March 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2016:0927-1: Optional update for dstat
by maintenance＠opensuse.org 31 Mar '16

31 Mar '16

openSUSE Optional Update: Optional update for dstat ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:0927-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update brings dstat, a versatile resource statistics tool, to the SLE12 backports project. See http://dag.wiee.rs/home-made/dstat/ for more information. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-417=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): dstat-0.7.3-2.1 References:

1 0

openSUSE-SU-2016:0922-1: moderate: Security update for libqt4
by opensuse-security＠opensuse.org 31 Mar '16

31 Mar '16

openSUSE Security Update: Security update for libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0922-1 Rating: moderate References: #865241 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libqt4 fixes the following issues: Various unsafe SSL ciphers have been disabled in the standard SSL classes. Also the RC4 based ciphers have been disabled. (bsc#865241) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-416=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libqt4-4.8.6-7.1 libqt4-debuginfo-4.8.6-7.1 libqt4-debugsource-4.8.6-7.1 libqt4-devel-4.8.6-7.1 libqt4-devel-debuginfo-4.8.6-7.1 libqt4-devel-doc-4.8.6-7.2 libqt4-devel-doc-debuginfo-4.8.6-7.2 libqt4-devel-doc-debugsource-4.8.6-7.2 libqt4-linguist-4.8.6-7.1 libqt4-linguist-debuginfo-4.8.6-7.1 libqt4-private-headers-devel-4.8.6-7.1 libqt4-qt3support-4.8.6-7.1 libqt4-qt3support-debuginfo-4.8.6-7.1 libqt4-sql-4.8.6-7.1 libqt4-sql-debuginfo-4.8.6-7.1 libqt4-sql-mysql-4.8.6-7.1 libqt4-sql-mysql-debuginfo-4.8.6-7.1 libqt4-sql-plugins-debugsource-4.8.6-7.1 libqt4-sql-postgresql-4.8.6-7.1 libqt4-sql-postgresql-debuginfo-4.8.6-7.1 libqt4-sql-sqlite-4.8.6-7.1 libqt4-sql-sqlite-debuginfo-4.8.6-7.1 libqt4-sql-unixODBC-4.8.6-7.1 libqt4-sql-unixODBC-debuginfo-4.8.6-7.1 libqt4-x11-4.8.6-7.1 libqt4-x11-debuginfo-4.8.6-7.1 qt4-x11-tools-4.8.6-7.2 qt4-x11-tools-debuginfo-4.8.6-7.2 - openSUSE Leap 42.1 (noarch): libqt4-devel-doc-data-4.8.6-7.2 - openSUSE Leap 42.1 (x86_64): libqt4-32bit-4.8.6-7.1 libqt4-debuginfo-32bit-4.8.6-7.1 libqt4-qt3support-32bit-4.8.6-7.1 libqt4-qt3support-debuginfo-32bit-4.8.6-7.1 libqt4-sql-32bit-4.8.6-7.1 libqt4-sql-debuginfo-32bit-4.8.6-7.1 libqt4-sql-mysql-32bit-4.8.6-7.1 libqt4-sql-mysql-debuginfo-32bit-4.8.6-7.1 libqt4-sql-postgresql-32bit-4.8.6-7.1 libqt4-sql-postgresql-debuginfo-32bit-4.8.6-7.1 libqt4-sql-sqlite-32bit-4.8.6-7.1 libqt4-sql-sqlite-debuginfo-32bit-4.8.6-7.1 libqt4-sql-unixODBC-32bit-4.8.6-7.1 libqt4-sql-unixODBC-debuginfo-32bit-4.8.6-7.1 libqt4-x11-32bit-4.8.6-7.1 libqt4-x11-debuginfo-32bit-4.8.6-7.1 References: https://bugzilla.suse.com/865241

1 0

openSUSE-RU-2016:0921-1: moderate: Recommended update for yast2-installation
by maintenance＠opensuse.org 31 Mar '16

31 Mar '16

openSUSE Recommended Update: Recommended update for yast2-installation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0921-1 Rating: moderate References: #910728 #935965 #956325 #960703 #966874 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for yast2-installation provides the following fixes: - Ensure plymouth does not interfere with X11 when executing yast2-firstboot. (bsc#966874) - Ensure second stage and YaST-Firstboot don't get killed by getty when running over 2nd or 3rd serial console. (bsc#935965) - Save the software selection for using it later in AutoYaST when deploying installation images. (bsc#956325, bsc#910728) - Move network service setup to yast2-network. (bsc#960703) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-415=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): yast2-installation-3.1.162.5-6.1 yast2-installation-devel-doc-3.1.162.5-6.1 References: https://bugzilla.suse.com/910728 https://bugzilla.suse.com/935965 https://bugzilla.suse.com/956325 https://bugzilla.suse.com/960703 https://bugzilla.suse.com/966874

1 0

openSUSE-RU-2016:0920-1: Recommended update for clamav-database
by maintenance＠opensuse.org 30 Mar '16

30 Mar '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0920-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh March 28th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-414=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201603280002-68.1 References:

1 0

openSUSE-SU-2016:0915-1: moderate: Security update for webkitgtk
by opensuse-security＠opensuse.org 30 Mar '16

