May 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1336-1: moderate: Security update for mercurial
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1336-1 Rating: moderate References: #978391 Cross-References: CVE-2016-3105 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mercurial fixes the following issues: Security issue fixed: - CVE-2016-3105: Fixed arbitrary code execution whenusing the convert extension on Git repo. (boo#978391) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-609=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-609=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): mercurial-3.5.1-6.1 mercurial-debuginfo-3.5.1-6.1 mercurial-debugsource-3.5.1-6.1 - openSUSE Leap 42.1 (noarch): mercurial-lang-3.5.1-6.1 - openSUSE 13.2 (i586 x86_64): mercurial-3.1.2-10.1 mercurial-debuginfo-3.1.2-10.1 mercurial-debugsource-3.1.2-10.1 - openSUSE 13.2 (noarch): mercurial-lang-3.1.2-10.1 References: https://www.suse.com/security/cve/CVE-2016-3105.html https://bugzilla.suse.com/978391

1 0

openSUSE-SU-2016:1335-1: moderate: Security update for ocaml
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for ocaml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1335-1 Rating: moderate References: #977990 Cross-References: CVE-2015-8869 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ocaml fixes the following issues: Security issue fixed: - CVE-2015-8869: prevent buffer overflow and information leak (boo#977990) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-605=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ocaml-4.01.0-6.4.1 ocaml-camlp4-4.01.0-6.4.1 ocaml-camlp4-devel-4.01.0-6.4.1 ocaml-camlp4-devel-debuginfo-4.01.0-6.4.1 ocaml-compiler-libs-4.01.0-6.4.1 ocaml-compiler-libs-devel-4.01.0-6.4.1 ocaml-debuginfo-4.01.0-6.4.1 ocaml-debugsource-4.01.0-6.4.1 ocaml-docs-4.01.0-6.4.1 ocaml-emacs-4.01.0-6.4.1 ocaml-labltk-4.01.0-6.4.1 ocaml-labltk-debuginfo-4.01.0-6.4.1 ocaml-labltk-devel-4.01.0-6.4.1 ocaml-ocamldoc-4.01.0-6.4.1 ocaml-ocamldoc-debuginfo-4.01.0-6.4.1 ocaml-runtime-4.01.0-6.4.1 ocaml-runtime-debuginfo-4.01.0-6.4.1 ocaml-source-4.01.0-6.4.1 ocaml-x11-4.01.0-6.4.1 References: https://www.suse.com/security/cve/CVE-2015-8869.html https://bugzilla.suse.com/977990

1 0

openSUSE-SU-2016:1334-1: moderate: Security update for proftpd
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for proftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1334-1 Rating: moderate References: #970890 Cross-References: CVE-2016-3125 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This proftpd update to version 1.3.5b fixes the following issues: Security issues fixed: - CVE-2016-3125: Fixed selection of DH groups from TLSDHParamFile. (boo#970890) Bugs fixed: - update to 1.3.5b: http://www.proftpd.org/docs/RELEASE_NOTES-1.3.5b * SSH RSA hostkeys smaller than 2048 bits now work properly. * MLSD response lines are now properly CRLF terminated. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-603=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-603=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): proftpd-1.3.5b-4.1 proftpd-debuginfo-1.3.5b-4.1 proftpd-debugsource-1.3.5b-4.1 proftpd-devel-1.3.5b-4.1 proftpd-doc-1.3.5b-4.1 proftpd-ldap-1.3.5b-4.1 proftpd-ldap-debuginfo-1.3.5b-4.1 proftpd-mysql-1.3.5b-4.1 proftpd-mysql-debuginfo-1.3.5b-4.1 proftpd-pgsql-1.3.5b-4.1 proftpd-pgsql-debuginfo-1.3.5b-4.1 proftpd-radius-1.3.5b-4.1 proftpd-radius-debuginfo-1.3.5b-4.1 proftpd-sqlite-1.3.5b-4.1 proftpd-sqlite-debuginfo-1.3.5b-4.1 - openSUSE Leap 42.1 (noarch): proftpd-lang-1.3.5b-4.1 - openSUSE 13.2 (i586 x86_64): proftpd-1.3.5b-6.1 proftpd-debuginfo-1.3.5b-6.1 proftpd-debugsource-1.3.5b-6.1 proftpd-devel-1.3.5b-6.1 proftpd-doc-1.3.5b-6.1 proftpd-ldap-1.3.5b-6.1 proftpd-ldap-debuginfo-1.3.5b-6.1 proftpd-mysql-1.3.5b-6.1 proftpd-mysql-debuginfo-1.3.5b-6.1 proftpd-pgsql-1.3.5b-6.1 proftpd-pgsql-debuginfo-1.3.5b-6.1 proftpd-radius-1.3.5b-6.1 proftpd-radius-debuginfo-1.3.5b-6.1 proftpd-sqlite-1.3.5b-6.1 proftpd-sqlite-debuginfo-1.3.5b-6.1 - openSUSE 13.2 (noarch): proftpd-lang-1.3.5b-6.1 References: https://www.suse.com/security/cve/CVE-2016-3125.html https://bugzilla.suse.com/970890

