May 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1313-1: moderate: Security update for quagga
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1313-1 Rating: moderate References: #977012 Cross-References: CVE-2016-4049 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following security issues: - CVE-2016-4049: Remote crash vulerability with specially crafted packages due to a buffer overflow error in bgp_dump_routes_func (boo#977012) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-591=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-591=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quagga-0.99.24.1-11.1 quagga-debuginfo-0.99.24.1-11.1 quagga-debugsource-0.99.24.1-11.1 quagga-devel-0.99.24.1-11.1 - openSUSE 13.2 (i586 x86_64): quagga-0.99.23-2.9.1 quagga-debuginfo-0.99.23-2.9.1 quagga-debugsource-0.99.23-2.9.1 quagga-devel-0.99.23-2.9.1 References: https://www.suse.com/security/cve/CVE-2016-4049.html https://bugzilla.suse.com/977012

1 0

openSUSE-SU-2016:1312-1: moderate: Security update for atheme
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for atheme ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1312-1 Rating: moderate References: #978170 Cross-References: CVE-2014-9773 CVE-2016-4478 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for atheme fixes the following issues: - CVE-2016-4478: Under certain circumstances, a remote attacker could cause denial of service due to a buffer overflow in the XMLRPC response encoding code (boo#978170) - CVE-2014-9773: Remote attacker could change Atheme's behavior by registering/dropping certain accounts/nicks (boo#978170) The version update to 7.2.6 also contains a number of upstream fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-590=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-590=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): atheme-7.2.6-5.1 atheme-debuginfo-7.2.6-5.1 atheme-debugsource-7.2.6-5.1 atheme-devel-7.2.6-5.1 libathemecore1-7.2.6-5.1 libathemecore1-debuginfo-7.2.6-5.1 - openSUSE 13.2 (i586 x86_64): atheme-7.2.6-2.3.1 atheme-debuginfo-7.2.6-2.3.1 atheme-debugsource-7.2.6-2.3.1 atheme-devel-7.2.6-2.3.1 libathemecore1-7.2.6-2.3.1 libathemecore1-debuginfo-7.2.6-2.3.1 References: https://www.suse.com/security/cve/CVE-2014-9773.html https://www.suse.com/security/cve/CVE-2016-4478.html https://bugzilla.suse.com/978170

1 0

openSUSE-SU-2016:1309-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1309-1 Rating: important References: #979422 Cross-References: CVE-2016-4117 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422): A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02) https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-587=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.621-162.1 flash-player-gnome-11.2.202.621-162.1 flash-player-kde4-11.2.202.621-162.1 References: https://www.suse.com/security/cve/CVE-2016-4117.html https://bugzilla.suse.com/979422

1 0

openSUSE-SU-2016:1308-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1308-1 Rating: important References: #979422 Cross-References: CVE-2016-4117 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422): A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02) https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-587=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.621-185.1 flash-player-gnome-11.2.202.621-185.1 flash-player-kde4-11.2.202.621-185.1 References: https://www.suse.com/security/cve/CVE-2016-4117.html https://bugzilla.suse.com/979422

1 0

openSUSE-RU-2016:1307-1: Recommended update for python3-requests
by maintenance＠opensuse.org 17 May '16

17 May '16

openSUSE Recommended Update: Recommended update for python3-requests ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1307-1 Rating: low References: #912903 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes an issue which prevented python3-requests to work with HTTPS. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-586=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): python3-requests-1.2.3-3.3.1 References: https://bugzilla.suse.com/912903

1 0

openSUSE-SU-2016:1306-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 May '16