30 Mar '16

openSUSE Security Update: Security update for webkitgtk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0915-1 Rating: moderate References: #971460 Cross-References: CVE-2014-1748 CVE-2015-1071 CVE-2015-1076 CVE-2015-1081 CVE-2015-1083 CVE-2015-1120 CVE-2015-1122 CVE-2015-1127 CVE-2015-1153 CVE-2015-1155 CVE-2015-3658 CVE-2015-3659 CVE-2015-3727 CVE-2015-3731 CVE-2015-3741 CVE-2015-3743 CVE-2015-3745 CVE-2015-3747 CVE-2015-3748 CVE-2015-3749 CVE-2015-3752 CVE-2015-5788 CVE-2015-5794 CVE-2015-5801 CVE-2015-5809 CVE-2015-5822 CVE-2015-5928 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for webkitgtk fixes the following issues: - webkitgtk was updated to version 2.4.10 (boo#971460): + Fix rendering of form controls and scrollbars with GTK+ >= 3.19. + Fix crashes on PPC64. + Fix the build on powerpc 32 bits. + Add ARM64 build support. + Security fixes: CVE-2015-1120, CVE-2015-1076, CVE-2015-1071, CVE-2015-1081, CVE-2015-1122, CVE-2015-1155, CVE-2014-1748, CVE-2015-3752, CVE-2015-5809, CVE-2015-5928, CVE-2015-3749, CVE-2015-3659, CVE-2015-3748, CVE-2015-3743, CVE-2015-3731, CVE-2015-3745, CVE-2015-5822, CVE-2015-3658, CVE-2015-3741, CVE-2015-3727, CVE-2015-5801, CVE-2015-5788, CVE-2015-3747, CVE-2015-5794, CVE-2015-1127, CVE-2015-1153, CVE-2015-1083. + Updated translations. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-412=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-412=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libjavascriptcoregtk-1_0-0-2.4.10-7.2 libjavascriptcoregtk-1_0-0-debuginfo-2.4.10-7.2 libjavascriptcoregtk-3_0-0-2.4.10-7.2 libjavascriptcoregtk-3_0-0-debuginfo-2.4.10-7.2 libwebkitgtk-1_0-0-2.4.10-7.2 libwebkitgtk-1_0-0-debuginfo-2.4.10-7.2 libwebkitgtk-3_0-0-2.4.10-7.2 libwebkitgtk-3_0-0-debuginfo-2.4.10-7.2 libwebkitgtk-devel-2.4.10-7.2 libwebkitgtk3-devel-2.4.10-7.2 typelib-1_0-JavaScriptCore-1_0-2.4.10-7.2 typelib-1_0-JavaScriptCore-3_0-2.4.10-7.2 typelib-1_0-WebKit-1_0-2.4.10-7.2 typelib-1_0-WebKit-3_0-2.4.10-7.2 webkit-jsc-1-2.4.10-7.2 webkit-jsc-1-debuginfo-2.4.10-7.2 webkit-jsc-3-2.4.10-7.2 webkit-jsc-3-debuginfo-2.4.10-7.2 - openSUSE Leap 42.1 (noarch): libwebkitgtk2-lang-2.4.10-7.2 libwebkitgtk3-lang-2.4.10-7.2 - openSUSE Leap 42.1 (x86_64): libjavascriptcoregtk-1_0-0-32bit-2.4.10-7.2 libjavascriptcoregtk-1_0-0-debuginfo-32bit-2.4.10-7.2 libjavascriptcoregtk-3_0-0-32bit-2.4.10-7.2 libjavascriptcoregtk-3_0-0-debuginfo-32bit-2.4.10-7.2 libwebkitgtk-1_0-0-32bit-2.4.10-7.2 libwebkitgtk-1_0-0-debuginfo-32bit-2.4.10-7.2 libwebkitgtk-3_0-0-32bit-2.4.10-7.2 libwebkitgtk-3_0-0-debuginfo-32bit-2.4.10-7.2 - openSUSE 13.2 (i586 x86_64): libjavascriptcoregtk-1_0-0-2.4.10-13.2 libjavascriptcoregtk-1_0-0-debuginfo-2.4.10-13.2 libjavascriptcoregtk-3_0-0-2.4.10-13.2 libjavascriptcoregtk-3_0-0-debuginfo-2.4.10-13.2 libwebkitgtk-1_0-0-2.4.10-13.2 libwebkitgtk-1_0-0-debuginfo-2.4.10-13.2 libwebkitgtk-3_0-0-2.4.10-13.2 libwebkitgtk-3_0-0-debuginfo-2.4.10-13.2 libwebkitgtk-devel-2.4.10-13.2 libwebkitgtk3-devel-2.4.10-13.2 typelib-1_0-JavaScriptCore-1_0-2.4.10-13.2 typelib-1_0-JavaScriptCore-3_0-2.4.10-13.2 typelib-1_0-WebKit-1_0-2.4.10-13.2 typelib-1_0-WebKit-3_0-2.4.10-13.2 webkit-jsc-1-2.4.10-13.2 webkit-jsc-1-debuginfo-2.4.10-13.2 webkit-jsc-3-2.4.10-13.2 webkit-jsc-3-debuginfo-2.4.10-13.2 - openSUSE 13.2 (x86_64): libjavascriptcoregtk-1_0-0-32bit-2.4.10-13.2 libjavascriptcoregtk-1_0-0-debuginfo-32bit-2.4.10-13.2 libjavascriptcoregtk-3_0-0-32bit-2.4.10-13.2 libjavascriptcoregtk-3_0-0-debuginfo-32bit-2.4.10-13.2 libwebkitgtk-1_0-0-32bit-2.4.10-13.2 libwebkitgtk-1_0-0-debuginfo-32bit-2.4.10-13.2 libwebkitgtk-3_0-0-32bit-2.4.10-13.2 libwebkitgtk-3_0-0-debuginfo-32bit-2.4.10-13.2 - openSUSE 13.2 (noarch): libwebkitgtk2-lang-2.4.10-13.2 libwebkitgtk3-lang-2.4.10-13.2 References: https://www.suse.com/security/cve/CVE-2014-1748.html https://www.suse.com/security/cve/CVE-2015-1071.html https://www.suse.com/security/cve/CVE-2015-1076.html https://www.suse.com/security/cve/CVE-2015-1081.html https://www.suse.com/security/cve/CVE-2015-1083.html https://www.suse.com/security/cve/CVE-2015-1120.html https://www.suse.com/security/cve/CVE-2015-1122.html https://www.suse.com/security/cve/CVE-2015-1127.html https://www.suse.com/security/cve/CVE-2015-1153.html https://www.suse.com/security/cve/CVE-2015-1155.html https://www.suse.com/security/cve/CVE-2015-3658.html https://www.suse.com/security/cve/CVE-2015-3659.html https://www.suse.com/security/cve/CVE-2015-3727.html https://www.suse.com/security/cve/CVE-2015-3731.html https://www.suse.com/security/cve/CVE-2015-3741.html https://www.suse.com/security/cve/CVE-2015-3743.html https://www.suse.com/security/cve/CVE-2015-3745.html https://www.suse.com/security/cve/CVE-2015-3747.html https://www.suse.com/security/cve/CVE-2015-3748.html https://www.suse.com/security/cve/CVE-2015-3749.html https://www.suse.com/security/cve/CVE-2015-3752.html https://www.suse.com/security/cve/CVE-2015-5788.html https://www.suse.com/security/cve/CVE-2015-5794.html https://www.suse.com/security/cve/CVE-2015-5801.html https://www.suse.com/security/cve/CVE-2015-5809.html https://www.suse.com/security/cve/CVE-2015-5822.html https://www.suse.com/security/cve/CVE-2015-5928.html https://bugzilla.suse.com/971460

