-2.2 ghc-http-client-0.4.27-2.1 ghc-http-client-devel-0.4.27-2.1 ghc-http-client-tls-0.2.2-2.1 ghc-http-client-tls-devel-0.2.2-2.1 ghc-http-types-0.9-2.2 ghc-http-types-devel-0.9-2.2 ghc-lifted-base-0.2.3.6-2.1 ghc-lifted-base-devel-0.2.3.6-2.1 ghc-memory-0.11-2.2 ghc-memory-devel-0.11-2.2 ghc-mime-types-0.1.0.6-2.2 ghc-mime-types-devel-0.1.0.6-2.2 ghc-mmorph-1.0.4-2.2 ghc-mmorph-devel-1.0.4-2.2 ghc-monad-control-1.0.0.5-2.1 ghc-monad-control-devel-1.0.0.5-2.1 ghc-mtl-2.2.1-2.2 ghc-mtl-devel-2.2.1-2.2 ghc-network-2.6.2.1-2.2 ghc-network-devel-2.6.2.1-2.2 ghc-network-uri-2.6.0.3-2.2 ghc-network-uri-devel-2.6.0.3-2.2 ghc-old-locale-1.0.0.7-2.2 ghc-old-locale-devel-1.0.0.7-2.2 ghc-old-time-1.1.0.3-2.2 ghc-old-time-devel-1.1.0.3-2.2 ghc-pandoc-1.16.0.2-2.1 ghc-pandoc-devel-1.16.0.2-2.1 ghc-pandoc-types-1.16.1-2.1 ghc-pandoc-types-devel-1.16.1-2.1 ghc-parsec-3.1.9-2.2 ghc-parsec-devel-3.1.9-2.2 ghc-pem-0.2.2-2.2 ghc-pem-devel-0.2.2-2.2 ghc-primitive-0.6.1.0-2.2 ghc-primitive-devel-0.6.1.0-2.2 ghc-random-1.1-2.2 ghc-random-devel-1.1-2.2 ghc-regex-base-0.93.2-2.2 ghc-regex-base-devel-0.93.2-2.2 ghc-regex-pcre-builtin-0.94.4.8.8.35-2.2 ghc-regex-pcre-builtin-devel-0.94.4.8.8.35-2.2 ghc-resourcet-1.1.7.2-2.1 ghc-resourcet-devel-1.1.7.2-2.1 ghc-scientific-0.3.4.4-2.2 ghc-scientific-devel-0.3.4.4-2.2 ghc-semigroups-0.18.1-2.1 ghc-semigroups-devel-0.18.1-2.1 ghc-socks-0.5.4-2.2 ghc-socks-devel-0.5.4-2.2 ghc-split-0.2.3-2.2 ghc-split-devel-0.2.3-2.2 ghc-stm-2.4.4.1-2.2 ghc-stm-devel-2.4.4.1-2.2 ghc-streaming-commons-0.1.15.1-2.1 ghc-streaming-commons-devel-0.1.15.1-2.1 ghc-syb-0.6-2.2 ghc-syb-devel-0.6-2.2 ghc-tagged-0.8.3-2.1 ghc-tagged-devel-0.8.3-2.1 ghc-tagsoup-0.13.8-2.2 ghc-tagsoup-devel-0.13.8-2.2 ghc-temporary-1.2.0.4-2.2 ghc-temporary-devel-1.2.0.4-2.2 ghc-texmath-0.8.4.2-2.1 ghc-texmath-devel-0.8.4.2-2.1 ghc-text-1.2.2.0-2.2 ghc-text-devel-1.2.2.0-2.2 ghc-tls-1.3.4-2.1 ghc-tls-devel-1.3.4-2.1 ghc-transformers-base-0.4.4-2.2 ghc-transformers-base-devel-0.4.4-2.2 ghc-transformers-compat-0.4.0.4-2.2 ghc-transformers-compat-devel-0.4.0.4-2.2 ghc-unix-compat-0.4.1.4-2.2 ghc-unix-compat-devel-0.4.1.4-2.2 ghc-unordered-containers-0.2.5.1-2.2 ghc-unordered-containers-devel-0.2.5.1-2.2 ghc-utf8-string-1.0.1.1-2.2 ghc-utf8-string-devel-1.0.1.1-2.2 ghc-vector-0.11.0.0-2.2 ghc-vector-devel-0.11.0.0-2.2 ghc-void-0.7.1-2.1 ghc-void-devel-0.7.1-2.1 ghc-x509-1.6.3-2.2 ghc-x509-devel-1.6.3-2.2 ghc-x509-store-1.6.1-2.1 ghc-x509-store-devel-1.6.1-2.1 ghc-x509-system-1.6.3-2.1 ghc-x509-system-devel-1.6.3-2.1 ghc-x509-validation-1.6.3-2.1 ghc-x509-validation-devel-1.6.3-2.1 ghc-xml-1.3.14-2.2 ghc-xml-devel-1.3.14-2.2 ghc-yaml-0.8.16-2.1 ghc-yaml-devel-0.8.16-2.1 ghc-zip-archive-0.2.3.7-2.2 ghc-zip-archive-devel-0.2.3.7-2.2 ghc-zlib-0.6.1.1-2.2 ghc-zlib-devel-0.6.1.1-2.2 highlighting-kate-0.6.1-2.1 pandoc-1.16.0.2-2.1 pandoc-pdf-1.16.0.2-2.1 texmath-0.8.4.2-2.1 References:

1 0

openSUSE-RU-2016:0629-1: Recommended update for inst-source-utils
by maintenance＠opensuse.org 02 Mar '16

02 Mar '16

openSUSE Recommended Update: Recommended update for inst-source-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0629-1 Rating: low References: #910388 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for inst-source-utils provides the following fixes: - Set LC_CTYPE in mk_listings. (bnc#910388) - Add endoflife tag to product structure in ABXML.pm. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-290=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): inst-source-utils-2015.10.27-15.4.1 References: https://bugzilla.suse.com/910388

1 0

openSUSE-SU-2016:0628-1: important: Security update for openssl
by opensuse-security＠opensuse.org 02 Mar '16