1 0

openSUSE-SU-2016:1333-1: moderate: Security update for librsvg
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for librsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1333-1 Rating: moderate References: #977986 Cross-References: CVE-2016-4348 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This librsvg update to version 2.40.15 fixes the following issues: Security issues fixed: - CVE-2016-4348: DoS parsing SVGs with circular definitions _rsvg_css_normalize_font_size() function (boo#977986) Bugs fixed: - Actually scale the image if required, regression fix from upstream git (bgo#760262). - Fixed bgo#759084: Don't crash when filters don't actually exist. - Updated our autogen.sh to use modern autotools. - Fixed bgo#761728: Memory leak in the PrimitiveComponentTransfer filter. - Added basic support for the "baseline-shift" attribute in text objects (bgo#340047). - Fixed some duplicate logic when rendering paths (bgo#749415). - Rewrote the markers engine (bgo#685906, bgo#760180). - Refactoring of the test harness to use Glib's gtest infrastructure, instead of using home-grown machinery. Tests can simply be put as SVG files in the tests/subdirectories; it is not necessary to list them explicitly in some text file. - Gzipped SVGs now work if read from streams. - References to objects/filters/URIs/etc. are now handled lazily. Also, there is a general-purpose cycle detector so malformed SVGs don't cause infinite loops. - Removed parsing of Adobe blend modes; they were not implemented, anyway. - Add project files for building on Visual Studio (bgo#753555). - Added an "--export-id" option to rsvg-convert(1). This lets you select a single object to export, for example, to pick out a group from a multi-part drawing. Note that this is mostly useful for PNG output right now; for SVG output we don't preserve many attributes which could be useful in the extracted version. Doing this properly requires an internal "output to SVG" backend instead of just telling Cairo to render to SVG. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-608=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-608=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.40.15-7.1 gdk-pixbuf-loader-rsvg-debuginfo-2.40.15-7.1 librsvg-2-2-2.40.15-7.1 librsvg-2-2-debuginfo-2.40.15-7.1 librsvg-debugsource-2.40.15-7.1 librsvg-devel-2.40.15-7.1 rsvg-view-2.40.15-7.1 rsvg-view-debuginfo-2.40.15-7.1 typelib-1_0-Rsvg-2_0-2.40.15-7.1 - openSUSE Leap 42.1 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.40.15-7.1 gdk-pixbuf-loader-rsvg-debuginfo-32bit-2.40.15-7.1 librsvg-2-2-32bit-2.40.15-7.1 librsvg-2-2-debuginfo-32bit-2.40.15-7.1 - openSUSE 13.2 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.40.15-10.1 gdk-pixbuf-loader-rsvg-debuginfo-2.40.15-10.1 librsvg-2-2-2.40.15-10.1 librsvg-2-2-debuginfo-2.40.15-10.1 librsvg-debugsource-2.40.15-10.1 librsvg-devel-2.40.15-10.1 rsvg-view-2.40.15-10.1 rsvg-view-debuginfo-2.40.15-10.1 typelib-1_0-Rsvg-2_0-2.40.15-10.1 - openSUSE 13.2 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.40.15-10.1 gdk-pixbuf-loader-rsvg-debuginfo-32bit-2.40.15-10.1 librsvg-2-2-32bit-2.40.15-10.1 librsvg-2-2-debuginfo-32bit-2.40.15-10.1 References: https://www.suse.com/security/cve/CVE-2016-4348.html https://bugzilla.suse.com/977986