1 0

openSUSE-SU-2016:0914-1: important: Security update for xen
by opensuse-security＠opensuse.org 30 Mar '16

30 Mar '16

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0914-1 Rating: important References: #864391 #864655 #864769 #864805 #877642 #901508 #902737 #924018 #928393 #945404 #945989 #954872 #956829 #957162 #957698 #959332 #959695 #960334 #960707 #960725 #960835 #960861 #961332 #961358 #961691 #963782 #963923 #964413 #967012 #967013 #967969 Cross-References: CVE-2013-4533 CVE-2013-4537 CVE-2013-4538 CVE-2013-4539 CVE-2014-0222 CVE-2014-3689 CVE-2014-7815 CVE-2014-9718 CVE-2015-1779 CVE-2015-5278 CVE-2015-6855 CVE-2015-7512 CVE-2015-8345 CVE-2015-8613 CVE-2015-8619 CVE-2015-8743 CVE-2015-8744 CVE-2015-8745 CVE-2016-1568 CVE-2016-1570 CVE-2016-1714 CVE-2016-1981 CVE-2016-2198 CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 26 vulnerabilities and has 5 fixes is now available. Description: xen was updated to fix 26 security issues. These security issues were fixed: - CVE-2013-4533: Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image (bsc#864655). - CVE-2013-4537: The ssi_sd_transfer function in hw/sd/ssi-sd.c allowed remote attackers to execute arbitrary code via a crafted arglen value in a savevm image (bsc#864391). - CVE-2013-4538: Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image (bsc#864769). - CVE-2013-4539: Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c might have allowed remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image (bsc#864805). - CVE-2014-0222: Integer overflow in the qcow_open function in block/qcow.c allowed remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image (bsc#877642). - CVE-2014-3689: The vmware-vga driver (hw/display/vmware_vga.c) allowed local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling (bsc#901508). - CVE-2014-7815: The set_pixel_format function in ui/vnc.c allowed remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value (bsc#902737). - CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality had multiple interpretations of a function's return value, which allowed guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions (bsc#928393). - CVE-2015-1779: The VNC websocket frame decoder allowed remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section (bsc#924018). - CVE-2015-5278: Infinite loop in ne2000_receive() function (bsc#945989). - CVE-2015-6855: hw/ide/core.c did not properly restrict the commands accepted by an ATAPI device, which allowed guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WIN_READ_NATIVE_MAX command to an empty drive, which triggers a divide-by-zero error and instance crash (bsc#945404). - CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c, when a guest NIC has a larger MTU, allowed remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet (bsc#957162). - CVE-2015-8345: eepro100: infinite loop in processing command block list (bsc#956829). - CVE-2015-8613: SCSI: stack based buffer overflow in megasas_ctrl_get_info (bsc#961358). - CVE-2015-8619: Stack based OOB write in hmp_sendkey routine (bsc#960334). - CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bsc#960725). - CVE-2015-8744: vmxnet3: Incorrect l2 header validation lead to a crash via assert(2) call (bsc#960835). - CVE-2015-8745: Reading IMR registers lead to a crash via assert(2) call (bsc#960707). - CVE-2016-1568: AHCI use-after-free vulnerability in aio port commands (bsc#961332). - CVE-2016-1570: The PV superpage functionality in arch/x86/mm.c allowed local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates (bsc#960861). - CVE-2016-1714: nvram: OOB r/w access in processing firmware configurations (bsc#961691). - CVE-2016-1981: e1000 infinite loop in start_xmit and e1000_receive_iov routines (bsc#963782). - CVE-2016-2198: EHCI NULL pointer dereference in ehci_caps_write (bsc#964413). - CVE-2016-2391: usb: multiple eof_timers in ohci module lead to NULL pointer dereference (bsc#967013). - CVE-2016-2392: NULL pointer dereference in remote NDIS control message handling (bsc#967012). - CVE-2016-2538: Integer overflow in remote NDIS control message handling (bsc#967969). These non-security issues were fixed: - bsc#954872: script block-dmmd not working as expected - bsc#957698: DOM0 can't bring up on Dell PC - bsc#963923: domain weights not honored when sched-credit tslice is reduced - bsc#959332: SLES12SP1 PV guest is unreachable when restored or migrated - bsc#959695: Missing docs for xen Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-413=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xen-debugsource-4.5.2_06-12.1 xen-devel-4.5.2_06-12.1 xen-libs-4.5.2_06-12.1 xen-libs-debuginfo-4.5.2_06-12.1 xen-tools-domU-4.5.2_06-12.1 xen-tools-domU-debuginfo-4.5.2_06-12.1 - openSUSE Leap 42.1 (x86_64): xen-4.5.2_06-12.1 xen-doc-html-4.5.2_06-12.1 xen-kmp-default-4.5.2_06_k4.1.15_8-12.1 xen-kmp-default-debuginfo-4.5.2_06_k4.1.15_8-12.1 xen-libs-32bit-4.5.2_06-12.1 xen-libs-debuginfo-32bit-4.5.2_06-12.1 xen-tools-4.5.2_06-12.1 xen-tools-debuginfo-4.5.2_06-12.1 References: https://www.suse.com/security/cve/CVE-2013-4533.html https://www.suse.com/security/cve/CVE-2013-4537.html https://www.suse.com/security/cve/CVE-2013-4538.html https://www.suse.com/security/cve/CVE-2013-4539.html https://www.suse.com/security/cve/CVE-2014-0222.html https://www.suse.com/security/cve/CVE-2014-3689.html https://www.suse.com/security/cve/CVE-2014-7815.html https://www.suse.com/security/cve/CVE-2014-9718.html https://www.suse.com/security/cve/CVE-2015-1779.html https://www.suse.com/security/cve/CVE-2015-5278.html https://www.suse.com/security/cve/CVE-2015-6855.html https://www.suse.com/security/cve/CVE-2015-7512.html https://www.suse.com/security/cve/CVE-2015-8345.html https://www.suse.com/security/cve/CVE-2015-8613.html https://www.suse.com/security/cve/CVE-2015-8619.html https://www.suse.com/security/cve/CVE-2015-8743.html https://www.suse.com/security/cve/CVE-2015-8744.html https://www.suse.com/security/cve/CVE-2015-8745.html https://www.suse.com/security/cve/CVE-2016-1568.html https://www.suse.com/security/cve/CVE-2016-1570.html https://www.suse.com/security/cve/CVE-2016-1714.html https://www.suse.com/security/cve/CVE-2016-1981.html https://www.suse.com/security/cve/CVE-2016-2198.html https://www.suse.com/security/cve/CVE-2016-2391.html https://www.suse.com/security/cve/CVE-2016-2392.html https://www.suse.com/security/cve/CVE-2016-2538.html https://bugzilla.suse.com/864391 https://bugzilla.suse.com/864655 https://bugzilla.suse.com/864769 https://bugzilla.suse.com/864805 https://bugzilla.suse.com/877642 https://bugzilla.suse.com/901508 https://bugzilla.suse.com/902737 https://bugzilla.suse.com/924018 https://bugzilla.suse.com/928393 https://bugzilla.suse.com/945404 https://bugzilla.suse.com/945989 https://bugzilla.suse.com/954872 https://bugzilla.suse.com/956829 https://bugzilla.suse.com/957162 https://bugzilla.suse.com/957698 https://bugzilla.suse.com/959332 https://bugzilla.suse.com/959695 https://bugzilla.suse.com/960334 https://bugzilla.suse.com/960707 https://bugzilla.suse.com/960725 https://bugzilla.suse.com/960835 https://bugzilla.suse.com/960861 https://bugzilla.suse.com/961332 https://bugzilla.suse.com/961358 https://bugzilla.suse.com/961691 https://bugzilla.suse.com/963782 https://bugzilla.suse.com/963923 https://bugzilla.suse.com/964413 https://bugzilla.suse.com/967012 https://bugzilla.suse.com/967013 https://bugzilla.suse.com/967969

