March 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:0832-1: important: Security update for git
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0832-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-366=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): git-1.8.4.5-3.14.1 git-arch-1.8.4.5-3.14.1 git-core-1.8.4.5-3.14.1 git-core-debuginfo-1.8.4.5-3.14.1 git-cvs-1.8.4.5-3.14.1 git-daemon-1.8.4.5-3.14.1 git-daemon-debuginfo-1.8.4.5-3.14.1 git-debugsource-1.8.4.5-3.14.1 git-email-1.8.4.5-3.14.1 git-gui-1.8.4.5-3.14.1 git-remote-helpers-1.8.4.5-3.14.1 git-svn-1.8.4.5-3.14.1 git-svn-debuginfo-1.8.4.5-3.14.1 git-web-1.8.4.5-3.14.1 gitk-1.8.4.5-3.14.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-SU-2016:0831-1: important: Security update for cgit
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0831-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for cgit fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-367=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): cgit-0.8.3.3-5.11.1 cgit-debuginfo-0.8.3.3-5.11.1 cgit-debugsource-0.8.3.3-5.11.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-SU-2016:0830-1: important: Security update for bind
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0830-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: * CVE-2016-1285: remote DoS caused by malformed data on control channel * CVE-2016-1286: remote DoS via assertion failure in parsing of signature records for DNAME records Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-365=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): bind-9.9.4P2-75.1 bind-chrootenv-9.9.4P2-75.1 bind-debuginfo-9.9.4P2-75.1 bind-debugsource-9.9.4P2-75.1 bind-devel-9.9.4P2-75.1 bind-libs-9.9.4P2-75.1 bind-libs-debuginfo-9.9.4P2-75.1 bind-lwresd-9.9.4P2-75.1 bind-lwresd-debuginfo-9.9.4P2-75.1 bind-utils-9.9.4P2-75.1 bind-utils-debuginfo-9.9.4P2-75.1 - openSUSE Evergreen 11.4 (x86_64): bind-libs-32bit-9.9.4P2-75.1 bind-libs-debuginfo-32bit-9.9.4P2-75.1 - openSUSE Evergreen 11.4 (noarch): bind-doc-9.9.4P2-75.1 - openSUSE Evergreen 11.4 (ia64): bind-libs-debuginfo-x86-9.9.4P2-75.1 bind-libs-x86-9.9.4P2-75.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073

1 0

openSUSE-SU-2016:0829-1: important: Security update for cgit
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0829-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for cgit fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-367=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cgit-0.12-11.12.1 cgit-debuginfo-0.12-11.12.1 cgit-debugsource-0.12-11.12.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-SU-2016:0828-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0828-1 Rating: important References: #970509 #970511 #970514 Cross-References: CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update contains Chromium 49.0.2623.87 to fix the following issues: - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-364=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-49.0.2623.87-138.1 chromedriver-debuginfo-49.0.2623.87-138.1 chromium-49.0.2623.87-138.1 chromium-debuginfo-49.0.2623.87-138.1 chromium-debugsource-49.0.2623.87-138.1 chromium-desktop-gnome-49.0.2623.87-138.1 chromium-desktop-kde-49.0.2623.87-138.1 chromium-ffmpegsumo-49.0.2623.87-138.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-138.1 References: https://www.suse.com/security/cve/CVE-2016-1643.html https://www.suse.com/security/cve/CVE-2016-1644.html https://www.suse.com/security/cve/CVE-2016-1645.html https://bugzilla.suse.com/970509 https://bugzilla.suse.com/970511 https://bugzilla.suse.com/970514

1 0

openSUSE-SU-2016:0827-1: important: Security update for bind
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0827-1 Rating: important References: #970072 #970073 Cross-References: CVE-2016-1285 CVE-2016-1286 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: * CVE-2016-1285: remote DoS caused by malformed data on control channel * CVE-2016-1286: remote DoS via assertion failure in parsing of signature records for DNAME records Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-365=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bind-9.9.4P2-2.29.1 bind-chrootenv-9.9.4P2-2.29.1 bind-debuginfo-9.9.4P2-2.29.1 bind-debugsource-9.9.4P2-2.29.1 bind-devel-9.9.4P2-2.29.1 bind-libs-9.9.4P2-2.29.1 bind-libs-debuginfo-9.9.4P2-2.29.1 bind-lwresd-9.9.4P2-2.29.1 bind-lwresd-debuginfo-9.9.4P2-2.29.1 bind-utils-9.9.4P2-2.29.1 bind-utils-debuginfo-9.9.4P2-2.29.1 - openSUSE 13.1 (x86_64): bind-libs-32bit-9.9.4P2-2.29.1 bind-libs-debuginfo-32bit-9.9.4P2-2.29.1 - openSUSE 13.1 (noarch): bind-doc-9.9.4P2-2.29.1 References: https://www.suse.com/security/cve/CVE-2016-1285.html https://www.suse.com/security/cve/CVE-2016-1286.html https://bugzilla.suse.com/970072 https://bugzilla.suse.com/970073

