May 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1326-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 18 May '16

18 May '16

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1326-1 Rating: important References: #978061 Cross-References: CVE-2016-3714 CVE-2016-3715 CVE-2016-3717 CVE-2016-3718 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - Multiple security issues in GraphicsMagick/ImageMagick [boo#978061] (CVE-2016-3714, CVE-2016-3718, CVE-2016-3715, CVE-2016-3717) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-602=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-602=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): GraphicsMagick-1.3.21-5.1 GraphicsMagick-debuginfo-1.3.21-5.1 GraphicsMagick-debugsource-1.3.21-5.1 GraphicsMagick-devel-1.3.21-5.1 libGraphicsMagick++-Q16-11-1.3.21-5.1 libGraphicsMagick++-Q16-11-debuginfo-1.3.21-5.1 libGraphicsMagick++-devel-1.3.21-5.1 libGraphicsMagick-Q16-3-1.3.21-5.1 libGraphicsMagick-Q16-3-debuginfo-1.3.21-5.1 libGraphicsMagick3-config-1.3.21-5.1 libGraphicsMagickWand-Q16-2-1.3.21-5.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.21-5.1 perl-GraphicsMagick-1.3.21-5.1 perl-GraphicsMagick-debuginfo-1.3.21-5.1 - openSUSE 13.2 (i586 x86_64): GraphicsMagick-1.3.20-3.1 GraphicsMagick-debuginfo-1.3.20-3.1 GraphicsMagick-debugsource-1.3.20-3.1 GraphicsMagick-devel-1.3.20-3.1 libGraphicsMagick++-Q16-3-1.3.20-3.1 libGraphicsMagick++-Q16-3-debuginfo-1.3.20-3.1 libGraphicsMagick++-devel-1.3.20-3.1 libGraphicsMagick-Q16-3-1.3.20-3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.20-3.1 libGraphicsMagick3-config-1.3.20-3.1 libGraphicsMagickWand-Q16-2-1.3.20-3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.20-3.1 perl-GraphicsMagick-1.3.20-3.1 perl-GraphicsMagick-debuginfo-1.3.20-3.1 References: https://www.suse.com/security/cve/CVE-2016-3714.html https://www.suse.com/security/cve/CVE-2016-3715.html https://www.suse.com/security/cve/CVE-2016-3717.html https://www.suse.com/security/cve/CVE-2016-3718.html https://bugzilla.suse.com/978061

1 0

openSUSE-RU-2016:1325-1: moderate: Recommended update for tigervnc
by maintenance＠opensuse.org 17 May '16

17 May '16

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1325-1 Rating: moderate References: #977019 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tigervnc fixes the following issues: - Added missing dependency on xauth and xorg-x11-fonts-core. (boo#977019) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-597=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-597=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): tigervnc-1.5.0-21.1 tigervnc-debuginfo-1.5.0-21.1 tigervnc-debugsource-1.5.0-21.1 xorg-x11-Xvnc-1.5.0-21.1 xorg-x11-Xvnc-debuginfo-1.5.0-21.1 - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.51.1 tigervnc-debuginfo-1.4.1-6.51.1 tigervnc-debugsource-1.4.1-6.51.1 xorg-x11-Xvnc-1.4.1-6.51.1 xorg-x11-Xvnc-debuginfo-1.4.1-6.51.1 References: https://bugzilla.suse.com/977019

1 0

openSUSE-RU-2016:1324-1: moderate: Recommended update for python3-requests
by maintenance＠opensuse.org 17 May '16

17 May '16

openSUSE Recommended Update: Recommended update for python3-requests ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1324-1 Rating: moderate References: #912903 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for python3-requests fixes the following issue: - Make https requests use verification based on openSUSE's default CA bundle. This didn't work at all before. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-596=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python3-requests-2.4.1-3.1 References: https://bugzilla.suse.com/912903

1 0

openSUSE-RU-2016:1323-1: Recommended update for pciutils-ids
by maintenance＠opensuse.org 17 May '16

17 May '16

openSUSE Recommended Update: Recommended update for pciutils-ids ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1323-1 Rating: low References: #958712 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The system's PCI IDs database has been updated to version 2016.04.04. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-592=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): pciutils-ids-2016.04.04-3.1 References: https://bugzilla.suse.com/958712