1 0

openSUSE-RU-2016:0904-1: moderate: Recommended update for monit
by maintenance＠opensuse.org 29 Mar '16

29 Mar '16

openSUSE Recommended Update: Recommended update for monit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0904-1 Rating: moderate References: #971647 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for monit fixes the following issues: - fixed pid file directory (boo#971647) - set pid file directory in /etc/monitrc - removed /run from file list Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-411=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): monit-5.10-5.1 monit-debuginfo-5.10-5.1 monit-debugsource-5.10-5.1 - openSUSE Leap 42.1 (noarch): monit-doc-5.10-5.1 References: https://bugzilla.suse.com/971647

1 0

openSUSE-RU-2016:0903-1: moderate: Recommended update for clamav
by maintenance＠opensuse.org 29 Mar '16

29 Mar '16

openSUSE Recommended Update: Recommended update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0903-1 Rating: moderate References: #958451 #969814 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update provides version 0.99.1 for clamav: - Update to version 0.99.1 (boo#969814) * Add support for parsing Hancom Office files including extracting and scanning embedded objects. * Several bug fixes. For details, see http://blog.clamav.net/2016/03/clamav-0991-has-been-released.html /usr/share/doc/packages/clamav/ChangeLog - boo#958451: Remove updateclamconf, because it breaks configurations that have multiple occurances of the same keyword. Henceforth the configuration files have to be merged maually, if a ClamAV update adds or removs options. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-409=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): clamav-0.99.1-2.25.1 clamav-debuginfo-0.99.1-2.25.1 clamav-debugsource-0.99.1-2.25.1 References: https://bugzilla.suse.com/958451 https://bugzilla.suse.com/969814

1 0

openSUSE-RU-2016:0902-1: moderate: Recommended update for libical
by maintenance＠opensuse.org 29 Mar '16