02 Mar '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0628-1 Rating: important References: #958501 #963415 #968046 #968047 #968048 #968050 #968051 #968053 #968265 #968374 Cross-References: CVE-2015-3197 CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has one errata is now available. Description: This update for openssl fixes various security issues: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0702 aka the "CacheBleed" attack. (bsc#968050) Various changes in the modular exponentation code were added that make sure that it is not possible to recover RSA secret keys by analyzing cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. Note that this was only exploitable if the malicious code was running on the same hyper threaded Intel Sandy Bridge processor as the victim thread performing decryptions. - CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser code was fixed that could be abused to facilitate a denial-of-service attack. - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0798 (bnc#968265) The SRP user database lookup method SRP_VBASE_get_by_user() had a memory leak that attackers could abuse to facility DoS attacks. To mitigate the issue, the seed handling in SRP_VBASE_get_by_user() was disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user(). - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Also the following bug was fixed: - Ensure that OpenSSL doesn't fall back to the default digest algorithm (SHA1) in case a non-FIPS algorithm was negotiated while running in FIPS mode. Instead, OpenSSL will refuse the session. (bnc#958501) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-289=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl-devel-1.0.1i-12.1 libopenssl1_0_0-1.0.1i-12.1 libopenssl1_0_0-debuginfo-1.0.1i-12.1 libopenssl1_0_0-hmac-1.0.1i-12.1 openssl-1.0.1i-12.1 openssl-debuginfo-1.0.1i-12.1 openssl-debugsource-1.0.1i-12.1 - openSUSE Leap 42.1 (x86_64): libopenssl-devel-32bit-1.0.1i-12.1 libopenssl1_0_0-32bit-1.0.1i-12.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-12.1 libopenssl1_0_0-hmac-32bit-1.0.1i-12.1 - openSUSE Leap 42.1 (noarch): openssl-doc-1.0.1i-12.1 References: https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0703.html https://www.suse.com/security/cve/CVE-2016-0704.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0798.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/958501 https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968047 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/968051 https://bugzilla.suse.com/968053 https://bugzilla.suse.com/968265 https://bugzilla.suse.com/968374

1 0

openSUSE-SU-2016:0627-1: important: Security update for openssl
by opensuse-security＠opensuse.org 02 Mar '16

02 Mar '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0627-1 Rating: important References: #952871 #968046 #968047 #968048 #968050 #968265 #968374 Cross-References: CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for openssl fixes the following issues: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. Please also note that we built the 13.2 openSUSE openssl already with "no-ssl2". * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0702 aka the "CacheBleed" attack. (bsc#968050) Various changes in the modular exponentation code were added that make sure that it is not possible to recover RSA secret keys by analyzing cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. Note that this was only exploitable if the malicious code was running on the same hyper threaded Intel Sandy Bridge processor as the victim thread performing decryptions. - CVE-2016-0705 (bnc#968047): A double free() bug in the DSA ASN1 parser code was fixed that could be abused to facilitate a denial-of-service attack. - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0798 (bnc#968265) The SRP user database lookup method SRP_VBASE_get_by_user() had a memory leak that attackers could abuse to facility DoS attacks. To mitigate the issue, the seed handling in SRP_VBASE_get_by_user() was disabled even if the user has configured a seed. Applications are advised to - We're unaffected by CVE-2016-0799 (boo#968374) because we use glibc's printf implementation instead of the built in one Bugs fixed: - avoid running OPENSSL_config twice. This avoids breaking engine loading. (boo#952871) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-288=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.33.1 libopenssl1_0_0-1.0.1k-2.33.1 libopenssl1_0_0-debuginfo-1.0.1k-2.33.1 libopenssl1_0_0-hmac-1.0.1k-2.33.1 openssl-1.0.1k-2.33.1 openssl-debuginfo-1.0.1k-2.33.1 openssl-debugsource-1.0.1k-2.33.1 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.33.1 libopenssl1_0_0-32bit-1.0.1k-2.33.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.33.1 libopenssl1_0_0-hmac-32bit-1.0.1k-2.33.1 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.33.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0798.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/952871 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968047 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/968265 https://bugzilla.suse.com/968374

1 0

openSUSE-SU-2016:0613-1: moderate: Security update for libqt5-qtbase
by opensuse-security＠opensuse.org 01 Mar '16

