May 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1222-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1222-1 Rating: important References: #976340 Cross-References: CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following security issues - April 2016 Oracle CPU (bsc#976340): - CVE-2016-0686: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. - CVE-2016-0687: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component - CVE-2016-0695: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to the Security Component - CVE-2016-3425: Unspecified vulnerability allowed remote attackers to affect availability via vectors related to JAXP - CVE-2016-3426: Unspecified vulnerability allowed remote attackers to affect confidentiality via vectors related to JCE - CVE-2016-3427: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-554=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.91-27.1 java-1_8_0-openjdk-accessibility-1.8.0.91-27.1 java-1_8_0-openjdk-debuginfo-1.8.0.91-27.1 java-1_8_0-openjdk-debugsource-1.8.0.91-27.1 java-1_8_0-openjdk-demo-1.8.0.91-27.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.91-27.1 java-1_8_0-openjdk-devel-1.8.0.91-27.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.91-27.1 java-1_8_0-openjdk-headless-1.8.0.91-27.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.91-27.1 java-1_8_0-openjdk-src-1.8.0.91-27.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.91-27.1 References: https://www.suse.com/security/cve/CVE-2016-0686.html https://www.suse.com/security/cve/CVE-2016-0687.html https://www.suse.com/security/cve/CVE-2016-0695.html https://www.suse.com/security/cve/CVE-2016-3425.html https://www.suse.com/security/cve/CVE-2016-3426.html https://www.suse.com/security/cve/CVE-2016-3427.html https://bugzilla.suse.com/976340

1 0

openSUSE-RU-2016:1221-1: Recommended update for nfs-utils
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for nfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1221-1 Rating: low References: #945937 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nfs-utils fixes the following issue: - mount.nfs should fail if statd is being slow to start due to DNS issues (bsc#945937) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-542=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nfs-client-1.3.0-17.1 nfs-client-debuginfo-1.3.0-17.1 nfs-doc-1.3.0-17.1 nfs-kernel-server-1.3.0-17.1 nfs-kernel-server-debuginfo-1.3.0-17.1 nfs-utils-debugsource-1.3.0-17.1 References: https://bugzilla.suse.com/945937

1 0

openSUSE-SU-2016:1220-1: Security update for wireshark
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1220-1 Rating: low References: #976944 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update to wireshark 1.12.11 fixes a number issues in protocol dissectors that could have allowed a remote attacker to crash Wireshark or cause excessive CPU usage through specially crafted packages inserted into the network or a capture file. - The PKTC dissector could crash (wnpa-sec-2016-22) - The PKTC dissector could crash (wnpa-sec-2016-23) - The IAX2 dissector could go into an infinite loop (wnpa-sec-2016-24) - Wireshark and TShark could exhaust the stack (wnpa-sec-2016-25) - The GSM CBCH dissector could crash (wnpa-sec-2016-26) - The NCP dissector could crash (wnpa-sec-2016-28) - Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.11.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-557=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-557=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): wireshark-1.12.11-20.1 wireshark-debuginfo-1.12.11-20.1 wireshark-debugsource-1.12.11-20.1 wireshark-devel-1.12.11-20.1 wireshark-ui-gtk-1.12.11-20.1 wireshark-ui-gtk-debuginfo-1.12.11-20.1 wireshark-ui-qt-1.12.11-20.1 wireshark-ui-qt-debuginfo-1.12.11-20.1 - openSUSE 13.2 (i586 x86_64): wireshark-1.12.11-35.1 wireshark-debuginfo-1.12.11-35.1 wireshark-debugsource-1.12.11-35.1 wireshark-devel-1.12.11-35.1 wireshark-ui-gtk-1.12.11-35.1 wireshark-ui-gtk-debuginfo-1.12.11-35.1 wireshark-ui-qt-1.12.11-35.1 wireshark-ui-qt-debuginfo-1.12.11-35.1 References: https://bugzilla.suse.com/976944

1 0

openSUSE-SU-2016:1219-1: moderate: Security update for giflib
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for giflib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1219-1 Rating: moderate References: #974847 Cross-References: CVE-2016-3977 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: giflib was updated to fix one security issue. This security issue was fixed: - CVE-2016-3977: Heap buffer overflow in gif2rgb (bsc#974847). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-556=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): giflib-debugsource-5.0.5-10.1 giflib-devel-5.0.5-10.1 giflib-progs-5.0.5-10.1 giflib-progs-debuginfo-5.0.5-10.1 libgif6-5.0.5-10.1 libgif6-debuginfo-5.0.5-10.1 - openSUSE Leap 42.1 (x86_64): giflib-devel-32bit-5.0.5-10.1 libgif6-32bit-5.0.5-10.1 libgif6-debuginfo-32bit-5.0.5-10.1 References: https://www.suse.com/security/cve/CVE-2016-3977.html https://bugzilla.suse.com/974847