29 Mar '16

openSUSE Recommended Update: Recommended update for libical ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0902-1 Rating: moderate References: #954161 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update provides version 1.0.1 for libical: - Update to 1.0.1 (boo#954161). + Bug fixes: - issue74: Do not escape double quote character - issue80,issue92: fix crashes using icaltimezone_load_builtin_timezone() recursively - Fix icalcomponent_foreach_recurrence() and large durations between recurrences (e.g. FREQ=YEARLY) - Properly handle UTCOFFSETs of the form +/-00mmss - Properly skip bogus dates (e.g. 2/30, 4/31) in RRULE:FREQ=MONTHLY - Properly handle RRULE:FREQ=MONTHLY;BYDAY;BYMONTHDAY when DTSTART isn't on BYDAY - Fix RRULE:FREQ=YEARLY;BYDAY;BYWEEKNO - MUST use ISO weeks - Properly skip bogus dates (e.g. 2/29) in RRULE:FREQ=YEARLY[;BYMONTH][;BYMONTHDAY] + Build fixes/features: - Autotools build system is removed - CMake version 2.8.9 (or higher) is required (was CMake version 2.4.0) - Add new -DSHARED_ONLY and -DSTATIC_ONLY CMake options - Remove -DSTATIC_LIBRARY CMake option - MSYS2 builds (fixed instructions) - Now can build api documentation with make docs + Update tzdata to version 2014g + Support added for schedule params: agent, status, force-send + Added a UID to the VFREEBUSY component + Allow dates > 2038 if sizeof(time_t) > 4 + Add properties from draft-ietf-tzdist-service + Add support for RRULE:FREQ=YEARLY;BYDAY;BYYEARDAY and fixed RRULE:FREQ=YEARLY;BYYEARDAY with negative days + More regression tests added, in particular for recurrence + Almost all compile warnings silenced + A bunch of Coverity Scan warnings silenced + Package cmake macros installed by package. - add reproducible-generator.patch from debian bug report to get reproducible builds (and predicatable API actually) - Add libical-leap-abi.patch -- use enum values used in prior LEAP package, for ABI compatibility (boo#954161). - Drop 941609-typo-fix_icaltime_days_in_year.patch: fixed upstream. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-410=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libical-debugsource-1.0.1-11.1 libical-devel-1.0.1-11.1 libical-devel-static-1.0.1-11.1 libical-doc-1.0.1-11.1 libical1-1.0.1-11.1 libical1-debuginfo-1.0.1-11.1 - openSUSE Leap 42.1 (x86_64): libical1-32bit-1.0.1-11.1 libical1-debuginfo-32bit-1.0.1-11.1 References: https://bugzilla.suse.com/954161

1 0

openSUSE-RU-2016:0900-1: moderate: Recommended update for enlightenment
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: Recommended update for enlightenment ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0900-1 Rating: moderate References: #920792 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for enlightenment fixes the following issues: - The QT PLATFORM THEME did not get set correctly for enlightenment so use a environment variable to force it. (boo#920792) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-406=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): enlightenment-0.19.12-3.1 enlightenment-branding-upstream-0.19.12-3.1 enlightenment-debuginfo-0.19.12-3.1 enlightenment-debugsource-0.19.12-3.1 enlightenment-devel-0.19.12-3.1 enlightenment-doc-html-0.19.12-3.1 References: https://bugzilla.suse.com/920792

1 0

openSUSE-RU-2016:0899-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0899-1 Rating: moderate References: #957291 #963441 #966869 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sssd provides the following fixes: - Add new configuration option "ldap_use_tokengroups" to control whether the Token-Groups attribute will be used when performing initgroup for users from Active Directory Server 2008 and later. By default Token-Groups usage is disabled. (bsc#963441, bsc#966869) - Resolve issues with missing groups and group attributes from Active Directory. (bsc#957291) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-408=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libipa_hbac-devel-1.11.5.1-10.1 libipa_hbac0-1.11.5.1-10.1 libipa_hbac0-debuginfo-1.11.5.1-10.1 libsss_idmap-devel-1.11.5.1-10.1 libsss_idmap0-1.11.5.1-10.1 libsss_idmap0-debuginfo-1.11.5.1-10.1 libsss_nss_idmap-devel-1.11.5.1-10.1 libsss_nss_idmap0-1.11.5.1-10.1 libsss_nss_idmap0-debuginfo-1.11.5.1-10.1 libsss_sudo-1.11.5.1-10.1 libsss_sudo-debuginfo-1.11.5.1-10.1 python-ipa_hbac-1.11.5.1-10.1 python-ipa_hbac-debuginfo-1.11.5.1-10.1 python-sss_nss_idmap-1.11.5.1-10.1 python-sss_nss_idmap-debuginfo-1.11.5.1-10.1 python-sssd-config-1.11.5.1-10.1 python-sssd-config-debuginfo-1.11.5.1-10.1 sssd-1.11.5.1-10.1 sssd-ad-1.11.5.1-10.1 sssd-ad-debuginfo-1.11.5.1-10.1 sssd-debuginfo-1.11.5.1-10.1 sssd-debugsource-1.11.5.1-10.1 sssd-ipa-1.11.5.1-10.1 sssd-ipa-debuginfo-1.11.5.1-10.1 sssd-krb5-1.11.5.1-10.1 sssd-krb5-common-1.11.5.1-10.1 sssd-krb5-common-debuginfo-1.11.5.1-10.1 sssd-krb5-debuginfo-1.11.5.1-10.1 sssd-ldap-1.11.5.1-10.1 sssd-ldap-debuginfo-1.11.5.1-10.1 sssd-proxy-1.11.5.1-10.1 sssd-proxy-debuginfo-1.11.5.1-10.1 sssd-tools-1.11.5.1-10.1 sssd-tools-debuginfo-1.11.5.1-10.1 - openSUSE Leap 42.1 (x86_64): sssd-32bit-1.11.5.1-10.1 sssd-debuginfo-32bit-1.11.5.1-10.1 References: https://bugzilla.suse.com/957291 https://bugzilla.suse.com/963441 https://bugzilla.suse.com/966869