1 0

openSUSE-SU-2016:1332-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1332-1 Rating: important References: #959724 #962779 #963810 Cross-References: CVE-2015-3194 CVE-2016-0639 CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0655 CVE-2016-0661 CVE-2016-0665 CVE-2016-0666 CVE-2016-0668 CVE-2016-0705 CVE-2016-2047 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This mysql-community-server version update to 5.6.30 fixes the following issues: Security issues fixed: - fixed CVEs (boo#962779, boo#959724): CVE-2016-0705, CVE-2016-0639, CVE-2015-3194, CVE-2016-0640, CVE-2016-2047, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650, CVE-2016-0665, CVE-2016-0666, CVE-2016-0641, CVE-2016-0642, CVE-2016-0655, CVE-2016-0661, CVE-2016-0668, CVE-2016-0643 - changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-30.html http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-29.html Bugs fixed: - don't delete the log data when migration fails - add 'log-error' and 'secure-file-priv' configuration options (added via configuration-tweaks.tar.bz2) [boo#963810] * add '/etc/my.cnf.d/error_log.conf' that specifies 'log-error = /var/log/mysql/mysqld.log'. If no path is set, the error log is written to '/var/lib/mysql/$HOSTNAME.err', which is not picked up by logrotate. * add '/etc/my.cnf.d/secure_file_priv.conf' which specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD FILE()' will only work with files in the directory specified by 'secure-file-priv' option (='/var/lib/mysql-files'). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-607=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-607=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysql56client18-5.6.30-16.2 libmysql56client18-debuginfo-5.6.30-16.2 libmysql56client_r18-5.6.30-16.2 mysql-community-server-5.6.30-16.2 mysql-community-server-bench-5.6.30-16.2 mysql-community-server-bench-debuginfo-5.6.30-16.2 mysql-community-server-client-5.6.30-16.2 mysql-community-server-client-debuginfo-5.6.30-16.2 mysql-community-server-debuginfo-5.6.30-16.2 mysql-community-server-debugsource-5.6.30-16.2 mysql-community-server-errormessages-5.6.30-16.2 mysql-community-server-test-5.6.30-16.2 mysql-community-server-test-debuginfo-5.6.30-16.2 mysql-community-server-tools-5.6.30-16.2 mysql-community-server-tools-debuginfo-5.6.30-16.2 - openSUSE Leap 42.1 (x86_64): libmysql56client18-32bit-5.6.30-16.2 libmysql56client18-debuginfo-32bit-5.6.30-16.2 libmysql56client_r18-32bit-5.6.30-16.2 - openSUSE 13.2 (i586 x86_64): libmysql56client18-5.6.30-2.20.2 libmysql56client18-debuginfo-5.6.30-2.20.2 libmysql56client_r18-5.6.30-2.20.2 mysql-community-server-5.6.30-2.20.2 mysql-community-server-bench-5.6.30-2.20.2 mysql-community-server-bench-debuginfo-5.6.30-2.20.2 mysql-community-server-client-5.6.30-2.20.2 mysql-community-server-client-debuginfo-5.6.30-2.20.2 mysql-community-server-debuginfo-5.6.30-2.20.2 mysql-community-server-debugsource-5.6.30-2.20.2 mysql-community-server-errormessages-5.6.30-2.20.2 mysql-community-server-test-5.6.30-2.20.2 mysql-community-server-test-debuginfo-5.6.30-2.20.2 mysql-community-server-tools-5.6.30-2.20.2 mysql-community-server-tools-debuginfo-5.6.30-2.20.2 - openSUSE 13.2 (x86_64): libmysql56client18-32bit-5.6.30-2.20.2 libmysql56client18-debuginfo-32bit-5.6.30-2.20.2 libmysql56client_r18-32bit-5.6.30-2.20.2 References: https://www.suse.com/security/cve/CVE-2015-3194.html https://www.suse.com/security/cve/CVE-2016-0639.html https://www.suse.com/security/cve/CVE-2016-0640.html https://www.suse.com/security/cve/CVE-2016-0641.html https://www.suse.com/security/cve/CVE-2016-0642.html https://www.suse.com/security/cve/CVE-2016-0643.html https://www.suse.com/security/cve/CVE-2016-0644.html https://www.suse.com/security/cve/CVE-2016-0646.html https://www.suse.com/security/cve/CVE-2016-0647.html https://www.suse.com/security/cve/CVE-2016-0648.html https://www.suse.com/security/cve/CVE-2016-0649.html https://www.suse.com/security/cve/CVE-2016-0650.html https://www.suse.com/security/cve/CVE-2016-0655.html https://www.suse.com/security/cve/CVE-2016-0661.html https://www.suse.com/security/cve/CVE-2016-0665.html https://www.suse.com/security/cve/CVE-2016-0666.html https://www.suse.com/security/cve/CVE-2016-0668.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-2047.html https://bugzilla.suse.com/959724 https://bugzilla.suse.com/962779 https://bugzilla.suse.com/963810

