May 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1238-1: important: Security update for openssl
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1238-1 Rating: important References: #958501 #976942 #976943 #977614 #977615 #977616 #977617 #977621 Cross-References: CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for openssl fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder (boo#977617) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (boo#977616) - CVE-2016-2105: EVP_EncodeUpdate overflow (boo#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (boo#977615) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (boo#976942) - boo#976943: Buffer overrun in ASN1_parse - boo#977621: Preserve digests for SNI - boo#958501: Fix openssl enc -non-fips-allow option in FIPS mode Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-561=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.36.1 libopenssl1_0_0-1.0.1k-2.36.1 libopenssl1_0_0-debuginfo-1.0.1k-2.36.1 libopenssl1_0_0-hmac-1.0.1k-2.36.1 openssl-1.0.1k-2.36.1 openssl-debuginfo-1.0.1k-2.36.1 openssl-debugsource-1.0.1k-2.36.1 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.36.1 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.36.1 libopenssl1_0_0-32bit-1.0.1k-2.36.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.36.1 libopenssl1_0_0-hmac-32bit-1.0.1k-2.36.1 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2107.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/958501 https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977616 https://bugzilla.suse.com/977617 https://bugzilla.suse.com/977621

1 0

openSUSE-SU-2016:1237-1: important: Security update for openssl
by opensuse-security＠opensuse.org 05 May '16

05 May '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1237-1 Rating: important References: #976942 #976943 #977614 #977615 #977616 #977617 Cross-References: CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for openssl fixes the following issues: - CVE-2016-2105: EVP_EncodeUpdate overflow (bsc#977614) - CVE-2016-2106: EVP_EncryptUpdate overflow (bsc#977615) - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check (bsc#977616) - CVE-2016-2108: Memory corruption in the ASN.1 encoder (bsc#977617) - CVE-2016-2109: ASN.1 BIO excessive memory allocation (bsc#976942) - bsc#976943: Buffer overrun in ASN1_parse Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-562=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): libopenssl-devel-1.0.1p-74.1 libopenssl1_0_0-1.0.1p-74.1 libopenssl1_0_0-debuginfo-1.0.1p-74.1 openssl-1.0.1p-74.1 openssl-debuginfo-1.0.1p-74.1 openssl-debugsource-1.0.1p-74.1 - openSUSE Evergreen 11.4 (x86_64): libopenssl-devel-32bit-1.0.1p-74.1 libopenssl1_0_0-32bit-1.0.1p-74.1 libopenssl1_0_0-debuginfo-32bit-1.0.1p-74.1 - openSUSE Evergreen 11.4 (noarch): openssl-doc-1.0.1p-74.1 - openSUSE Evergreen 11.4 (ia64): libopenssl1_0_0-debuginfo-x86-1.0.1p-74.1 libopenssl1_0_0-x86-1.0.1p-74.1 References: https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2106.html https://www.suse.com/security/cve/CVE-2016-2107.html https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-2109.html https://bugzilla.suse.com/976942 https://bugzilla.suse.com/976943 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977615 https://bugzilla.suse.com/977616 https://bugzilla.suse.com/977617

1 0

openSUSE-SU-2016:1235-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1235-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3427 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency (bsc#976340). - CVE-2016-0687: Better byte behavior (bsc#976340). - CVE-2016-0695: Make DSA more fair (bsc#976340). - CVE-2016-3425: Better buffering of XML strings (bsc#976340). - CVE-2016-3427: Improve JMX connections (bsc#976340). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-560=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.101-24.36.2 java-1_7_0-openjdk-accessibility-1.7.0.101-24.36.2 java-1_7_0-openjdk-debuginfo-1.7.0.101-24.36.2 java-1_7_0-openjdk-debugsource-1.7.0.101-24.36.2 java-1_7_0-openjdk-demo-1.7.0.101-24.36.2 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-24.36.2 java-1_7_0-openjdk-devel-1.7.0.101-24.36.2 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-24.36.2 java-1_7_0-openjdk-headless-1.7.0.101-24.36.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-24.36.2 java-1_7_0-openjdk-src-1.7.0.101-24.36.2 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.101-24.36.2 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340