1 0

openSUSE-RU-2016:0898-1: ocfs2console fix starting failure
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Recommended Update: ocfs2console fix starting failure ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0898-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: ocfs2console fix starting failure Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-407=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ocfs2-tools-1.8.4-9.1 ocfs2-tools-debuginfo-1.8.4-9.1 ocfs2-tools-debugsource-1.8.4-9.1 ocfs2-tools-devel-1.8.4-9.1 ocfs2-tools-devel-static-1.8.4-9.1 ocfs2-tools-o2cb-1.8.4-9.1 ocfs2-tools-o2cb-debuginfo-1.8.4-9.1 ocfs2console-1.8.4-9.1 ocfs2console-debuginfo-1.8.4-9.1 References:

1 0

openSUSE-SU-2016:0897-1: moderate: Security update for gdk-pixbuf
by opensuse-security＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Security Update: Security update for gdk-pixbuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0897-1 Rating: moderate References: #948790 #948791 #958963 Cross-References: CVE-2015-7552 CVE-2015-7673 CVE-2015-7674 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for gdk-pixbuf fixes the following issues: - CVE-2015-7552: Fixed various overflows in image handling (boo#958963). - CVE-2015-7673: Fixed an overflow and DoS with a TGA file (boo#948790). - CVE-2015-7674: Fixed overflow when scaling a gif (boo#948791). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-405=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gdk-pixbuf-debugsource-2.31.6-6.1 gdk-pixbuf-devel-2.31.6-6.1 gdk-pixbuf-devel-debuginfo-2.31.6-6.1 gdk-pixbuf-query-loaders-2.31.6-6.1 gdk-pixbuf-query-loaders-debuginfo-2.31.6-6.1 libgdk_pixbuf-2_0-0-2.31.6-6.1 libgdk_pixbuf-2_0-0-debuginfo-2.31.6-6.1 typelib-1_0-GdkPixbuf-2_0-2.31.6-6.1 - openSUSE 13.2 (x86_64): gdk-pixbuf-devel-32bit-2.31.6-6.1 gdk-pixbuf-devel-debuginfo-32bit-2.31.6-6.1 gdk-pixbuf-query-loaders-32bit-2.31.6-6.1 gdk-pixbuf-query-loaders-debuginfo-32bit-2.31.6-6.1 libgdk_pixbuf-2_0-0-32bit-2.31.6-6.1 libgdk_pixbuf-2_0-0-debuginfo-32bit-2.31.6-6.1 - openSUSE 13.2 (noarch): gdk-pixbuf-lang-2.31.6-6.1 References: https://www.suse.com/security/cve/CVE-2015-7552.html https://www.suse.com/security/cve/CVE-2015-7673.html https://www.suse.com/security/cve/CVE-2015-7674.html https://bugzilla.suse.com/948790 https://bugzilla.suse.com/948791 https://bugzilla.suse.com/958963

1 0

openSUSE-FU-2016:0896-1: moderate: Add Mozilla Thunderbird to SLE 12 Backports
by maintenance＠opensuse.org 28 Mar '16

28 Mar '16

openSUSE Feature Update: Add Mozilla Thunderbird to SLE 12 Backports ______________________________________________________________________________ Announcement ID: openSUSE-FU-2016:0896-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update adds Mozilla Thunderbird 38.7.0 to the SLE 12 Backports project. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-404=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-38.7.0-2.1 MozillaThunderbird-buildsymbols-38.7.0-2.1 MozillaThunderbird-devel-38.7.0-2.1 MozillaThunderbird-translations-common-38.7.0-2.1 MozillaThunderbird-translations-other-38.7.0-2.1 References:

1 0

openSUSE-RU-2016:0895-1: Recommended update for timezone
by maintenance＠opensuse.org 26 Mar '16

26 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0895-1 Rating: low References: #971377 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016b) for your system, including the following changes: - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-403=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): timezone-2016b-46.1 timezone-debuginfo-2016b-46.1 timezone-debugsource-2016b-46.1 - openSUSE 13.1 (noarch): timezone-java-2016b-46.1 References: https://bugzilla.suse.com/971377

1 0

openSUSE-SU-2016:0894-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 26 Mar '16

26 Mar '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0894-1 Rating: important References: #969894 Cross-References: CVE-2015-4477 CVE-2015-7207 CVE-2016-1952 CVE-2016-1954 CVE-2016-1957 CVE-2016-1958 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: MozillaThunderbird was updated to 38.7.0 to fix the following issues: * Update to Thunderbird 38.7.0 (boo#969894) * MFSA 2015-81/CVE-2015-4477 (bmo#1179484) Use-after-free in MediaStream playback * MFSA 2015-136/CVE-2015-7207 (bmo#1185256) Same-origin policy violation using performance.getEntries and history navigation * MFSA 2016-16/CVE-2016-1952 Miscellaneous memory safety hazards * MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and potential privilege escalation through CSP reports * MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in libstagefright when deleting an array during MP4 processing * MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be overridden * MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free in HTML5 string parser * MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free in SetBody * MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using multiple WebRTC data channels * MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML transformations * MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though history navigation and Location protocol property * MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with malicious NPAPI plugin * MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML parser following a failed allocation * MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-402=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-38.7.0-70.80.1 MozillaThunderbird-buildsymbols-38.7.0-70.80.1 MozillaThunderbird-debuginfo-38.7.0-70.80.1 MozillaThunderbird-debugsource-38.7.0-70.80.1 MozillaThunderbird-devel-38.7.0-70.80.1 MozillaThunderbird-translations-common-38.7.0-70.80.1 MozillaThunderbird-translations-other-38.7.0-70.80.1 References: https://www.suse.com/security/cve/CVE-2015-4477.html https://www.suse.com/security/cve/CVE-2015-7207.html https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1958.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1962.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1965.html https://www.suse.com/security/cve/CVE-2016-1966.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://bugzilla.suse.com/969894