1 0

openSUSE-RU-2016:1218-1: moderate: Recommended update for Mesa
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for Mesa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1218-1 Rating: moderate References: #977047 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Mesa fixes the following issues: - Fix Nouveau crashing when starting xterm (boo#977047) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-544=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): Mesa-11.0.8-145.1 Mesa-debuginfo-11.0.8-145.1 Mesa-debugsource-11.0.8-145.1 Mesa-devel-11.0.8-145.1 Mesa-dri-devel-11.0.8-145.1 Mesa-libEGL-devel-11.0.8-145.1 Mesa-libEGL1-11.0.8-145.1 Mesa-libEGL1-debuginfo-11.0.8-145.1 Mesa-libGL-devel-11.0.8-145.1 Mesa-libGL1-11.0.8-145.1 Mesa-libGL1-debuginfo-11.0.8-145.1 Mesa-libGLESv1_CM-devel-11.0.8-145.1 Mesa-libGLESv1_CM1-11.0.8-145.1 Mesa-libGLESv1_CM1-debuginfo-11.0.8-145.1 Mesa-libGLESv2-2-11.0.8-145.1 Mesa-libGLESv2-2-debuginfo-11.0.8-145.1 Mesa-libGLESv2-devel-11.0.8-145.1 Mesa-libGLESv3-devel-11.0.8-145.1 Mesa-libd3d-11.0.8-145.1 Mesa-libd3d-debuginfo-11.0.8-145.1 Mesa-libd3d-devel-11.0.8-145.1 Mesa-libglapi-devel-11.0.8-145.1 Mesa-libglapi0-11.0.8-145.1 Mesa-libglapi0-debuginfo-11.0.8-145.1 libOSMesa-devel-11.0.8-145.1 libOSMesa9-11.0.8-145.1 libOSMesa9-debuginfo-11.0.8-145.1 libXvMC_nouveau-11.0.8-145.1 libXvMC_nouveau-debuginfo-11.0.8-145.1 libXvMC_r600-11.0.8-145.1 libgbm-devel-11.0.8-145.1 libgbm1-11.0.8-145.1 libgbm1-debuginfo-11.0.8-145.1 libvdpau_nouveau-11.0.8-145.1 libvdpau_nouveau-debuginfo-11.0.8-145.1 libvdpau_r300-11.0.8-145.1 libvdpau_r600-11.0.8-145.1 libvdpau_radeonsi-11.0.8-145.1 libwayland-egl-devel-11.0.8-145.1 libwayland-egl1-11.0.8-145.1 libwayland-egl1-debuginfo-11.0.8-145.1 libxatracker-devel-1.0.0-145.1 libxatracker2-1.0.0-145.1 libxatracker2-debuginfo-1.0.0-145.1 - openSUSE Leap 42.1 (x86_64): Mesa-32bit-11.0.8-145.1 Mesa-debuginfo-32bit-11.0.8-145.1 Mesa-libEGL-devel-32bit-11.0.8-145.1 Mesa-libEGL1-32bit-11.0.8-145.1 Mesa-libEGL1-debuginfo-32bit-11.0.8-145.1 Mesa-libGL-devel-32bit-11.0.8-145.1 Mesa-libGL1-32bit-11.0.8-145.1 Mesa-libGL1-debuginfo-32bit-11.0.8-145.1 Mesa-libGLESv1_CM-devel-32bit-11.0.8-145.1 Mesa-libGLESv1_CM1-32bit-11.0.8-145.1 Mesa-libGLESv1_CM1-debuginfo-32bit-11.0.8-145.1 Mesa-libGLESv2-2-32bit-11.0.8-145.1 Mesa-libGLESv2-2-debuginfo-32bit-11.0.8-145.1 Mesa-libGLESv2-devel-32bit-11.0.8-145.1 Mesa-libd3d-32bit-11.0.8-145.1 Mesa-libd3d-debuginfo-32bit-11.0.8-145.1 Mesa-libd3d-devel-32bit-11.0.8-145.1 Mesa-libglapi-devel-32bit-11.0.8-145.1 Mesa-libglapi0-32bit-11.0.8-145.1 Mesa-libglapi0-debuginfo-32bit-11.0.8-145.1 libOSMesa-devel-32bit-11.0.8-145.1 libOSMesa9-32bit-11.0.8-145.1 libOSMesa9-debuginfo-32bit-11.0.8-145.1 libXvMC_nouveau-32bit-11.0.8-145.1 libXvMC_nouveau-debuginfo-32bit-11.0.8-145.1 libXvMC_r600-32bit-11.0.8-145.1 libgbm-devel-32bit-11.0.8-145.1 libgbm1-32bit-11.0.8-145.1 libgbm1-debuginfo-32bit-11.0.8-145.1 libvdpau_nouveau-32bit-11.0.8-145.1 libvdpau_nouveau-debuginfo-32bit-11.0.8-145.1 libvdpau_r300-32bit-11.0.8-145.1 libvdpau_r600-32bit-11.0.8-145.1 libvdpau_radeonsi-32bit-11.0.8-145.1 libwayland-egl-devel-32bit-11.0.8-145.1 libwayland-egl1-32bit-11.0.8-145.1 libwayland-egl1-debuginfo-32bit-11.0.8-145.1 References: https://bugzilla.suse.com/977047