01 Mar '16

openSUSE Security Update: Security update for libqt5-qtbase ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0613-1 Rating: moderate References: #865241 #957006 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libqt5-qtbase fixes the following issues: - boo#865241: disable RC4 based ciphers which are now considered insecure The following non-security bugs were fixed: - boo#957006: dolphin freeze when opening a folder containing symlinks to special files Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 4723=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libQt5Bootstrap-devel-static-5.5.1-10.1 libQt5Concurrent-devel-5.5.1-10.1 libQt5Concurrent5-5.5.1-10.1 libQt5Concurrent5-debuginfo-5.5.1-10.1 libQt5Core-devel-5.5.1-10.1 libQt5Core5-5.5.1-10.1 libQt5Core5-debuginfo-5.5.1-10.1 libQt5DBus-devel-5.5.1-10.1 libQt5DBus-devel-debuginfo-5.5.1-10.1 libQt5DBus5-5.5.1-10.1 libQt5DBus5-debuginfo-5.5.1-10.1 libQt5Gui-devel-5.5.1-10.1 libQt5Gui5-5.5.1-10.1 libQt5Gui5-debuginfo-5.5.1-10.1 libQt5Network-devel-5.5.1-10.1 libQt5Network5-5.5.1-10.1 libQt5Network5-debuginfo-5.5.1-10.1 libQt5OpenGL-devel-5.5.1-10.1 libQt5OpenGL5-5.5.1-10.1 libQt5OpenGL5-debuginfo-5.5.1-10.1 libQt5OpenGLExtensions-devel-static-5.5.1-10.1 libQt5PlatformHeaders-devel-5.5.1-10.1 libQt5PlatformSupport-devel-static-5.5.1-10.1 libQt5PrintSupport-devel-5.5.1-10.1 libQt5PrintSupport5-5.5.1-10.1 libQt5PrintSupport5-debuginfo-5.5.1-10.1 libQt5Sql-devel-5.5.1-10.1 libQt5Sql5-5.5.1-10.1 libQt5Sql5-debuginfo-5.5.1-10.1 libQt5Sql5-mysql-5.5.1-10.1 libQt5Sql5-mysql-debuginfo-5.5.1-10.1 libQt5Sql5-postgresql-5.5.1-10.1 libQt5Sql5-postgresql-debuginfo-5.5.1-10.1 libQt5Sql5-sqlite-5.5.1-10.1 libQt5Sql5-sqlite-debuginfo-5.5.1-10.1 libQt5Sql5-unixODBC-5.5.1-10.1 libQt5Sql5-unixODBC-debuginfo-5.5.1-10.1 libQt5Test-devel-5.5.1-10.1 libQt5Test5-5.5.1-10.1 libQt5Test5-debuginfo-5.5.1-10.1 libQt5Widgets-devel-5.5.1-10.1 libQt5Widgets5-5.5.1-10.1 libQt5Widgets5-debuginfo-5.5.1-10.1 libQt5Xml-devel-5.5.1-10.1 libQt5Xml5-5.5.1-10.1 libQt5Xml5-debuginfo-5.5.1-10.1 libqt5-qtbase-common-devel-5.5.1-10.1 libqt5-qtbase-common-devel-debuginfo-5.5.1-10.1 libqt5-qtbase-debugsource-5.5.1-10.1 libqt5-qtbase-devel-5.5.1-10.1 libqt5-qtbase-doc-5.5.1-10.1 libqt5-qtbase-doc-debuginfo-5.5.1-10.1 libqt5-qtbase-examples-5.5.1-10.1 libqt5-qtbase-examples-debuginfo-5.5.1-10.1 libqt5-qtbase-platformtheme-gtk2-5.5.1-10.1 libqt5-qtbase-platformtheme-gtk2-debuginfo-5.5.1-10.1 - openSUSE Leap 42.1 (x86_64): libQt5Bootstrap-devel-static-32bit-5.5.1-10.1 libQt5Concurrent-devel-32bit-5.5.1-10.1 libQt5Concurrent5-32bit-5.5.1-10.1 libQt5Concurrent5-debuginfo-32bit-5.5.1-10.1 libQt5Core-devel-32bit-5.5.1-10.1 libQt5Core5-32bit-5.5.1-10.1 libQt5Core5-debuginfo-32bit-5.5.1-10.1 libQt5DBus-devel-32bit-5.5.1-10.1 libQt5DBus-devel-debuginfo-32bit-5.5.1-10.1 libQt5DBus5-32bit-5.5.1-10.1 libQt5DBus5-debuginfo-32bit-5.5.1-10.1 libQt5Gui-devel-32bit-5.5.1-10.1 libQt5Gui5-32bit-5.5.1-10.1 libQt5Gui5-debuginfo-32bit-5.5.1-10.1 libQt5Network-devel-32bit-5.5.1-10.1 libQt5Network5-32bit-5.5.1-10.1 libQt5Network5-debuginfo-32bit-5.5.1-10.1 libQt5OpenGL-devel-32bit-5.5.1-10.1 libQt5OpenGL5-32bit-5.5.1-10.1 libQt5OpenGL5-debuginfo-32bit-5.5.1-10.1 libQt5OpenGLExtensions-devel-static-32bit-5.5.1-10.1 libQt5PlatformSupport-devel-static-32bit-5.5.1-10.1 libQt5PrintSupport-devel-32bit-5.5.1-10.1 libQt5PrintSupport5-32bit-5.5.1-10.1 libQt5PrintSupport5-debuginfo-32bit-5.5.1-10.1 libQt5Sql-devel-32bit-5.5.1-10.1 libQt5Sql5-32bit-5.5.1-10.1 libQt5Sql5-debuginfo-32bit-5.5.1-10.1 libQt5Sql5-mysql-32bit-5.5.1-10.1 libQt5Sql5-mysql-debuginfo-32bit-5.5.1-10.1 libQt5Sql5-postgresql-32bit-5.5.1-10.1 libQt5Sql5-postgresql-debuginfo-32bit-5.5.1-10.1 libQt5Sql5-sqlite-32bit-5.5.1-10.1 libQt5Sql5-sqlite-debuginfo-32bit-5.5.1-10.1 libQt5Sql5-unixODBC-32bit-5.5.1-10.1 libQt5Sql5-unixODBC-debuginfo-32bit-5.5.1-10.1 libQt5Test-devel-32bit-5.5.1-10.1 libQt5Test5-32bit-5.5.1-10.1 libQt5Test5-debuginfo-32bit-5.5.1-10.1 libQt5Widgets-devel-32bit-5.5.1-10.1 libQt5Widgets5-32bit-5.5.1-10.1 libQt5Widgets5-debuginfo-32bit-5.5.1-10.1 libQt5Xml-devel-32bit-5.5.1-10.1 libQt5Xml5-32bit-5.5.1-10.1 libQt5Xml5-debuginfo-32bit-5.5.1-10.1 libqt5-qtbase-examples-32bit-5.5.1-10.1 libqt5-qtbase-examples-debuginfo-32bit-5.5.1-10.1 - openSUSE Leap 42.1 (noarch): libQt5Core-private-headers-devel-5.5.1-10.1 libQt5DBus-private-headers-devel-5.5.1-10.1 libQt5Gui-private-headers-devel-5.5.1-10.1 libQt5Network-private-headers-devel-5.5.1-10.1 libQt5OpenGL-private-headers-devel-5.5.1-10.1 libQt5PlatformSupport-private-headers-devel-5.5.1-10.1 libQt5PrintSupport-private-headers-devel-5.5.1-10.1 libQt5Sql-private-headers-devel-5.5.1-10.1 libQt5Test-private-headers-devel-5.5.1-10.1 libQt5Widgets-private-headers-devel-5.5.1-10.1 libqt5-qtbase-private-headers-devel-5.5.1-10.1 References: https://bugzilla.suse.com/865241 https://bugzilla.suse.com/957006

1 0

openSUSE-SU-2016:0612-1: moderate: Recommended update for KDE Frameworks
by opensuse-security＠opensuse.org 01 Mar '16