1 0

openSUSE-RU-2016:0893-1: Recommended update for timezone
by maintenance＠opensuse.org 25 Mar '16

25 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0893-1 Rating: low References: #972433 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016c) for your system, including the following changes: - Azerbaijan no longer observes DST (Asia/Baku) - Chile reverts from permanent to seasonal DST This release also includes changes affecting past time stamps and documentation. For a comprehensive list, please refer to the release announcement from ICANN: http://mm.icann.org/pipermail/tz-announce/2016-March/000037.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 4886=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016c-0.11.1 timezone-debuginfo-2016c-0.11.1 timezone-debugsource-2016c-0.11.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016c-0.11.1 References: https://bugzilla.suse.com/972433

1 0

openSUSE-RU-2016:0892-1: Recommended update for timezone
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0892-1 Rating: low References: #971377 #972433 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides the latest timezone information (2016c) for your system, including the following changes: - Azerbaijan no longer observes DST. - Chile reverts from permanent to seasonal DST. - Correct past timestamps for Europe/Kaliningrad, Europe/Vilnius, Europe/Volgograd 1989-1991 - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-401=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2016c-38.1 timezone-debuginfo-2016c-38.1 timezone-debugsource-2016c-38.1 - openSUSE 13.2 (noarch): timezone-java-2016c-38.1 References: https://bugzilla.suse.com/971377 https://bugzilla.suse.com/972433

1 0

openSUSE-RU-2016:0891-1: Recommended update for timezone
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0891-1 Rating: low References: #971377 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016b) for your system, including the following changes: - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on 2016-03-27 at 02:00 local time. - New zone Asia/Barnaul for Altai Krai and Altai Republic, Russia, which will switch from +06 to +07 on the same date and local time. - Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00. - As a trial of a new system that needs less information to be made up, the new zones use numeric time zone abbreviations like "+04" instead of invented abbreviations like "ASTT". - Haiti will not observe DST in 2016. - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00. - tzselect's diagnostics and checking, and checktab.awk's checking, have been improved. - tzselect now tests Julian-date TZ settings more accurately. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-400=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016b-0.8.1 timezone-debuginfo-2016b-0.8.1 timezone-debugsource-2016b-0.8.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016b-0.8.1 References: https://bugzilla.suse.com/971377

1 0

openSUSE-SU-2016:0888-1: moderate: Security update for quagga
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0888-1 Rating: moderate References: #970952 Cross-References: CVE-2016-2342 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following security issue: - CVE-2016-2342: Quagga was extended the prefixlen check to ensure it is within the bound of the NLRI packet data and the on-stack prefix structure and the maximum size for the address family (bsc#970952). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-396=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quagga-0.99.24.1-5.1 quagga-debuginfo-0.99.24.1-5.1 quagga-debugsource-0.99.24.1-5.1 quagga-devel-0.99.24.1-5.1 References: https://www.suse.com/security/cve/CVE-2016-2342.html https://bugzilla.suse.com/970952

1 0

openSUSE-RU-2016:0887-1: moderate: Recommended update for yast2
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0887-1 Rating: moderate References: #955400 #960040 #963585 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for YaST fixes the following issues: - SuSEFirewall module reads system configuration during autoinstallation. It behaves in the same way as regular installation or normal operation. (bsc#963585) - AutoYaST settings for SuSEFirewall are now merged with the existing configuration instead of being fully overwritten. - Put valid hostname into AutoYaST profile generated at the end of installation. (bsc#960040) - Add a default value for firewall setting FW_BOOT_INIT_FULL. (bsc#955400) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-398=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): yast2-3.1.155.3-3.1 yast2-devel-doc-3.1.155.3-3.1 References: https://bugzilla.suse.com/955400 https://bugzilla.suse.com/960040 https://bugzilla.suse.com/963585

1 0

openSUSE-RU-2016:0886-1: moderate: Recommended update for os-prober
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for os-prober ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0886-1 Rating: moderate References: #892364 #931955 #953987 #954225 #957018 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for os-prober fixes the following issues: Various patches were merged from openSUSE Factory: - fix os-prober fails to detect other SLES12 installation (boo#892364) - fix os-prober mount error, no such file or directory (boo#931955) - also skip legacy grub if /boot/grub2/grub.cfg is present - fix detect os on default subvolume in snapshot (boo#954225) - fix os-prober update broke Linux detection (boo#957018) - fix y2base runs at 100% cpu busy from beginning in installation of files to completion (boo#953987) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-391=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): os-prober-1.61-12.4.1 os-prober-debuginfo-1.61-12.4.1 os-prober-debugsource-1.61-12.4.1 References: https://bugzilla.suse.com/892364 https://bugzilla.suse.com/931955 https://bugzilla.suse.com/953987 https://bugzilla.suse.com/954225 https://bugzilla.suse.com/957018

1 0

openSUSE-RU-2016:0885-1: moderate: Recommended update for mgetty
by maintenance＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Recommended Update: Recommended update for mgetty ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0885-1 Rating: moderate References: #968571 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mgetty fixes the following issues: - Use correct permissions for unit files (boo#968571) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-390=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-390=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): g3utils-1.1.36-62.1 g3utils-debuginfo-1.1.36-62.1 mgetty-1.1.36-62.1 mgetty-debuginfo-1.1.36-62.1 mgetty-debugsource-1.1.36-62.1 sendfax-1.1.36-62.1 sendfax-debuginfo-1.1.36-62.1 - openSUSE 13.2 (i586 x86_64): g3utils-1.1.36-55.7.1 g3utils-debuginfo-1.1.36-55.7.1 mgetty-1.1.36-55.7.1 mgetty-debuginfo-1.1.36-55.7.1 mgetty-debugsource-1.1.36-55.7.1 sendfax-1.1.36-55.7.1 sendfax-debuginfo-1.1.36-55.7.1 References: https://bugzilla.suse.com/968571