1 0

openSUSE-SU-2016:1331-1: moderate: Security update for go
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1331-1 Rating: moderate References: #960151 #974232 Cross-References: CVE-2015-8618 CVE-2016-3959 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This go update to version 1.6 fixes the following issues: Security issues fixed: - CVE-2016-3959: Infinite loop in several big integer routines (boo#974232) - CVE-2015-8618: Carry propagation in Int.Exp Montgomery code in math/big library (boo#960151) Bugs fixed: - Update to version 1.6: * On Linux on little-endian 64-bit PowerPC (linux/ppc64le), Go 1.6 now supports cgo with external linking and is roughly feature complete. * Vendoring support * HTTP2 transparent support * fix gc and gccgo incompatibility regarding embedded unexported struct types containing exported fields * Linux on 64-bit MIPS and Android on 32-bit x86 * enforced rules for sharing Go pointers with C * new mechanism for template reuse * performance improvements ... and more! see more in https://tip.golang.org/doc/go1.6 - Updated to version 1.5.2: This release includes bug fixes to the compiler, linker, and the mime/multipart, net, and runtime packages. https://golang.org/doc/devel/release.html#go1.5.minor - Updated to version 1.5.1: This release includes bug fixes to the go command, the compiler, assembler, and the fmt, net/textproto, net/http, and runtime packages. https://golang.org/doc/devel/release.html#go1.5.minor - Update to version 1.5: * see https://golang.org/doc/go1.5 - install shared stdlib on x86_64 - add go.gdbinit for debug friendly - Adapt to Leap * use gcc5-go than go1.4 is the proper requirement for Leap Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-606=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): go-1.6.1-14.1 go-debuginfo-1.6.1-14.1 go-debugsource-1.6.1-14.1 go-doc-1.6.1-14.1 References: https://www.suse.com/security/cve/CVE-2015-8618.html https://www.suse.com/security/cve/CVE-2016-3959.html https://bugzilla.suse.com/960151 https://bugzilla.suse.com/974232