01 Mar '16

openSUSE Security Update: Recommended update for KDE Frameworks ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0612-1 Rating: moderate References: #955280 #963680 #967668 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update contains KDE Frameworks 5.19.0 (boo#967668) For details, see https://www.kde.org/announcements/kde-frameworks-5.19.0.php The following bugs were fixed in specific packages: kxmlgui, kdelibs4support: - boo#955280: session not restored after logout/login kio: - boo#963680: Unable to create new link to application - Install "Create New" templates as a workaround Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-287=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): attica-qt5-debugsource-5.19.0-6.3 attica-qt5-devel-5.19.0-6.3 baloo5-5.19.0-6.2 baloo5-debugsource-5.19.0-6.2 baloo5-devel-5.19.0-6.2 baloo5-file-5.19.0-6.2 baloo5-file-debuginfo-5.19.0-6.2 baloo5-imports-5.19.0-6.2 baloo5-imports-debuginfo-5.19.0-6.2 baloo5-kioslaves-5.19.0-6.2 baloo5-kioslaves-debuginfo-5.19.0-6.2 baloo5-tools-5.19.0-6.2 baloo5-tools-debuginfo-5.19.0-6.2 bluez-qt-debugsource-5.19.0-6.3 bluez-qt-devel-5.19.0-6.3 bluez-qt-imports-5.19.0-6.3 bluez-qt-imports-debuginfo-5.19.0-6.3 bluez-qt-udev-5.19.0-6.3 extra-cmake-modules-5.19.0-6.3 frameworkintegration-debugsource-5.19.0-9.2 frameworkintegration-devel-5.19.0-9.2 frameworkintegration-plugin-5.19.0-9.2 frameworkintegration-plugin-debuginfo-5.19.0-9.2 kactivities5-5.19.0-11.2 kactivities5-debuginfo-5.19.0-11.2 kactivities5-debugsource-5.19.0-11.2 kactivities5-devel-5.19.0-11.2 kactivities5-imports-5.19.0-11.2 kactivities5-imports-debuginfo-5.19.0-11.2 kapidox-5.19.0-6.3 karchive-debugsource-5.19.0-6.3 karchive-devel-5.19.0-6.3 kauth-debugsource-5.19.0-6.3 kauth-devel-5.19.0-6.3 kbookmarks-debugsource-5.19.0-6.2 kbookmarks-devel-5.19.0-6.2 kcmutils-debugsource-5.19.0-6.2 kcmutils-devel-5.19.0-6.2 kcodecs-debugsource-5.19.0-6.3 kcodecs-devel-5.19.0-6.3 kcompletion-debugsource-5.19.0-6.3 kcompletion-devel-5.19.0-6.3 kconf_update5-5.19.0-6.3 kconf_update5-debuginfo-5.19.0-6.3 kconfig-debugsource-5.19.0-6.3 kconfig-devel-5.19.0-6.3 kconfig-devel-debuginfo-5.19.0-6.3 kconfigwidgets-debugsource-5.19.0-6.3 kconfigwidgets-devel-5.19.0-6.3 kcoreaddons-5.19.0-6.3 kcoreaddons-debugsource-5.19.0-6.3 kcoreaddons-devel-5.19.0-6.3 kcoreaddons-devel-debuginfo-5.19.0-6.3 kcrash-debugsource-5.19.0-8.1 kcrash-devel-5.19.0-8.1 kdbusaddons-debugsource-5.19.0-6.3 kdbusaddons-devel-5.19.0-6.3 kdbusaddons-tools-5.19.0-6.3 kdbusaddons-tools-debuginfo-5.19.0-6.3 kdeclarative-components-5.19.0-6.2 kdeclarative-components-debuginfo-5.19.0-6.2 kdeclarative-debugsource-5.19.0-6.2 kdeclarative-devel-5.19.0-6.2 kdeclarative-tools-5.19.0-6.2 kdeclarative-tools-debuginfo-5.19.0-6.2 kded-5.19.0-6.2 kded-debuginfo-5.19.0-6.2 kded-debugsource-5.19.0-6.2 kded-devel-5.19.0-6.2 kdelibs4support-5.19.0-6.6 kdelibs4support-debuginfo-5.19.0-6.6 kdelibs4support-debugsource-5.19.0-6.6 kdelibs4support-devel-5.19.0-6.6 kdesignerplugin-5.19.0-6.7 kdesignerplugin-debuginfo-5.19.0-6.7 kdesignerplugin-debugsource-5.19.0-6.7 kdesignerplugin-devel-5.19.0-6.7 kdesu-debugsource-5.19.0-6.2 kdesu-devel-5.19.0-6.2 kdewebkit-debugsource-5.19.0-6.2 kdewebkit-devel-5.19.0-6.2 kdnssd-framework-debugsource-5.19.0-6.3 kdnssd-framework-devel-5.19.0-6.3 kdoctools-5.19.0-6.3 kdoctools-debuginfo-5.19.0-6.3 kdoctools-debugsource-5.19.0-6.3 kdoctools-devel-5.19.0-6.3 kemoticons-debugsource-5.19.0-6.2 kemoticons-devel-5.19.0-6.2 kfilemetadata5-5.19.0-9.3 kfilemetadata5-debuginfo-5.19.0-9.3 kfilemetadata5-debugsource-5.19.0-9.3 kfilemetadata5-devel-5.19.0-9.3 kglobalaccel-debugsource-5.19.0-6.2 kglobalaccel-devel-5.19.0-6.2 kglobalaccel5-5.19.0-6.2 kglobalaccel5-debuginfo-5.19.0-6.2 kguiaddons-debugsource-5.19.0-6.3 kguiaddons-devel-5.19.0-6.3 khtml-debugsource-5.19.0-6.2 khtml-devel-5.19.0-6.2 ki18n-debugsource-5.19.0-6.3 ki18n-devel-5.19.0-6.3 kiconthemes-debugsource-5.19.0-6.3 kiconthemes-devel-5.19.0-6.3 kiconthemes-devel-debuginfo-5.19.0-6.3 kidletime-debugsource-5.19.0-6.3 kidletime-devel-5.19.0-6.3 kimageformats-5.19.0-6.3 kimageformats-debuginfo-5.19.0-6.3 kimageformats-debugsource-5.19.0-6.3 kinit-5.19.0-6.2 