1 0

openSUSE-SU-2016:1230-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1230-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3427 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk to version 2.6.6 fixes five security issues. These security issues were fixed: - CVE-2016-0686: Ensure thread consistency (bsc#976340). - CVE-2016-0687: Better byte behavior (bsc#976340). - CVE-2016-0695: Make DSA more fair (bsc#976340). - CVE-2016-3425: Better buffering of XML strings (bsc#976340). - CVE-2016-3427: Improve JMX connections (bsc#976340). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-553=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.101-22.1 java-1_7_0-openjdk-accessibility-1.7.0.101-22.1 java-1_7_0-openjdk-bootstrap-1.7.0.101-22.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.101-22.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.101-22.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.101-22.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.101-22.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.101-22.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.101-22.1 java-1_7_0-openjdk-debuginfo-1.7.0.101-22.1 java-1_7_0-openjdk-debugsource-1.7.0.101-22.1 java-1_7_0-openjdk-demo-1.7.0.101-22.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.101-22.1 java-1_7_0-openjdk-devel-1.7.0.101-22.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.101-22.1 java-1_7_0-openjdk-headless-1.7.0.101-22.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.101-22.1 java-1_7_0-openjdk-src-1.7.0.101-22.1 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.101-22.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340

1 0

openSUSE-FU-2016:1229-1: moderate: Add go 1.6 to the SUSE Package Hub
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Feature Update: Add go 1.6 to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-FU-2016:1229-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update adds go 1.6 to the SUSE Package Hub. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-552=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go-1.6.1-2.1 go-doc-1.6.1-2.1 References:

1 0

openSUSE-SU-2016:1227-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1227-1 Rating: moderate References: #965902 Cross-References: CVE-2015-7511 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libgcrypt was updated to fix one security issue. This security issue was fixed: - CVE-2015-7511: Side-channel attack on ECDH with Weierstrass curves (bsc#965902). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-559=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgcrypt-cavs-1.6.1-26.1 libgcrypt-cavs-debuginfo-1.6.1-26.1 libgcrypt-debugsource-1.6.1-26.1 libgcrypt-devel-1.6.1-26.1 libgcrypt-devel-debuginfo-1.6.1-26.1 libgcrypt20-1.6.1-26.1 libgcrypt20-debuginfo-1.6.1-26.1 libgcrypt20-hmac-1.6.1-26.1 - openSUSE Leap 42.1 (x86_64): libgcrypt-devel-32bit-1.6.1-26.1 libgcrypt-devel-debuginfo-32bit-1.6.1-26.1 libgcrypt20-32bit-1.6.1-26.1 libgcrypt20-debuginfo-32bit-1.6.1-26.1 libgcrypt20-hmac-32bit-1.6.1-26.1 References: https://www.suse.com/security/cve/CVE-2015-7511.html https://bugzilla.suse.com/965902

1 0

openSUSE-SU-2016:1226-1: important: Security update for yast2-users
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for yast2-users ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1226-1 Rating: important References: #971804 #973639 #974220 Cross-References: CVE-2016-1601 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: yast2-users was updated to fix one security issue. This security issue was fixed: - CVE-2016-1601: Empty passwords fields in /etc/shadow after SLES 12 SP1 autoyast installation (bsc#974220). This update includes a script that fixes installations that we're affected by this problem. It is run automatically upon installing the update. This non-security issue was fixed: - bsc#971804: Set root password correctly when using a minimal profile This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-555=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): yast2-users-3.1.41.3-10.1 yast2-users-debuginfo-3.1.41.3-10.1 yast2-users-debugsource-3.1.41.3-10.1 yast2-users-devel-doc-3.1.41.3-10.1 References: https://www.suse.com/security/cve/CVE-2016-1601.html https://bugzilla.suse.com/971804 https://bugzilla.suse.com/973639 https://bugzilla.suse.com/974220