1 0

openSUSE-SU-2016:1330-1: moderate: Security update for imlib2
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for imlib2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1330-1 Rating: moderate References: #963796 #963797 #963800 #973759 #973761 #974202 #974854 #975703 Cross-References: CVE-2011-5326 CVE-2014-9762 CVE-2014-9763 CVE-2014-9764 CVE-2014-9771 CVE-2016-3993 CVE-2016-3994 CVE-2016-4024 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This imlib2 update to version 1.4.9 fixes the following issues: Security issues fixed: - CVE-2011-5326: divide by 0 when drawing an ellipse of height 1 (boo#974202) - CVE-2014-9762: segmentation fault on images without colormap (boo#963796) - CVE-2014-9764: segmentation fault when opening specifically crafted input (boo#963797) - CVE-2014-9763: division-by-zero crashes when opening images (boo#963800) - CVE-2014-9771: exploitable integer overflow in _imlib_SaveImage (boo#974854) - CVE-2016-3994: imlib2/evas Potential DOS in giflib loader (boo#973759) - CVE-2016-3993: off by 1 Potential DOS (boo#973761) - CVE-2016-4024: integer overflow resulting in insufficient heap allocation (boo#975703) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-600=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): imlib2-1.4.9-17.4.1 imlib2-debuginfo-1.4.9-17.4.1 imlib2-debugsource-1.4.9-17.4.1 imlib2-devel-1.4.9-17.4.1 imlib2-filters-1.4.9-17.4.1 imlib2-filters-debuginfo-1.4.9-17.4.1 imlib2-loaders-1.4.9-17.4.1 imlib2-loaders-debuginfo-1.4.9-17.4.1 libImlib2-1-1.4.9-17.4.1 libImlib2-1-debuginfo-1.4.9-17.4.1 References: https://www.suse.com/security/cve/CVE-2011-5326.html https://www.suse.com/security/cve/CVE-2014-9762.html https://www.suse.com/security/cve/CVE-2014-9763.html https://www.suse.com/security/cve/CVE-2014-9764.html https://www.suse.com/security/cve/CVE-2014-9771.html https://www.suse.com/security/cve/CVE-2016-3993.html https://www.suse.com/security/cve/CVE-2016-3994.html https://www.suse.com/security/cve/CVE-2016-4024.html https://bugzilla.suse.com/963796 https://bugzilla.suse.com/963797 https://bugzilla.suse.com/963800 https://bugzilla.suse.com/973759 https://bugzilla.suse.com/973761 https://bugzilla.suse.com/974202 https://bugzilla.suse.com/974854 https://bugzilla.suse.com/975703

1 0

openSUSE-SU-2016:1329-1: important: Security update for ntp
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1329-1 Rating: important References: #957226 #977446 #977450 #977451 #977452 #977455 #977457 #977458 #977459 #977461 #977464 Cross-References: CVE-2015-7704 CVE-2015-7705 CVE-2015-7974 CVE-2016-1547 CVE-2016-1548 CVE-2016-1549 CVE-2016-1550 CVE-2016-1551 CVE-2016-2516 CVE-2016-2517 CVE-2016-2518 CVE-2016-2519 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for ntp to 4.2.8p7 fixes the following issues: * CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. * CVE-2016-1548, bsc#977461: Interleave-pivot * CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack. * CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks. * CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability * CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd. * CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated. * CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC. * CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked. * This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974 Bugs fixed: - Restrict the parser in the startup script to the first occurrance of "keys" and "controlkey" in ntp.conf (bsc#957226). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-599=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ntp-4.2.8p7-21.1 ntp-debuginfo-4.2.8p7-21.1 ntp-debugsource-4.2.8p7-21.1 ntp-doc-4.2.8p7-21.1 References: https://www.suse.com/security/cve/CVE-2015-7704.html https://www.suse.com/security/cve/CVE-2015-7705.html https://www.suse.com/security/cve/CVE-2015-7974.html https://www.suse.com/security/cve/CVE-2016-1547.html https://www.suse.com/security/cve/CVE-2016-1548.html https://www.suse.com/security/cve/CVE-2016-1549.html https://www.suse.com/security/cve/CVE-2016-1550.html https://www.suse.com/security/cve/CVE-2016-1551.html https://www.suse.com/security/cve/CVE-2016-2516.html https://www.suse.com/security/cve/CVE-2016-2517.html https://www.suse.com/security/cve/CVE-2016-2518.html https://www.suse.com/security/cve/CVE-2016-2519.html https://bugzilla.suse.com/957226 https://bugzilla.suse.com/977446 https://bugzilla.suse.com/977450 https://bugzilla.suse.com/977451 https://bugzilla.suse.com/977452 https://bugzilla.suse.com/977455 https://bugzilla.suse.com/977457 https://bugzilla.suse.com/977458 https://bugzilla.suse.com/977459 https://bugzilla.suse.com/977461 https://bugzilla.suse.com/977464