kinit-debuginfo-5.19.0-6.2 kinit-debugsource-5.19.0-6.2 kinit-devel-5.19.0-6.2 kio-5.19.0-12.5 kio-core-5.19.0-12.5 kio-core-debuginfo-5.19.0-12.5 kio-debuginfo-5.19.0-12.5 kio-debugsource-5.19.0-12.5 kio-devel-5.19.0-12.5 kio-devel-debuginfo-5.19.0-12.5 kitemmodels-debugsource-5.19.0-6.3 kitemmodels-devel-5.19.0-6.3 kitemviews-debugsource-5.19.0-6.3 kitemviews-devel-5.19.0-6.3 kjobwidgets-debugsource-5.19.0-6.3 kjobwidgets-devel-5.19.0-6.3 kjs-debugsource-5.19.0-6.3 kjs-devel-5.19.0-6.3 kjs-devel-debuginfo-5.19.0-6.3 kjsembed-debugsource-5.19.0-6.3 kjsembed-devel-5.19.0-6.3 kjsembed-devel-debuginfo-5.19.0-6.3 kmediaplayer-debugsource-5.19.0-6.2 kmediaplayer-devel-5.19.0-6.2 knewstuff-debugsource-5.19.0-6.2 knewstuff-devel-5.19.0-6.2 knotifications-debugsource-5.19.0-6.3 knotifications-devel-5.19.0-6.3 knotifyconfig-debugsource-5.19.0-6.2 knotifyconfig-devel-5.19.0-6.2 kpackage-5.19.0-6.3 kpackage-debuginfo-5.19.0-6.3 kpackage-debugsource-5.19.0-6.3 kpackage-devel-5.19.0-6.3 kparts-debugsource-5.19.0-6.2 kparts-devel-5.19.0-6.2 kpeople5-5.19.0-6.2 kpeople5-debuginfo-5.19.0-6.2 kpeople5-debugsource-5.19.0-6.2 kpeople5-devel-5.19.0-6.2 kplotting-debugsource-5.19.0-6.3 kplotting-devel-5.19.0-6.3 kpty-debugsource-5.19.0-6.3 kpty-devel-5.19.0-6.3 kross-5.19.0-6.2 kross-debuginfo-5.19.0-6.2 kross-debugsource-5.19.0-6.2 kross-devel-5.19.0-6.2 kross-devel-debuginfo-5.19.0-6.2 krunner-debugsource-5.19.0-6.2 krunner-devel-5.19.0-6.2 kservice-5.19.0-7.2 kservice-debuginfo-5.19.0-7.2 kservice-debugsource-5.19.0-7.2 kservice-devel-5.19.0-7.2 kssl-5.19.0-6.6 kssl-debuginfo-5.19.0-6.6 ktexteditor-5.19.0-6.3 ktexteditor-debuginfo-5.19.0-6.3 ktexteditor-debugsource-5.19.0-6.3 ktexteditor-devel-5.19.0-6.3 ktextwidgets-debugsource-5.19.0-6.2 ktextwidgets-devel-5.19.0-6.2 kunitconversion-debugsource-5.19.0-6.3 kunitconversion-devel-5.19.0-6.3 kwallet-debugsource-5.19.0-6.2 kwallet-devel-5.19.0-6.2 kwallet-tools-5.19.0-6.2 kwallet-tools-debuginfo-5.19.0-6.2 kwallet-tools-lang-5.19.0-6.2 kwalletd5-5.19.0-6.2 kwalletd5-debuginfo-5.19.0-6.2 kwidgetsaddons-debugsource-5.19.0-6.3 kwidgetsaddons-devel-5.19.0-6.3 kwindowsystem-debugsource-5.19.0-6.3 kwindowsystem-devel-5.19.0-6.3 kxmlgui-debugsource-5.19.0-6.2 kxmlgui-devel-5.19.0-6.2 kxmlrpcclient5-debugsource-5.19.0-6.2 kxmlrpcclient5-devel-5.19.0-6.2 libKF5Activities5-5.19.0-11.2 libKF5Activities5-debuginfo-5.19.0-11.2 libKF5Archive5-5.19.0-6.3 libKF5Archive5-debuginfo-5.19.0-6.3 libKF5Attica5-5.19.0-6.3 libKF5Attica5-debuginfo-5.19.0-6.3 libKF5Auth5-5.19.0-6.3 libKF5Auth5-debuginfo-5.19.0-6.3 libKF5Baloo5-5.19.0-6.2 libKF5Baloo5-debuginfo-5.19.0-6.2 libKF5BalooEngine5-5.19.0-6.2 libKF5BalooEngine5-debuginfo-5.19.0-6.2 libKF5BluezQt6-5.19.0-6.3 libKF5BluezQt6-debuginfo-5.19.0-6.3 libKF5Bookmarks5-5.19.0-6.2 libKF5Bookmarks5-debuginfo-5.19.0-6.2 libKF5CalendarEvents5-5.19.0-6.2 libKF5CalendarEvents5-debuginfo-5.19.0-6.2 libKF5Codecs5-5.19.0-6.3 libKF5Codecs5-debuginfo-5.19.0-6.3 libKF5Completion5-5.19.0-6.3 libKF5Completion5-debuginfo-5.19.0-6.3 libKF5ConfigCore5-5.19.0-6.3 libKF5ConfigCore5-debuginfo-5.19.0-6.3 libKF5ConfigGui5-5.19.0-6.3 libKF5ConfigGui5-debuginfo-5.19.0-6.3 libKF5ConfigWidgets5-5.19.0-6.3 libKF5ConfigWidgets5-debuginfo-5.19.0-6.3 libKF5CoreAddons5-5.19.0-6.3 libKF5CoreAddons5-debuginfo-5.19.0-6.3 libKF5Crash5-5.19.0-8.1 libKF5Crash5-debuginfo-5.19.0-8.1 libKF5DBusAddons5-5.19.0-6.3 libKF5DBusAddons5-debuginfo-5.19.0-6.3 libKF5DNSSD5-5.19.0-6.3 libKF5DNSSD5-debuginfo-5.19.0-6.3 libKF5Declarative5-5.19.0-6.2 libKF5Declarative5-debuginfo-5.19.0-6.2 libKF5Emoticons5-5.19.0-6.2 libKF5Emoticons5-debuginfo-5.19.0-6.2 libKF5GlobalAccel5-5.19.0-6.2 libKF5GlobalAccel5-debuginfo-5.19.0-6.2 libKF5GlobalAccelPrivate5-5.19.0-6.2 libKF5GlobalAccelPrivate5-debuginfo-5.19.0-6.2 libKF5GuiAddons5-5.19.0-6.3 libKF5GuiAddons5-debuginfo-5.19.0-6.3 libKF5I18n5-5.19.0-6.3 libKF5I18n5-debuginfo-5.19.0-6.3 libKF5IconThemes5-5.19.0-6.3 libKF5IconThemes5-debuginfo-5.19.0-6.3 libKF5IdleTime5-5.19.0-6.3 libKF5IdleTime5-debuginfo-5.19.0-6.3 libKF5ItemModels5-5.19.0-6.3 libKF5ItemModels5-debuginfo-5.19.0-6.3 libKF5ItemViews5-5.19.0-6.3 libKF5ItemViews5-debuginfo-5.19.0-6.3 libKF5JS5-5.19.0-6.3 