March 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:0730-1: moderate: Recommended update for fate
by maintenance＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0730-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for fate fixes the following issues: - update to version 1.5.5.4 * prioritytable: reenable editing of requester prio by himself Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-331=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): fate-1.5.5.4-9.1 fate-debuginfo-1.5.5.4-9.1 fate-debugsource-1.5.5.4-9.1 References:

1 0

openSUSE-SU-2016:0729-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0729-1 Rating: important References: #969333 Cross-References: CVE-2015-8126 CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333) - CVE-2016-1630: Same-origin bypass in Blink - CVE-2016-1631: Same-origin bypass in Pepper Plugin - CVE-2016-1632: Bad cast in Extensions - CVE-2016-1633: Use-after-free in Blink - CVE-2016-1634: Use-after-free in Blink - CVE-2016-1635: Use-after-free in Blink - CVE-2016-1636: SRI Validation Bypass - CVE-2015-8126: Out-of-bounds access in libpng - CVE-2016-1637: Information Leak in Skia - CVE-2016-1638: WebAPI Bypass - CVE-2016-1639: Use-after-free in WebRTC - CVE-2016-1640: Origin confusion in Extensions UI - CVE-2016-1641: Use-after-free in Favicon - CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch (currently 4.9.385.26) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-330=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-49.0.2623.75-81.2 chromedriver-debuginfo-49.0.2623.75-81.2 chromium-49.0.2623.75-81.2 chromium-debuginfo-49.0.2623.75-81.2 chromium-debugsource-49.0.2623.75-81.2 chromium-desktop-gnome-49.0.2623.75-81.2 chromium-desktop-kde-49.0.2623.75-81.2 chromium-ffmpegsumo-49.0.2623.75-81.2 chromium-ffmpegsumo-debuginfo-49.0.2623.75-81.2 References: https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2016-1630.html https://www.suse.com/security/cve/CVE-2016-1631.html https://www.suse.com/security/cve/CVE-2016-1632.html https://www.suse.com/security/cve/CVE-2016-1633.html https://www.suse.com/security/cve/CVE-2016-1634.html https://www.suse.com/security/cve/CVE-2016-1635.html https://www.suse.com/security/cve/CVE-2016-1636.html https://www.suse.com/security/cve/CVE-2016-1637.html https://www.suse.com/security/cve/CVE-2016-1638.html https://www.suse.com/security/cve/CVE-2016-1639.html https://www.suse.com/security/cve/CVE-2016-1640.html https://www.suse.com/security/cve/CVE-2016-1641.html https://www.suse.com/security/cve/CVE-2016-1642.html https://bugzilla.suse.com/969333

1 0

openSUSE-RU-2016:0724-1: moderate: Softwarestack update
by maintenance＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Recommended Update: Softwarestack update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0724-1 Rating: moderate References: #889363 #953214 #955801 #956443 #957606 #961738 #966760 #967673 #968006 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update contains bug fixes for the software management stack. The following issues were fixed: zypper: - boo#967673: Zypper export/import was not honoring autorefresh flag - boo#968006: Zypper returned non-success error code even when installation/patching succeeds - boo#966760: Error in addlock man page header - boo#953214: typo in man page () libsolv: - boo#961738: Issue with rule generation for linked packages - boo#957606: fix issues with multiversion orphan handling - bnc#956443: conflict on *-release packages on SP1 migration libzypp: - media: Send stats header to download.opensuse.org only (boo#955801) - rebuild to satisfy dependencies zypp-plugin: - boo#889363: Zypper failed when custom version of Python is additionally installed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-329=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsolv-debugsource-0.6.19-20.1 libsolv-demo-0.6.19-20.1 libsolv-demo-debuginfo-0.6.19-20.1 libsolv-devel-0.6.19-20.1 libsolv-devel-debuginfo-0.6.19-20.1 libsolv-tools-0.6.19-20.1 libsolv-tools-debuginfo-0.6.19-20.1 libzypp-14.42.4-36.1 libzypp-debuginfo-14.42.4-36.1 libzypp-debugsource-14.42.4-36.1 libzypp-devel-14.42.4-36.1 libzypp-devel-doc-14.42.4-36.1 perl-solv-0.6.19-20.1 perl-solv-debuginfo-0.6.19-20.1 python-solv-0.6.19-20.1 python-solv-debuginfo-0.6.19-20.1 ruby-solv-0.6.19-20.1 ruby-solv-debuginfo-0.6.19-20.1 zypp-plugin-python-0.5-2.3.1 zypper-1.11.51-37.2 zypper-debuginfo-1.11.51-37.2 zypper-debugsource-1.11.51-37.2 - openSUSE 13.2 (noarch): zypper-aptitude-1.11.51-37.2 zypper-log-1.11.51-37.2 References: https://bugzilla.suse.com/889363 https://bugzilla.suse.com/953214 https://bugzilla.suse.com/955801 https://bugzilla.suse.com/956443 https://bugzilla.suse.com/957606 https://bugzilla.suse.com/961738 https://bugzilla.suse.com/966760 https://bugzilla.suse.com/967673 https://bugzilla.suse.com/968006