1 0

openSUSE-SU-2016:1328-1: moderate: Security update for cacti
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for cacti ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1328-1 Rating: moderate References: #971357 #974013 Cross-References: CVE-2016-3172 CVE-2016-3659 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for cacti fixes the following issues: Security issues fixed: - CVE-2016-3172: SQL injection in tree.php (boo#971357) - CVE-2016-3659: SQL injection in lib/functions.php (boo#974013) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-601=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-601=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): cacti-0.8.8f-11.1 - openSUSE 13.2 (noarch): cacti-0.8.8f-4.16.1 References: https://www.suse.com/security/cve/CVE-2016-3172.html https://www.suse.com/security/cve/CVE-2016-3659.html https://bugzilla.suse.com/971357 https://bugzilla.suse.com/974013

1 0

openSUSE-SU-2016:1327-1: moderate: Security update for libressl
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1327-1 Rating: moderate References: #950707 #950708 #957812 #957815 #977584 #978492 Cross-References: CVE-2015-3194 CVE-2015-3195 CVE-2015-5333 CVE-2015-5334 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This libressl update to version 2.2.7 fixes the following issues: Security issues fixed: - Fix multiple vulnerabilities in libcrypto relating to ASN.1 and encoding. [boo#978492, boo#977584] - CVE-2015-3194: Certificate verify crash with missing PSS parameter (boo#957815) - CVE-2015-3195: X509_ATTRIBUTE memory leak (boo#957812) - CVE-2015-5333: Memory Leak (boo#950707) - CVE-2015-5334: Buffer Overflow (boo#950708) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-604=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcrypto34-2.2.7-2.13.1 libcrypto34-debuginfo-2.2.7-2.13.1 libressl-2.2.7-2.13.1 libressl-debuginfo-2.2.7-2.13.1 libressl-debugsource-2.2.7-2.13.1 libressl-devel-2.2.7-2.13.1 libssl33-2.2.7-2.13.1 libssl33-debuginfo-2.2.7-2.13.1 libtls4-2.2.7-2.13.1 libtls4-debuginfo-2.2.7-2.13.1 - openSUSE 13.2 (x86_64): libcrypto34-32bit-2.2.7-2.13.1 libcrypto34-debuginfo-32bit-2.2.7-2.13.1 libressl-devel-32bit-2.2.7-2.13.1 libssl33-32bit-2.2.7-2.13.1 libssl33-debuginfo-32bit-2.2.7-2.13.1 libtls4-32bit-2.2.7-2.13.1 libtls4-debuginfo-32bit-2.2.7-2.13.1 - openSUSE 13.2 (noarch): libressl-devel-doc-2.2.7-2.13.1 References: https://www.suse.com/security/cve/CVE-2015-3194.html https://www.suse.com/security/cve/CVE-2015-3195.html https://www.suse.com/security/cve/CVE-2015-5333.html https://www.suse.com/security/cve/CVE-2015-5334.html https://bugzilla.suse.com/950707 https://bugzilla.suse.com/950708 https://bugzilla.suse.com/957812 https://bugzilla.suse.com/957815 https://bugzilla.suse.com/977584 https://bugzilla.suse.com/978492

1 0