1 0

openSUSE-SU-2016:1322-1: moderate: Security update for poppler
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for poppler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1322-1 Rating: moderate References: #976844 Cross-References: CVE-2015-8868 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for poppler fixes the following issues: Security issues fixed: - CVE-2015-8868: Corrupted PDF file can corrupt heap, causing DoS (boo#976844) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-595=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpoppler-cpp0-0.26.5-6.1 libpoppler-cpp0-debuginfo-0.26.5-6.1 libpoppler-devel-0.26.5-6.1 libpoppler-glib-devel-0.26.5-6.1 libpoppler-glib8-0.26.5-6.1 libpoppler-glib8-debuginfo-0.26.5-6.1 libpoppler-qt4-4-0.26.5-6.1 libpoppler-qt4-4-debuginfo-0.26.5-6.1 libpoppler-qt4-devel-0.26.5-6.1 libpoppler-qt5-1-0.26.5-6.1 libpoppler-qt5-1-debuginfo-0.26.5-6.1 libpoppler-qt5-devel-0.26.5-6.1 libpoppler46-0.26.5-6.1 libpoppler46-debuginfo-0.26.5-6.1 poppler-debugsource-0.26.5-6.1 poppler-qt-debugsource-0.26.5-6.1 poppler-qt5-debugsource-0.26.5-6.1 poppler-tools-0.26.5-6.1 poppler-tools-debuginfo-0.26.5-6.1 typelib-1_0-Poppler-0_18-0.26.5-6.1 - openSUSE 13.2 (x86_64): libpoppler-cpp0-32bit-0.26.5-6.1 libpoppler-cpp0-debuginfo-32bit-0.26.5-6.1 libpoppler-glib8-32bit-0.26.5-6.1 libpoppler-glib8-debuginfo-32bit-0.26.5-6.1 libpoppler-qt4-4-32bit-0.26.5-6.1 libpoppler-qt4-4-debuginfo-32bit-0.26.5-6.1 libpoppler-qt5-1-32bit-0.26.5-6.1 libpoppler-qt5-1-debuginfo-32bit-0.26.5-6.1 libpoppler46-32bit-0.26.5-6.1 libpoppler46-debuginfo-32bit-0.26.5-6.1 References: https://www.suse.com/security/cve/CVE-2015-8868.html https://bugzilla.suse.com/976844

1 0

openSUSE-RU-2016:1321-1: moderate: Recommended update for curl
by maintenance＠opensuse.org 17 May '16

17 May '16

openSUSE Recommended Update: Recommended update for curl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1321-1 Rating: moderate References: #915846 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for curl fixes the following issues: - Fixes "Network is unreachable" errors in valid situations when ipv6 is not available but ipv4 is working fine. This also fixes the same error from happening in applications using libcurl4 (like zypper). (boo#915846) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-594=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): curl-7.42.1-22.1 curl-debuginfo-7.42.1-22.1 curl-debugsource-7.42.1-22.1 libcurl-devel-7.42.1-22.1 libcurl4-7.42.1-22.1 libcurl4-debuginfo-7.42.1-22.1 - openSUSE 13.2 (x86_64): libcurl-devel-32bit-7.42.1-22.1 libcurl4-32bit-7.42.1-22.1 libcurl4-debuginfo-32bit-7.42.1-22.1 References: https://bugzilla.suse.com/915846

1 0

openSUSE-RU-2016:1320-1: moderate: Recommended update for lightdm, xdm
by maintenance＠opensuse.org 17 May '16

17 May '16

openSUSE Recommended Update: Recommended update for lightdm, xdm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1320-1 Rating: moderate References: #978262 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lightdm, xdm fixes the following issues: Changes in xdm: - boo#978262: Make SUSEconfig handler for DISPLAYMANAGER_XSERVER_TCP_PORT_6000_OPEN robust against changes to the default setting of -listen/-nolisten tcp Changes in lightdm: - boo#978262: Handle new type of -liste/-nolisten tcp Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-593=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): liblightdm-gobject-1-0-1.15.0-6.1 liblightdm-gobject-1-0-debuginfo-1.15.0-6.1 liblightdm-qt-3-0-1.15.0-6.1 liblightdm-qt-3-0-debuginfo-1.15.0-6.1 liblightdm-qt5-3-0-1.15.0-6.1 liblightdm-qt5-3-0-debuginfo-1.15.0-6.1 lightdm-1.15.0-6.1 lightdm-debuginfo-1.15.0-6.1 lightdm-debugsource-1.15.0-6.1 lightdm-gobject-devel-1.15.0-6.1 lightdm-qt-devel-1.15.0-6.1 lightdm-qt5-devel-1.15.0-6.1 typelib-1_0-LightDM-1-1.15.0-6.1 xdm-1.1.11-10.1 xdm-debuginfo-1.1.11-10.1 xdm-debugsource-1.1.11-10.1 - openSUSE Leap 42.1 (noarch): lightdm-lang-1.15.0-6.1 References: https://bugzilla.suse.com/978262