libKF5JS5-debuginfo-5.19.0-6.3 libKF5JSApi5-5.19.0-6.3 libKF5JSApi5-debuginfo-5.19.0-6.3 libKF5JobWidgets5-5.19.0-6.3 libKF5JobWidgets5-debuginfo-5.19.0-6.3 libKF5JsEmbed5-5.19.0-6.3 libKF5JsEmbed5-debuginfo-5.19.0-6.3 libKF5KCMUtils5-5.19.0-6.2 libKF5KCMUtils5-debuginfo-5.19.0-6.2 libKF5KDELibs4Support5-5.19.0-6.6 libKF5KDELibs4Support5-debuginfo-5.19.0-6.6 libKF5KHtml5-5.19.0-6.2 libKF5KHtml5-debuginfo-5.19.0-6.2 libKF5MediaPlayer5-5.19.0-6.2 libKF5MediaPlayer5-debuginfo-5.19.0-6.2 libKF5ModemManagerQt-debugsource-5.19.0-6.3 libKF5ModemManagerQt-devel-5.19.0-6.3 libKF5ModemManagerQt6-5.19.0-6.3 libKF5ModemManagerQt6-debuginfo-5.19.0-6.3 libKF5NetworkManagerQt-debugsource-5.19.0-6.3 libKF5NetworkManagerQt-devel-5.19.0-6.3 libKF5NetworkManagerQt6-5.19.0-6.3 libKF5NetworkManagerQt6-debuginfo-5.19.0-6.3 libKF5NewStuff5-5.19.0-6.2 libKF5NewStuff5-debuginfo-5.19.0-6.2 libKF5Notifications5-5.19.0-6.3 libKF5Notifications5-debuginfo-5.19.0-6.3 libKF5NotifyConfig5-5.19.0-6.2 libKF5NotifyConfig5-debuginfo-5.19.0-6.2 libKF5Parts5-5.19.0-6.2 libKF5Parts5-debuginfo-5.19.0-6.2 libKF5Plotting5-5.19.0-6.3 libKF5Plotting5-debuginfo-5.19.0-6.3 libKF5Pty5-5.19.0-6.3 libKF5Pty5-debuginfo-5.19.0-6.3 libKF5QuickAddons5-5.19.0-6.2 libKF5QuickAddons5-debuginfo-5.19.0-6.2 libKF5Runner5-5.19.0-6.2 libKF5Runner5-debuginfo-5.19.0-6.2 libKF5Solid5-5.19.0-6.3 libKF5Solid5-debuginfo-5.19.0-6.3 libKF5SonnetCore5-5.19.0-6.7 libKF5SonnetCore5-debuginfo-5.19.0-6.7 libKF5SonnetUi5-5.19.0-6.7 libKF5SonnetUi5-debuginfo-5.19.0-6.7 libKF5Style5-5.19.0-9.2 libKF5Style5-debuginfo-5.19.0-9.2 libKF5Su5-5.19.0-6.2 libKF5Su5-debuginfo-5.19.0-6.2 libKF5TextWidgets5-5.19.0-6.2 libKF5TextWidgets5-debuginfo-5.19.0-6.2 libKF5ThreadWeaver5-5.19.0-6.3 libKF5ThreadWeaver5-debuginfo-5.19.0-6.3 libKF5UnitConversion5-5.19.0-6.3 libKF5UnitConversion5-debuginfo-5.19.0-6.3 libKF5Wallet5-5.19.0-6.2 libKF5Wallet5-debuginfo-5.19.0-6.2 libKF5WebKit5-5.19.0-6.2 libKF5WebKit5-debuginfo-5.19.0-6.2 libKF5WidgetsAddons5-5.19.0-6.3 libKF5WidgetsAddons5-debuginfo-5.19.0-6.3 libKF5WindowSystem5-5.19.0-6.3 libKF5WindowSystem5-debuginfo-5.19.0-6.3 libKF5XmlGui5-5.19.0-6.2 libKF5XmlGui5-debuginfo-5.19.0-6.2 libKF5XmlRpcClient5-5.19.0-6.2 libKF5XmlRpcClient5-debuginfo-5.19.0-6.2 libkwalletbackend5-5-5.19.0-6.2 libkwalletbackend5-5-debuginfo-5.19.0-6.2 plasma-framework-5.19.0-6.2 plasma-framework-components-5.19.0-6.2 plasma-framework-components-debuginfo-5.19.0-6.2 plasma-framework-debuginfo-5.19.0-6.2 plasma-framework-debugsource-5.19.0-6.2 plasma-framework-devel-5.19.0-6.2 plasma-framework-private-5.19.0-6.2 plasma-framework-private-debuginfo-5.19.0-6.2 solid-debugsource-5.19.0-6.3 solid-devel-5.19.0-6.3 solid-imports-5.19.0-6.3 solid-imports-debuginfo-5.19.0-6.3 solid-tools-5.19.0-6.3 solid-tools-debuginfo-5.19.0-6.3 sonnet-debugsource-5.19.0-6.7 sonnet-devel-5.19.0-6.7 threadweaver-debugsource-5.19.0-6.3 threadweaver-devel-5.19.0-6.3 - openSUSE Leap 42.1 (x86_64): attica-qt5-devel-32bit-5.19.0-6.3 frameworkintegration-devel-32bit-5.19.0-9.2 frameworkintegration-plugin-32bit-5.19.0-9.2 frameworkintegration-plugin-debuginfo-32bit-5.19.0-9.2 kactivities5-devel-32bit-5.19.0-11.2 karchive-devel-32bit-5.19.0-6.3 kauth-devel-32bit-5.19.0-6.3 kbookmarks-devel-32bit-5.19.0-6.2 kcmutils-devel-32bit-5.19.0-6.2 kcodecs-devel-32bit-5.19.0-6.3 kcompletion-devel-32bit-5.19.0-6.3 kconfig-devel-32bit-5.19.0-6.3 kconfig-devel-debuginfo-32bit-5.19.0-6.3 kconfigwidgets-devel-32bit-5.19.0-6.3 kcoreaddons-devel-32bit-5.19.0-6.3 kcoreaddons-devel-debuginfo-32bit-5.19.0-6.3 kcrash-devel-32bit-5.19.0-8.1 kdbusaddons-devel-32bit-5.19.0-6.3 kdeclarative-components-32bit-5.19.0-6.2 kdeclarative-components-debuginfo-32bit-5.19.0-6.2 kdeclarative-devel-32bit-5.19.0-6.2 kdelibs4support-32bit-5.19.0-6.6 kdelibs4support-debuginfo-32bit-5.19.0-6.6 kdelibs4support-devel-32bit-5.19.0-6.6 kdesu-devel-32bit-5.19.0-6.2 kdewebkit-devel-32bit-5.19.0-6.2 kdnssd-framework-devel-32bit-5.19.0-6.3 kemoticons-devel-32bit-5.19.0-6.2 kfilemetadata5-32bit-5.19.0-9.3 kfilemetadata5-debuginfo-32bit-5.19.0-9.3 kglobalaccel-devel-32bit-5.19.0-6.2 kguiaddons-devel-32bit-5.19.0-6.3 khtml-devel-32bit-5.19.0-6.2 ki18n-devel-32bit-5.19.0-6.3 