1 0

openSUSE-RU-2016:1225-1: Recommended update for postgrey
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for postgrey ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1225-1 Rating: low References: #976963 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This patch fixes the missing sysconfig template for postgrey. Without the sysconfig template the service cannot correctly start. (boo#976963) The package is also updated to version 1.36 which includes a few minor improvements: - Improved support for IPv6 addresses: new --ipv4cidr and --ipv6cidr options for proper subnetting of IPv6 - Updated whitelist - user-settable unix socket permission: --socketmode Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-545=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): postgrey-1.36-6.1 References: https://bugzilla.suse.com/976963

1 0

openSUSE-RU-2016:1224-1: Recommended update for python-boto3, python-botocore
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for python-boto3, python-botocore ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1224-1 Rating: low References: #974705 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides newer versions of python-boto3 and python-botocore, which bring several fixes and enhancements. python-boto3 (updated to version 1.3.0): - Session: Add get_available_partitions and get_available_regions methods to determine partitions and a service's available regions. - EC2: Update resource model to include Route resources. - Resources: Properly alias identifiers which are also in the shape. - S3: Forward extra_args when using multipart downloads. - EC2: Add delete_tags() action to Instance resource. - Session: Add region_name property on session. - S3: Fix issue with hanging downloads. python-botocore (updated to version 1.4.10): - Lambda: Added support for setting the function runtime as nodejs4.3, as well as updating function configuration to set the runtime. - DS: Added support for Directory Service Conditional Forwarder APIs. - Elasticbeanstalk: Adds support for three additional elements in AWS Elasticbeanstalk's DescribeInstancesHealthResponse: Deployment, AvailabilityZone, and InstanceType. Additionally adds support for increased EnvironmentName length from 23 to 40. - APIGateway: Added support for API Import. - Route53: Added support for metric-based health checks and regional health checks. - STS: Added support for GetCallerIdentity, which returns details about the credentials used to make the API call. The details include name and account, as well as the type of entity making the call, such as an IAM user vs. federated user. - S3: Added support for VersionId in PutObjectAcl. - DeviceFarm: Add support to pay a flat monthly fee for unlimited testing of your Android and iOS apps with AWS Device Farm device slots - RDS: Add support for customizing the order in which Aurora Replicas are promoted to primary instance during a failover. - MeteringMarketplace: The AWS Marketplace Metering Service enables sellers to price their products along new pricing dimensions. - S3: Added support for delete marker and abort multipart upload lifecycle configuration. - IOT: Added support for Amazon Elasticsearch Service and Amazon Cloudwatch actions for the AWS IoT rules engine. - CloudHSM: Added support for tagging resources. - DMS: Added support for AWS Database Migration Service. - SES: Added support for white-labeling. - CodeDeploy: Added support for BatchGetDeploymentGroups. - Config: Moved Config to its own class to boost import speed. - EC2: Add support for VPC peering with security groups. - DirectoryService: Add SNS event notification support. - Regions: Add ability to list regions and endpoints for services in a partition. - DynamoDB: Add support for DescribeLimits. - APIGateway: Add support for TestInvokeAuthorizer and FlushStageAuthorizersCache operations. - CloudSearchDomain: Add support for stats. - StorageGateway: Added support for user-supplied barcodes. - CodeDeploy: Added support for setting up triggers for a deployment group. - RDS: Added support for Cross-account Encrypted (KMS) snapshot sharing. - EMR: Added support for adding EBS storage to EMR instances. For a comprehensive list of changes please refer to the package's change logs. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-546=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): python-boto3-1.3.0-2.1 python-botocore-1.4.10-6.1 References: https://bugzilla.suse.com/974705

1 0

openSUSE-RU-2016:1223-1: moderate: Recommended update for syncthing and syncthing-gtk
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for syncthing and syncthing-gtk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1223-1 Rating: moderate References: #975873 #976937 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update provides version 0.8.3 for syncthing-gtk and version 0.12.22 for syncthing. For detailed information please refere to: https://github.com/syncthing/syncthing-gtk/releases https://github.com/syncthing/syncthing/releases Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-547=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): syncthing-0.12.22-3.1 - openSUSE Leap 42.1 (noarch): syncthing-gtk-0.8.3-3.1 syncthing-gtk-lang-0.8.3-3.1 References: https://bugzilla.suse.com/975873 https://bugzilla.suse.com/976937

1 0