1 0

openSUSE-SU-2016:0722-1: moderate: Security update for libssh
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0722-1 Rating: moderate References: #965875 Cross-References: CVE-2016-0739 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libssh fixes the following issues: - CVE-2016-0739: Fix Weakness in diffie-hellman secret key generation. (bsc#965875) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-328=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libssh-debugsource-0.6.3-10.1 libssh-devel-0.6.3-10.1 libssh-devel-doc-0.6.3-10.1 libssh4-0.6.3-10.1 libssh4-debuginfo-0.6.3-10.1 - openSUSE Leap 42.1 (x86_64): libssh4-32bit-0.6.3-10.1 libssh4-debuginfo-32bit-0.6.3-10.1 References: https://www.suse.com/security/cve/CVE-2016-0739.html https://bugzilla.suse.com/965875

1 0

openSUSE-SU-2016:0721-1: important: Security update for exim
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0721-1 Rating: important References: #968844 Cross-References: CVE-2016-1531 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to exim 4.86.2 fixes the following issues: * CVE-2016-1531: local privilege escalation for set-uid root exim when using 'perl_startup' (boo#968844) Important: Exim now cleans the complete execution environment by default. This affects Exim and subprocesses such as transports calling other programs. The following new options are supported to adjust this behaviour: * keep_environment * add_environment A warning will be printed upon startup if none of these are configured. Also includes upstream changes, improvements and bug fixes: * Support for using the system standard CA bundle. * New expansion items $config_file, $config_dir, containing the file and directory name of the main configuration file. Also $exim_version. * New "malware=" support for Avast. * New "spam=" variant option for Rspamd. * Assorted options on malware= and spam= scanners. * A commandline option to write a comment into the logfile. * A logging option for slow DNS lookups. * New ${env {<variable>}} expansion. * A non-SMTP authenticator using information from TLS client certificates. * Main option "tls_eccurve" for selecting an Elliptic Curve for TLS. * Main option "dns_trust_aa" for trusting your local nameserver at the same level as DNSSEC. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-326=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-326=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): exim-4.86.2-8.1 exim-debuginfo-4.86.2-8.1 exim-debugsource-4.86.2-8.1 eximon-4.86.2-8.1 eximon-debuginfo-4.86.2-8.1 eximstats-html-4.86.2-8.1 - openSUSE 13.2 (i586 x86_64): exim-4.86.2-3.10.1 exim-debuginfo-4.86.2-3.10.1 exim-debugsource-4.86.2-3.10.1 eximon-4.86.2-3.10.1 eximon-debuginfo-4.86.2-3.10.1 eximstats-html-4.86.2-3.10.1 References: https://www.suse.com/security/cve/CVE-2016-1531.html https://bugzilla.suse.com/968844