kiconthemes-devel-32bit-5.19.0-6.3 kiconthemes-devel-debuginfo-32bit-5.19.0-6.3 kidletime-devel-32bit-5.19.0-6.3 kimageformats-32bit-5.19.0-6.3 kimageformats-debuginfo-32bit-5.19.0-6.3 kinit-32bit-5.19.0-6.2 kinit-debuginfo-32bit-5.19.0-6.2 kio-32bit-5.19.0-12.5 kio-core-32bit-5.19.0-12.5 kio-core-debuginfo-32bit-5.19.0-12.5 kio-debuginfo-32bit-5.19.0-12.5 kio-devel-32bit-5.19.0-12.5 kio-devel-debuginfo-32bit-5.19.0-12.5 kitemmodels-devel-32bit-5.19.0-6.3 kitemviews-devel-32bit-5.19.0-6.3 kjobwidgets-devel-32bit-5.19.0-6.3 kjs-devel-32bit-5.19.0-6.3 kjs-devel-debuginfo-32bit-5.19.0-6.3 kjsembed-devel-32bit-5.19.0-6.3 kjsembed-devel-debuginfo-32bit-5.19.0-6.3 kmediaplayer-devel-32bit-5.19.0-6.2 knewstuff-devel-32bit-5.19.0-6.2 knotifications-devel-32bit-5.19.0-6.3 knotifyconfig-devel-32bit-5.19.0-6.2 kpackage-32bit-5.19.0-6.3 kpackage-debuginfo-32bit-5.19.0-6.3 kpackage-devel-32bit-5.19.0-6.3 kparts-devel-32bit-5.19.0-6.2 kpeople5-32bit-5.19.0-6.2 kpeople5-debuginfo-32bit-5.19.0-6.2 kpeople5-devel-32bit-5.19.0-6.2 kplotting-devel-32bit-5.19.0-6.3 kpty-devel-32bit-5.19.0-6.3 kross-32bit-5.19.0-6.2 kross-debuginfo-32bit-5.19.0-6.2 kross-devel-32bit-5.19.0-6.2 kross-devel-debuginfo-32bit-5.19.0-6.2 krunner-devel-32bit-5.19.0-6.2 kservice-32bit-5.19.0-7.2 kservice-debuginfo-32bit-5.19.0-7.2 kservice-devel-32bit-5.19.0-7.2 ktexteditor-32bit-5.19.0-6.3 ktexteditor-debuginfo-32bit-5.19.0-6.3 ktexteditor-devel-32bit-5.19.0-6.3 ktextwidgets-devel-32bit-5.19.0-6.2 kunitconversion-devel-32bit-5.19.0-6.3 kwallet-devel-32bit-5.19.0-6.2 kwidgetsaddons-devel-32bit-5.19.0-6.3 kwindowsystem-devel-32bit-5.19.0-6.3 kxmlgui-devel-32bit-5.19.0-6.2 kxmlrpcclient5-devel-32bit-5.19.0-6.2 libKF5Activities5-32bit-5.19.0-11.2 libKF5Activities5-debuginfo-32bit-5.19.0-11.2 libKF5Archive5-32bit-5.19.0-6.3 libKF5Archive5-debuginfo-32bit-5.19.0-6.3 libKF5Attica5-32bit-5.19.0-6.3 libKF5Attica5-debuginfo-32bit-5.19.0-6.3 libKF5Auth5-32bit-5.19.0-6.3 libKF5Auth5-debuginfo-32bit-5.19.0-6.3 libKF5Baloo5-32bit-5.19.0-6.2 libKF5Baloo5-debuginfo-32bit-5.19.0-6.2 libKF5BalooEngine5-32bit-5.19.0-6.2 libKF5BalooEngine5-debuginfo-32bit-5.19.0-6.2 libKF5Bookmarks5-32bit-5.19.0-6.2 libKF5Bookmarks5-debuginfo-32bit-5.19.0-6.2 libKF5CalendarEvents5-32bit-5.19.0-6.2 libKF5CalendarEvents5-debuginfo-32bit-5.19.0-6.2 libKF5Codecs5-32bit-5.19.0-6.3 libKF5Codecs5-debuginfo-32bit-5.19.0-6.3 libKF5Completion5-32bit-5.19.0-6.3 libKF5Completion5-debuginfo-32bit-5.19.0-6.3 libKF5ConfigCore5-32bit-5.19.0-6.3 libKF5ConfigCore5-debuginfo-32bit-5.19.0-6.3 libKF5ConfigGui5-32bit-5.19.0-6.3 libKF5ConfigGui5-debuginfo-32bit-5.19.0-6.3 libKF5ConfigWidgets5-32bit-5.19.0-6.3 libKF5ConfigWidgets5-debuginfo-32bit-5.19.0-6.3 libKF5CoreAddons5-32bit-5.19.0-6.3 libKF5CoreAddons5-debuginfo-32bit-5.19.0-6.3 libKF5Crash5-32bit-5.19.0-8.1 libKF5Crash5-debuginfo-32bit-5.19.0-8.1 libKF5DBusAddons5-32bit-5.19.0-6.3 libKF5DBusAddons5-debuginfo-32bit-5.19.0-6.3 libKF5DNSSD5-32bit-5.19.0-6.3 libKF5DNSSD5-debuginfo-32bit-5.19.0-6.3 libKF5Declarative5-32bit-5.19.0-6.2 libKF5Declarative5-debuginfo-32bit-5.19.0-6.2 libKF5Emoticons5-32bit-5.19.0-6.2 libKF5Emoticons5-debuginfo-32bit-5.19.0-6.2 libKF5GlobalAccel5-32bit-5.19.0-6.2 libKF5GlobalAccel5-debuginfo-32bit-5.19.0-6.2 libKF5GuiAddons5-32bit-5.19.0-6.3 libKF5GuiAddons5-debuginfo-32bit-5.19.0-6.3 libKF5I18n5-32bit-5.19.0-6.3 libKF5I18n5-debuginfo-32bit-5.19.0-6.3 libKF5IconThemes5-32bit-5.19.0-6.3 libKF5IconThemes5-debuginfo-32bit-5.19.0-6.3 libKF5IdleTime5-32bit-5.19.0-6.3 libKF5IdleTime5-debuginfo-32bit-5.19.0-6.3 libKF5ItemModels5-32bit-5.19.0-6.3 libKF5ItemModels5-debuginfo-32bit-5.19.0-6.3 libKF5ItemViews5-32bit-5.19.0-6.3 libKF5ItemViews5-debuginfo-32bit-5.19.0-6.3 libKF5JS5-32bit-5.19.0-6.3 libKF5JS5-debuginfo-32bit-5.19.0-6.3 libKF5JSApi5-32bit-5.19.0-6.3 libKF5JSApi5-debuginfo-32bit-5.19.0-6.3 libKF5JobWidgets5-32bit-5.19.0-6.3 libKF5JobWidgets5-debuginfo-32bit-5.19.0-6.3 libKF5JsEmbed5-32bit-5.19.0-6.3 libKF5JsEmbed5-debuginfo-32bit-5.19.0-6.3 libKF5KCMUtils5-32bit-5.19.0-6.2 libKF5KCMUtils5-debuginfo-32bit-5.19.0-6.2 libKF5KDELibs4Support5-32bit-5.19.0-6.6 libKF5KDELibs4Support5-debuginfo-32bit-5.19.0-6.6 libKF5KHtml5-32bit-5.19.0-6.2 libKF5KHtml5-debuginfo-32bit-5.19.0-6.2 