1 0

openSUSE-SU-2016:0826-1: important: Security update for git
by opensuse-security＠opensuse.org 19 Mar '16

19 Mar '16

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0826-1 Rating: important References: #971328 Cross-References: CVE-2016-2315 CVE-2016-2324 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes a buffer overflow issue that had the potential to be abused for remote execution of arbitrary code (CVE-2016-2315, CVE-2016-2324, bsc#971328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-366=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): git-1.7.3.4-4.14.1 git-arch-1.7.3.4-4.14.1 git-core-1.7.3.4-4.14.1 git-core-debuginfo-1.7.3.4-4.14.1 git-cvs-1.7.3.4-4.14.1 git-daemon-1.7.3.4-4.14.1 git-daemon-debuginfo-1.7.3.4-4.14.1 git-debugsource-1.7.3.4-4.14.1 git-email-1.7.3.4-4.14.1 git-gui-1.7.3.4-4.14.1 git-remote-helpers-1.7.3.4-4.14.1 git-svn-1.7.3.4-4.14.1 git-web-1.7.3.4-4.14.1 gitk-1.7.3.4-4.14.1 References: https://www.suse.com/security/cve/CVE-2016-2315.html https://www.suse.com/security/cve/CVE-2016-2324.html https://bugzilla.suse.com/971328

1 0

openSUSE-RU-2016:0819-1: moderate: Recommended update for nfs-utils
by maintenance＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Recommended Update: Recommended update for nfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0819-1 Rating: moderate References: #950340 #963616 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for nfs-utils fixes the following issues: - Add ordering dependency on network-online.target, preventing attempts to mount NFS filesystems before the network is up. (bsc#963616) - Avoid "already mounted" errors from 'mount -a' when name in /etc/fstab differs slightly from /proc/mounts. (bsc#950340) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-363=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nfs-client-1.3.0-14.1 nfs-client-debuginfo-1.3.0-14.1 nfs-doc-1.3.0-14.1 nfs-kernel-server-1.3.0-14.1 nfs-kernel-server-debuginfo-1.3.0-14.1 nfs-utils-debugsource-1.3.0-14.1 References: https://bugzilla.suse.com/950340 https://bugzilla.suse.com/963616

1 0

openSUSE-SU-2016:0818-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0818-1 Rating: important References: #970509 #970511 #970514 Cross-References: CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update contains Chromium 49.0.2623.87 to fix the following issues: - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-362=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-49.0.2623.87-58.1 chromedriver-debuginfo-49.0.2623.87-58.1 chromium-49.0.2623.87-58.1 chromium-debuginfo-49.0.2623.87-58.1 chromium-debugsource-49.0.2623.87-58.1 chromium-desktop-gnome-49.0.2623.87-58.1 chromium-desktop-kde-49.0.2623.87-58.1 chromium-ffmpegsumo-49.0.2623.87-58.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-58.1 References: https://www.suse.com/security/cve/CVE-2016-1643.html https://www.suse.com/security/cve/CVE-2016-1644.html https://www.suse.com/security/cve/CVE-2016-1645.html https://bugzilla.suse.com/970509 https://bugzilla.suse.com/970511 https://bugzilla.suse.com/970514

1 0

openSUSE-SU-2016:0817-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 18 Mar '16

18 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0817-1 Rating: important References: #970509 #970511 #970514 Cross-References: CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update contains Chromium 49.0.2623.87 to fix the following issues: - CVE-2016-1643: Type confusion in Blink (boo#970514) - CVE-2016-1644: Use-after-free in Blink (boo#970509) - CVE-2016-1645: Out-of-bounds write in PDFium (boo#970511) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-362=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-362=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-49.0.2623.87-31.1 chromedriver-debuginfo-49.0.2623.87-31.1 chromium-49.0.2623.87-31.1 chromium-debuginfo-49.0.2623.87-31.1 chromium-debugsource-49.0.2623.87-31.1 chromium-desktop-gnome-49.0.2623.87-31.1 chromium-desktop-kde-49.0.2623.87-31.1 chromium-ffmpegsumo-49.0.2623.87-31.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-31.1 - openSUSE 13.2 (i586 x86_64): chromedriver-49.0.2623.87-84.1 chromedriver-debuginfo-49.0.2623.87-84.1 chromium-49.0.2623.87-84.1 chromium-debuginfo-49.0.2623.87-84.1 chromium-debugsource-49.0.2623.87-84.1 chromium-desktop-gnome-49.0.2623.87-84.1 chromium-desktop-kde-49.0.2623.87-84.1 chromium-ffmpegsumo-49.0.2623.87-84.1 chromium-ffmpegsumo-debuginfo-49.0.2623.87-84.1 References: https://www.suse.com/security/cve/CVE-2016-1643.html https://www.suse.com/security/cve/CVE-2016-1644.html https://www.suse.com/security/cve/CVE-2016-1645.html https://bugzilla.suse.com/970509 https://bugzilla.suse.com/970511 https://bugzilla.suse.com/970514

1 0