1 0

openSUSE-SU-2016:0720-1: important: Security update for openssl
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0720-1 Rating: important References: #952871 #963415 #968046 #968048 #968051 #968053 #968374 Cross-References: CVE-2015-3197 CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for compat-openssl098 fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Also fixes the following bug: - Avoid running OPENSSL_config twice. This avoids breaking engine loading and also fixes a memory leak in libssl. (bsc#952871) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-327=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-9.1 libopenssl0_9_8-0.9.8j-9.1 libopenssl0_9_8-debuginfo-0.9.8j-9.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-9.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-9.1 References: https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0703.html https://www.suse.com/security/cve/CVE-2016-0704.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/952871 https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968051 https://bugzilla.suse.com/968053 https://bugzilla.suse.com/968374

1 0

openSUSE-SU-2016:0719-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0719-1 Rating: important References: #970547 Cross-References: CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. (boo#970547) * APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005, CVE-2016-1010 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-325=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.577-2.91.1 flash-player-gnome-11.2.202.577-2.91.1 flash-player-kde4-11.2.202.577-2.91.1 References: https://www.suse.com/security/cve/CVE-2016-0960.html https://www.suse.com/security/cve/CVE-2016-0961.html https://www.suse.com/security/cve/CVE-2016-0962.html https://www.suse.com/security/cve/CVE-2016-0963.html https://www.suse.com/security/cve/CVE-2016-0986.html https://www.suse.com/security/cve/CVE-2016-0987.html https://www.suse.com/security/cve/CVE-2016-0988.html https://www.suse.com/security/cve/CVE-2016-0989.html https://www.suse.com/security/cve/CVE-2016-0990.html https://www.suse.com/security/cve/CVE-2016-0991.html https://www.suse.com/security/cve/CVE-2016-0992.html https://www.suse.com/security/cve/CVE-2016-0993.html https://www.suse.com/security/cve/CVE-2016-0994.html https://www.suse.com/security/cve/CVE-2016-0995.html https://www.suse.com/security/cve/CVE-2016-0996.html https://www.suse.com/security/cve/CVE-2016-0997.html https://www.suse.com/security/cve/CVE-2016-0998.html https://www.suse.com/security/cve/CVE-2016-0999.html https://www.suse.com/security/cve/CVE-2016-1000.html https://www.suse.com/security/cve/CVE-2016-1001.html https://www.suse.com/security/cve/CVE-2016-1002.html https://www.suse.com/security/cve/CVE-2016-1005.html https://www.suse.com/security/cve/CVE-2016-1010.html https://bugzilla.suse.com/970547

1 0

openSUSE-SU-2016:0710-1: moderate: Security update for OpenVPN
by opensuse-security＠opensuse.org 10 Mar '16

10 Mar '16

openSUSE Security Update: Security update for OpenVPN ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0710-1 Rating: moderate References: #934237 #959714 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for OpenVPN fixes the following vulnerabilities: * boo#959714: heap overflow on read accessing getaddrinfo result * boo#934237: multiple low severity issues Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-324=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): openvpn-2.3.4-2.10.1 openvpn-auth-pam-plugin-2.3.4-2.10.1 openvpn-auth-pam-plugin-debuginfo-2.3.4-2.10.1 openvpn-debuginfo-2.3.4-2.10.1 openvpn-debugsource-2.3.4-2.10.1 openvpn-down-root-plugin-2.3.4-2.10.1 openvpn-down-root-plugin-debuginfo-2.3.4-2.10.1 References: https://bugzilla.suse.com/934237 https://bugzilla.suse.com/959714

1 0

openSUSE-SU-2016:0709-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 10 Mar '16