libKF5MediaPlayer5-32bit-5.19.0-6.2 libKF5MediaPlayer5-debuginfo-32bit-5.19.0-6.2 libKF5NetworkManagerQt-devel-32bit-5.19.0-6.3 libKF5NetworkManagerQt6-32bit-5.19.0-6.3 libKF5NetworkManagerQt6-debuginfo-32bit-5.19.0-6.3 libKF5NewStuff5-32bit-5.19.0-6.2 libKF5NewStuff5-debuginfo-32bit-5.19.0-6.2 libKF5Notifications5-32bit-5.19.0-6.3 libKF5Notifications5-debuginfo-32bit-5.19.0-6.3 libKF5NotifyConfig5-32bit-5.19.0-6.2 libKF5NotifyConfig5-debuginfo-32bit-5.19.0-6.2 libKF5Parts5-32bit-5.19.0-6.2 libKF5Parts5-debuginfo-32bit-5.19.0-6.2 libKF5Plotting5-32bit-5.19.0-6.3 libKF5Plotting5-debuginfo-32bit-5.19.0-6.3 libKF5Pty5-32bit-5.19.0-6.3 libKF5Pty5-debuginfo-32bit-5.19.0-6.3 libKF5QuickAddons5-32bit-5.19.0-6.2 libKF5QuickAddons5-debuginfo-32bit-5.19.0-6.2 libKF5Runner5-32bit-5.19.0-6.2 libKF5Runner5-debuginfo-32bit-5.19.0-6.2 libKF5Solid5-32bit-5.19.0-6.3 libKF5Solid5-debuginfo-32bit-5.19.0-6.3 libKF5SonnetCore5-32bit-5.19.0-6.7 libKF5SonnetCore5-debuginfo-32bit-5.19.0-6.7 libKF5SonnetUi5-32bit-5.19.0-6.7 libKF5SonnetUi5-debuginfo-32bit-5.19.0-6.7 libKF5Style5-32bit-5.19.0-9.2 libKF5Style5-debuginfo-32bit-5.19.0-9.2 libKF5Su5-32bit-5.19.0-6.2 libKF5Su5-debuginfo-32bit-5.19.0-6.2 libKF5TextWidgets5-32bit-5.19.0-6.2 libKF5TextWidgets5-debuginfo-32bit-5.19.0-6.2 libKF5ThreadWeaver5-32bit-5.19.0-6.3 libKF5ThreadWeaver5-debuginfo-32bit-5.19.0-6.3 libKF5UnitConversion5-32bit-5.19.0-6.3 libKF5UnitConversion5-debuginfo-32bit-5.19.0-6.3 libKF5Wallet5-32bit-5.19.0-6.2 libKF5Wallet5-debuginfo-32bit-5.19.0-6.2 libKF5WebKit5-32bit-5.19.0-6.2 libKF5WebKit5-debuginfo-32bit-5.19.0-6.2 libKF5WidgetsAddons5-32bit-5.19.0-6.3 libKF5WidgetsAddons5-debuginfo-32bit-5.19.0-6.3 libKF5WindowSystem5-32bit-5.19.0-6.3 libKF5WindowSystem5-debuginfo-32bit-5.19.0-6.3 libKF5XmlGui5-32bit-5.19.0-6.2 libKF5XmlGui5-debuginfo-32bit-5.19.0-6.2 libKF5XmlRpcClient5-32bit-5.19.0-6.2 libKF5XmlRpcClient5-debuginfo-32bit-5.19.0-6.2 libkwalletbackend5-5-32bit-5.19.0-6.2 libkwalletbackend5-5-debuginfo-32bit-5.19.0-6.2 plasma-framework-32bit-5.19.0-6.2 plasma-framework-components-32bit-5.19.0-6.2 plasma-framework-components-debuginfo-32bit-5.19.0-6.2 plasma-framework-debuginfo-32bit-5.19.0-6.2 plasma-framework-devel-32bit-5.19.0-6.2 plasma-framework-private-32bit-5.19.0-6.2 plasma-framework-private-debuginfo-32bit-5.19.0-6.2 solid-devel-32bit-5.19.0-6.3 sonnet-devel-32bit-5.19.0-6.7 threadweaver-devel-32bit-5.19.0-6.3 - openSUSE Leap 42.1 (noarch): baloo5-lang-5.19.0-6.2 breeze5-icons-5.19.0-5.8 kcoreaddons-lang-5.19.0-6.3 kded-lang-5.19.0-6.2 kdelibs4support-lang-5.19.0-6.6 kdesignerplugin-lang-5.19.0-6.7 kdoctools-lang-5.19.0-6.3 kfilemetadata5-lang-5.19.0-9.3 kinit-lang-5.19.0-6.2 kio-lang-5.19.0-12.5 kpackage-lang-5.19.0-6.3 kpeople5-lang-5.19.0-6.2 kross-lang-5.19.0-6.2 kservice-lang-5.19.0-7.2 ktexteditor-lang-5.19.0-6.3 kwalletd5-lang-5.19.0-6.2 libKF5Activities5-lang-5.19.0-11.2 libKF5Auth5-lang-5.19.0-6.3 libKF5Bookmarks5-lang-5.19.0-6.2 libKF5Codecs5-lang-5.19.0-6.3 libKF5Completion5-lang-5.19.0-6.3 libKF5ConfigCore5-lang-5.19.0-6.3 libKF5ConfigWidgets5-lang-5.19.0-6.3 libKF5DBusAddons5-lang-5.19.0-6.3 libKF5DNSSD5-lang-5.19.0-6.3 libKF5Declarative5-lang-5.19.0-6.2 libKF5GlobalAccel5-lang-5.19.0-6.2 libKF5I18n5-lang-5.19.0-6.3 libKF5IconThemes5-lang-5.19.0-6.3 libKF5ItemViews5-lang-5.19.0-6.3 libKF5JobWidgets5-lang-5.19.0-6.3 libKF5JsEmbed5-lang-5.19.0-6.3 libKF5KCMUtils5-lang-5.19.0-6.2 libKF5KHtml5-lang-5.19.0-6.2 libKF5NewStuff5-lang-5.19.0-6.2 libKF5Notifications5-lang-5.19.0-6.3 libKF5NotifyConfig5-lang-5.19.0-6.2 libKF5Parts5-lang-5.19.0-6.2 libKF5Pty5-lang-5.19.0-6.3 libKF5Solid5-lang-5.19.0-6.3 libKF5SonnetCore5-lang-5.19.0-6.7 libKF5Style5-lang-5.19.0-9.2 libKF5Su5-lang-5.19.0-6.2 libKF5TextWidgets5-lang-5.19.0-6.2 libKF5UnitConversion5-lang-5.19.0-6.3 libKF5WidgetsAddons5-lang-5.19.0-6.3 libKF5WindowSystem5-lang-5.19.0-6.3 libKF5XmlGui5-lang-5.19.0-6.2 libKF5XmlRpcClient5-lang-5.19.0-6.2 oxygen5-icon-theme-5.18.0-5.3 oxygen5-icon-theme-large-5.18.0-5.3 oxygen5-icon-theme-scalable-5.18.0-5.3 plasma-framework-lang-5.19.0-6.2 References: https://bugzilla.suse.com/955280 https://bugzilla.suse.com/963680 https://bugzilla.suse.com/967668

1 0