1 0

openSUSE-SU-2016:0882-1: moderate: Security update for dropbear
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0882-1 Rating: moderate References: #970633 Cross-References: CVE-2016-3116 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: dropbear was updated to 2016.72 to fix the following issues: Changes in dropbear: - updated to upstream version 2016.72 * Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug fix release for boo#970633 - CVE-2016-3116 - updated to upstream version 2015.71 * Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 * Fix crash on exit when -p address:port is used, broke in 2015.68 * Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev * Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert, broke in 2015.70 * Fix server race condition that could cause sessions to hang on exit, https://github.com/robotframework/SSHLibrary/issues/128 - updated to upstream version 2015.70 * Fix server password authentication on Linux, broke in 2015.69 * Fix crash when forwarded TCP connections fail to connect (bug introduced in 2015.68) * Avoid hang on session close when multiple sessions are started, affects Qt Creator Patch from Andrzej Szombierski * Reduce per-channel memory consumption in common case, increase default channel limit from 100 to 1000 which should improve SOCKS forwarding for modern webpages * Handle multiple command line arguments in a single flag, thanks to Guilhem Moulin * Manpage improvements from Guilhem Moulin * Build fixes for Android from Mike Frysinger * Don't display the MOTD when an explicit command is run from Guilhem Moulin * Check curve25519 shared secret isn't zero - updated to upstream version 2015.68 * Reduce local data copying for improved efficiency. Measured 30% increase in throughput for connections to localhost * Forwarded TCP ports connect asynchronously and try all available addresses (IPv4, IPv6, round robin DNS) * Fix all compile warnings, many patches from Gaël Portay Note that configure with -Werror may not be successful on some platforms (OS X) and some configuration options may still result in unused variable warnings. * Use TCP Fast Open on Linux if available. Saves a round trip at connection to hosts that have previously been connected. Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" Client side is disabled by default pending further compatibility testing with networks and systems. * Increase maximum command length to 9000 bytes * Free memory before exiting, patch from Thorsten Horstmann. Useful for Dropbear ports to embedded systems and for checking memory leaks with valgrind. Only partially implemented for dbclient. This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h * DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless there is a leading slash (~ isn't treated specially) * Fix small ECC memory leaks * Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of Matta Consulting. Odds of bad values are around 2**-512 -- improbable. * Twofish-ctr cipher is supported though disabled by default * Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks to CL Ouyang * Fix null pointer crash with restrictions in authorized_keys without a command, patch from Guilhem Moulin * Ensure authentication timeout is handled while reading the initial banner, thanks to CL Ouyang for finding it. * Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz - fixed checksum URL - updated to upstream version 2015.67 * Call fsync() after generating private keys to ensure they aren't lost if a reboot occurs. Thanks to Peter Korsgaard * Disable non-delayed zlib compression by default on the server. Can be enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB * Default client key path ~/.ssh/id_dropbear * Prefer stronger algorithms by default, from Fedor Brunner. AES256 over 3DES Diffie-hellman group14 over group1 * Add option to disable CBC ciphers. * Disable twofish in default options.h * Enable sha2 HMAC algorithms by default, the code was already required for ECC key exchange. sha1 is the first preference still for performance. * Fix installing dropbear.8 in a separate build directory, from Like Ma * Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe * Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea * Minor bug fixes, a few issues found by Coverity scan - replaced deprecated gpg-offline check by obs-service-source_validator - updated to upstream version 2014.66 * Use the same keepalive handling behaviour as OpenSSH. This will work better with some SSH implementations that have different behaviour with unknown message types. * Don't reply with SSH_MSG_UNIMPLEMENTED when we receive a reply to our own keepalive message * Set $SSH_CLIENT to keep bash happy, patch from Ryan Cleere * Fix wtmp which broke since 2013.62, patch from Whoopie Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-387=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-387=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dropbear-2016.72-8.1 dropbear-debuginfo-2016.72-8.1 dropbear-debugsource-2016.72-8.1 - openSUSE 13.2 (i586 x86_64): dropbear-2016.72-2.3.1 dropbear-debuginfo-2016.72-2.3.1 dropbear-debugsource-2016.72-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-3116.html https://bugzilla.suse.com/970633

1 0

openSUSE-SU-2016:0881-1: moderate: Security update for perl
by opensuse-security＠opensuse.org 24 Mar '16

24 Mar '16

openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0881-1 Rating: moderate References: #928292 #961528 #967082 Cross-References: CVE-2015-8607 CVE-2016-2381 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for perl fixes the following issues: - CVE-2016-2381: Fixed environment duplicated variable handling bug [boo#967082] - fix memory leak in 'use utf8' handling [boo#928292] - CVE-2015-8607: Fixed taint propagation in canonpath [boo#961528] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-386=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): perl-5.20.1-3.1 perl-base-5.20.1-3.1 perl-base-debuginfo-5.20.1-3.1 perl-debuginfo-5.20.1-3.1 perl-debugsource-5.20.1-3.1 - openSUSE 13.2 (x86_64): perl-32bit-5.20.1-3.1 perl-base-32bit-5.20.1-3.1 perl-base-debuginfo-32bit-5.20.1-3.1 perl-debuginfo-32bit-5.20.1-3.1 - openSUSE 13.2 (noarch): perl-doc-5.20.1-3.1 References: https://www.suse.com/security/cve/CVE-2015-8607.html https://www.suse.com/security/cve/CVE-2016-2381.html https://bugzilla.suse.com/928292 https://bugzilla.suse.com/961528 https://bugzilla.suse.com/967082

1 0