10 Mar '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0709-1 Rating: moderate References: #968284 Cross-References: CVE-2016-2554 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php5 fixes the following issues: * CVE-2016-2554: A stack overflow vulnerability when decompressing tar phar archives was fixed. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-323=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-42.2 apache2-mod_php5-debuginfo-5.6.1-42.2 php5-5.6.1-42.2 php5-bcmath-5.6.1-42.2 php5-bcmath-debuginfo-5.6.1-42.2 php5-bz2-5.6.1-42.2 php5-bz2-debuginfo-5.6.1-42.2 php5-calendar-5.6.1-42.2 php5-calendar-debuginfo-5.6.1-42.2 php5-ctype-5.6.1-42.2 php5-ctype-debuginfo-5.6.1-42.2 php5-curl-5.6.1-42.2 php5-curl-debuginfo-5.6.1-42.2 php5-dba-5.6.1-42.2 php5-dba-debuginfo-5.6.1-42.2 php5-debuginfo-5.6.1-42.2 php5-debugsource-5.6.1-42.2 php5-devel-5.6.1-42.2 php5-dom-5.6.1-42.2 php5-dom-debuginfo-5.6.1-42.2 php5-enchant-5.6.1-42.2 php5-enchant-debuginfo-5.6.1-42.2 php5-exif-5.6.1-42.2 php5-exif-debuginfo-5.6.1-42.2 php5-fastcgi-5.6.1-42.2 php5-fastcgi-debuginfo-5.6.1-42.2 php5-fileinfo-5.6.1-42.2 php5-fileinfo-debuginfo-5.6.1-42.2 php5-firebird-5.6.1-42.2 php5-firebird-debuginfo-5.6.1-42.2 php5-fpm-5.6.1-42.2 php5-fpm-debuginfo-5.6.1-42.2 php5-ftp-5.6.1-42.2 php5-ftp-debuginfo-5.6.1-42.2 php5-gd-5.6.1-42.2 php5-gd-debuginfo-5.6.1-42.2 php5-gettext-5.6.1-42.2 php5-gettext-debuginfo-5.6.1-42.2 php5-gmp-5.6.1-42.2 php5-gmp-debuginfo-5.6.1-42.2 php5-iconv-5.6.1-42.2 php5-iconv-debuginfo-5.6.1-42.2 php5-imap-5.6.1-42.2 php5-imap-debuginfo-5.6.1-42.2 php5-intl-5.6.1-42.2 php5-intl-debuginfo-5.6.1-42.2 php5-json-5.6.1-42.2 php5-json-debuginfo-5.6.1-42.2 php5-ldap-5.6.1-42.2 php5-ldap-debuginfo-5.6.1-42.2 php5-mbstring-5.6.1-42.2 php5-mbstring-debuginfo-5.6.1-42.2 php5-mcrypt-5.6.1-42.2 php5-mcrypt-debuginfo-5.6.1-42.2 php5-mssql-5.6.1-42.2 php5-mssql-debuginfo-5.6.1-42.2 php5-mysql-5.6.1-42.2 php5-mysql-debuginfo-5.6.1-42.2 php5-odbc-5.6.1-42.2 php5-odbc-debuginfo-5.6.1-42.2 php5-opcache-5.6.1-42.2 php5-opcache-debuginfo-5.6.1-42.2 php5-openssl-5.6.1-42.2 php5-openssl-debuginfo-5.6.1-42.2 php5-pcntl-5.6.1-42.2 php5-pcntl-debuginfo-5.6.1-42.2 php5-pdo-5.6.1-42.2 php5-pdo-debuginfo-5.6.1-42.2 php5-pgsql-5.6.1-42.2 php5-pgsql-debuginfo-5.6.1-42.2 php5-phar-5.6.1-42.2 php5-phar-debuginfo-5.6.1-42.2 php5-posix-5.6.1-42.2 php5-posix-debuginfo-5.6.1-42.2 php5-pspell-5.6.1-42.2 php5-pspell-debuginfo-5.6.1-42.2 php5-readline-5.6.1-42.2 php5-readline-debuginfo-5.6.1-42.2 php5-shmop-5.6.1-42.2 php5-shmop-debuginfo-5.6.1-42.2 php5-snmp-5.6.1-42.2 php5-snmp-debuginfo-5.6.1-42.2 php5-soap-5.6.1-42.2 php5-soap-debuginfo-5.6.1-42.2 php5-sockets-5.6.1-42.2 php5-sockets-debuginfo-5.6.1-42.2 php5-sqlite-5.6.1-42.2 php5-sqlite-debuginfo-5.6.1-42.2 php5-suhosin-5.6.1-42.2 php5-suhosin-debuginfo-5.6.1-42.2 php5-sysvmsg-5.6.1-42.2 php5-sysvmsg-debuginfo-5.6.1-42.2 php5-sysvsem-5.6.1-42.2 php5-sysvsem-debuginfo-5.6.1-42.2 php5-sysvshm-5.6.1-42.2 php5-sysvshm-debuginfo-5.6.1-42.2 php5-tidy-5.6.1-42.2 php5-tidy-debuginfo-5.6.1-42.2 php5-tokenizer-5.6.1-42.2 php5-tokenizer-debuginfo-5.6.1-42.2 php5-wddx-5.6.1-42.2 php5-wddx-debuginfo-5.6.1-42.2 php5-xmlreader-5.6.1-42.2 php5-xmlreader-debuginfo-5.6.1-42.2 php5-xmlrpc-5.6.1-42.2 php5-xmlrpc-debuginfo-5.6.1-42.2 php5-xmlwriter-5.6.1-42.2 php5-xmlwriter-debuginfo-5.6.1-42.2 php5-xsl-5.6.1-42.2 php5-xsl-debuginfo-5.6.1-42.2 php5-zip-5.6.1-42.2 php5-zip-debuginfo-5.6.1-42.2 php5-zlib-5.6.1-42.2 php5-zlib-debuginfo-5.6.1-42.2 - openSUSE 13.2 (noarch): php5-pear-5.6.1-42.2 References: https://www.suse.com/security/cve/CVE-2016-2554.html https://bugzilla.suse.com/968284