1 0

openSUSE-RU-2016:1217-1: moderate: Recommended update for autofs
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for autofs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1217-1 Rating: moderate References: #955477 #966573 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for autofs fixes the following issues: - Improve scalability of direct mount path component creation. (bsc#966573) - Use libldap_r instead of libldap for thread safety. (bsc#955477) - Don't overwrite tirpc version of auth_destroy. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-543=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): autofs-5.0.9-6.1 autofs-debuginfo-5.0.9-6.1 autofs-debugsource-5.0.9-6.1 References: https://bugzilla.suse.com/955477 https://bugzilla.suse.com/966573

1 0

openSUSE-SU-2016:1216-1: moderate: Security update for xerces-j2
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for xerces-j2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1216-1 Rating: moderate References: #814241 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: xerces-j2 was updated to fix one security issue. This security issue was fixed: - bsc#814241: Fixed possible DoS through very long attribute names Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-558=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): xerces-j2-2.11.0-3.3.1 xerces-j2-demo-2.11.0-3.3.1 xerces-j2-scripts-2.11.0-3.3.1 xerces-j2-xml-apis-2.11.0-3.3.1 xerces-j2-xml-resolver-2.11.0-3.3.1 References: https://bugzilla.suse.com/814241

1 0

openSUSE-RU-2016:1215-1: Recommended update for postfix
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1215-1 Rating: low References: #947519 #947707 #972346 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for postfix fixes the following issues: - Incorrect path to smtp_tls_session_cache_database in config.postfix script. (bsc#972346) - Mail generated by Amavis prevented from being re-addressed by /etc/postfix/virtual. (bsc#947707) - SuSEconfig.postfix should enforce umask 022. (bsc#947519) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-549=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): postfix-2.11.6-3.1 postfix-debuginfo-2.11.6-3.1 postfix-debugsource-2.11.6-3.1 postfix-devel-2.11.6-3.1 postfix-mysql-2.11.6-3.1 postfix-mysql-debuginfo-2.11.6-3.1 postfix-postgresql-2.11.6-3.1 postfix-postgresql-debuginfo-2.11.6-3.1 - openSUSE Leap 42.1 (noarch): postfix-doc-2.11.6-3.1 References: https://bugzilla.suse.com/947519 https://bugzilla.suse.com/947707 https://bugzilla.suse.com/972346

1 0

openSUSE-SU-2016:1214-1: moderate: Security update for jq
by opensuse-security＠opensuse.org 04 May '16

04 May '16

openSUSE Security Update: Security update for jq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1214-1 Rating: moderate References: #976992 Cross-References: CVE-2015-8863 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: jq was updated to fix one security issue. This security issue was fixed: - CVE-2015-8863: Heap buffer overflow in tokenadd() function (boo#976992). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-550=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): jq-1.5-7.1 jq-debuginfo-1.5-7.1 jq-debugsource-1.5-7.1 libjq-devel-1.5-7.1 libjq1-1.5-7.1 libjq1-debuginfo-1.5-7.1 References: https://www.suse.com/security/cve/CVE-2015-8863.html https://bugzilla.suse.com/976992

1 0

openSUSE-RU-2016:1213-1: moderate: Recommended update for audacity
by maintenance＠opensuse.org 04 May '16

04 May '16

openSUSE Recommended Update: Recommended update for audacity ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1213-1 Rating: moderate References: #976964 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for audacity fixes the following issues: - fix usage of custom temp directories (boo#976964). - Build with ffmpeg support in openSUSE Leap 42.1 and newer. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-548=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): audacity-2.1.1-5.1 audacity-debuginfo-2.1.1-5.1 audacity-debugsource-2.1.1-5.1 - openSUSE Leap 42.1 (noarch): audacity-lang-2.1.1-5.1 References: https://bugzilla.suse.com/976964

1 0