1 0

openSUSE-SU-2016:1319-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1319-1 Rating: important References: #979859 Cross-References: CVE-2016-1667 CVE-2016-1668 CVE-2016-1669 CVE-2016-1670 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Chromium was updated to 50.0.2661.102 to fix four vulnerabilities (boo#979859): - CVE-2016-1667: Same origin bypass in DOM - CVE-2016-1668: Same origin bypass in Blink V8 bindings - CVE-2016-1669: Buffer overflow in V8 - CVE-2016-1670: Race condition in loader Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-598=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-50.0.2661.102-75.1 chromium-50.0.2661.102-75.1 chromium-desktop-gnome-50.0.2661.102-75.1 chromium-desktop-kde-50.0.2661.102-75.1 chromium-ffmpegsumo-50.0.2661.102-75.1 References: https://www.suse.com/security/cve/CVE-2016-1667.html https://www.suse.com/security/cve/CVE-2016-1668.html https://www.suse.com/security/cve/CVE-2016-1669.html https://www.suse.com/security/cve/CVE-2016-1670.html https://bugzilla.suse.com/979859

1 0

openSUSE-SU-2016:1316-1: moderate: Security update for varnish
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for varnish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1316-1 Rating: moderate References: #976097 Cross-References: CVE-2015-8852 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This varnish update to version 3.0.7 fixes the following issues: Security issues fixed: - CVE-2015-8852: Vulnerable to HTTP Smuggling issues: Double Content Length and bad EOL. (boo#976097) Bugs fixed: - Stop recognizing a single CR (\r) as a HTTP line separator. - Improved error detection on master-child process communication, leading to faster recovery (child restart) if communication loses sync. - Fix a corner-case where Content-Length was wrong for HTTP 1.0 clients, when using gzip and streaming. - More robust handling of hop-by-hop headers. - Avoid memory leak when adding bans. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-588=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libvarnishapi1-3.0.7-2.3.1 libvarnishapi1-debuginfo-3.0.7-2.3.1 varnish-3.0.7-2.3.1 varnish-debuginfo-3.0.7-2.3.1 varnish-debugsource-3.0.7-2.3.1 varnish-devel-3.0.7-2.3.1 References: https://www.suse.com/security/cve/CVE-2015-8852.html https://bugzilla.suse.com/976097

1 0

openSUSE-SU-2016:1314-1: moderate: Security update for quassel
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for quassel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1314-1 Rating: moderate References: #978002 Cross-References: CVE-2016-4414 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quassel fixes the following issues: - CVE-2016-4414: Denial of service vulnerability by unauthenticated clients (boo#978002) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-589=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-589=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quassel-base-0.12.2-10.1 quassel-client-0.12.2-10.1 quassel-client-debuginfo-0.12.2-10.1 quassel-core-0.12.2-10.1 quassel-core-debuginfo-0.12.2-10.1 quassel-debugsource-0.12.2-10.1 quassel-mono-0.12.2-10.1 quassel-mono-debuginfo-0.12.2-10.1 - openSUSE 13.2 (i586 x86_64): quassel-base-0.10.0-3.16.1 quassel-client-0.10.0-3.16.1 quassel-client-debuginfo-0.10.0-3.16.1 quassel-core-0.10.0-3.16.1 quassel-core-debuginfo-0.10.0-3.16.1 quassel-debugsource-0.10.0-3.16.1 quassel-mono-0.10.0-3.16.1 quassel-mono-debuginfo-0.10.0-3.16.1 References: https://www.suse.com/security/cve/CVE-2016-4414.html https://bugzilla.suse.com/978002

1 0