1 0

openSUSE-SU-2016:0708-1: important: Security update for libotr,libotr2
by opensuse-security＠opensuse.org 10 Mar '16

10 Mar '16

openSUSE Security Update: Security update for libotr,libotr2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0708-1 Rating: important References: #969785 Cross-References: CVE-2016-2851 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libotr and libotr2 were updated to fix one security issue: - CVE-2016-2851: Integer overflow vulnerability allowed remote attackers to execute arbitrary code on 64 bit platforms (boo#969785) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-322=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-322=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libotr-debugsource-4.1.1-4.1 libotr-devel-4.1.1-4.1 libotr-tools-4.1.1-4.1 libotr-tools-debuginfo-4.1.1-4.1 libotr2-3.2.1-13.1 libotr2-debuginfo-3.2.1-13.1 libotr2-debugsource-3.2.1-13.1 libotr2-devel-3.2.1-13.1 libotr2-tools-3.2.1-13.1 libotr2-tools-debuginfo-3.2.1-13.1 libotr5-4.1.1-4.1 libotr5-debuginfo-4.1.1-4.1 - openSUSE 13.2 (i586 x86_64): libotr-debugsource-4.0.0-8.3.1 libotr-devel-4.0.0-8.3.1 libotr-tools-4.0.0-8.3.1 libotr-tools-debuginfo-4.0.0-8.3.1 libotr2-3.2.1-7.3.1 libotr2-debuginfo-3.2.1-7.3.1 libotr2-debugsource-3.2.1-7.3.1 libotr2-devel-3.2.1-7.3.1 libotr2-tools-3.2.1-7.3.1 libotr2-tools-debuginfo-3.2.1-7.3.1 libotr5-4.0.0-8.3.1 libotr5-debuginfo-4.0.0-8.3.1 References: https://www.suse.com/security/cve/CVE-2016-2851.html https://bugzilla.suse.com/969785

1 0