17 May '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1306-1 Rating: important References: #979422 Cross-References: CVE-2016-1006 CVE-2016-1011 CVE-2016-1012 CVE-2016-1013 CVE-2016-1014 CVE-2016-1015 CVE-2016-1016 CVE-2016-1017 CVE-2016-1018 CVE-2016-1019 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1030 CVE-2016-1031 CVE-2016-1032 CVE-2016-1033 CVE-2016-4117 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422): A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02) https://helpx.adobe.com/security/products/flash-player/apsa16-02.html Some CVEs were not listed in the last submission: * APSA16-01, APSB16-10, CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-585=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.621-2.97.1 flash-player-gnome-11.2.202.621-2.97.1 flash-player-kde4-11.2.202.621-2.97.1 References: https://www.suse.com/security/cve/CVE-2016-1006.html https://www.suse.com/security/cve/CVE-2016-1011.html https://www.suse.com/security/cve/CVE-2016-1012.html https://www.suse.com/security/cve/CVE-2016-1013.html https://www.suse.com/security/cve/CVE-2016-1014.html https://www.suse.com/security/cve/CVE-2016-1015.html https://www.suse.com/security/cve/CVE-2016-1016.html https://www.suse.com/security/cve/CVE-2016-1017.html https://www.suse.com/security/cve/CVE-2016-1018.html https://www.suse.com/security/cve/CVE-2016-1019.html https://www.suse.com/security/cve/CVE-2016-1020.html https://www.suse.com/security/cve/CVE-2016-1021.html https://www.suse.com/security/cve/CVE-2016-1022.html https://www.suse.com/security/cve/CVE-2016-1023.html https://www.suse.com/security/cve/CVE-2016-1024.html https://www.suse.com/security/cve/CVE-2016-1025.html https://www.suse.com/security/cve/CVE-2016-1026.html https://www.suse.com/security/cve/CVE-2016-1027.html https://www.suse.com/security/cve/CVE-2016-1028.html https://www.suse.com/security/cve/CVE-2016-1029.html https://www.suse.com/security/cve/CVE-2016-1030.html https://www.suse.com/security/cve/CVE-2016-1031.html https://www.suse.com/security/cve/CVE-2016-1032.html https://www.suse.com/security/cve/CVE-2016-1033.html https://www.suse.com/security/cve/CVE-2016-4117.html https://bugzilla.suse.com/979422

1 0

openSUSE-SU-2016:1304-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 16 May '16

16 May '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1304-1 Rating: important References: #979859 Cross-References: CVE-2016-1667 CVE-2016-1668 CVE-2016-1669 CVE-2016-1670 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Chromium was updated to 50.0.2661.102 to fix four vulnerabilities (boo#979859): - CVE-2016-1667: Same origin bypass in DOM - CVE-2016-1668: Same origin bypass in Blink V8 bindings - CVE-2016-1669: Buffer overflow in V8 - CVE-2016-1670: Race condition in loader Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-584=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-584=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): chromedriver-50.0.2661.102-48.1 chromedriver-debuginfo-50.0.2661.102-48.1 chromium-50.0.2661.102-48.1 chromium-debuginfo-50.0.2661.102-48.1 chromium-debugsource-50.0.2661.102-48.1 chromium-desktop-gnome-50.0.2661.102-48.1 chromium-desktop-kde-50.0.2661.102-48.1 chromium-ffmpegsumo-50.0.2661.102-48.1 chromium-ffmpegsumo-debuginfo-50.0.2661.102-48.1 - openSUSE 13.2 (i586 x86_64): chromedriver-50.0.2661.102-100.1 chromedriver-debuginfo-50.0.2661.102-100.1 chromium-50.0.2661.102-100.1 chromium-debuginfo-50.0.2661.102-100.1 chromium-debugsource-50.0.2661.102-100.1 chromium-desktop-gnome-50.0.2661.102-100.1 chromium-desktop-kde-50.0.2661.102-100.1 chromium-ffmpegsumo-50.0.2661.102-100.1 chromium-ffmpegsumo-debuginfo-50.0.2661.102-100.1 References: https://www.suse.com/security/cve/CVE-2016-1667.html https://www.suse.com/security/cve/CVE-2016-1668.html https://www.suse.com/security/cve/CVE-2016-1669.html https://www.suse.com/security/cve/CVE-2016-1670.html https://bugzilla.suse.com/979859

1 0

openSUSE-SU-2016:1298-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 13 May '16

13 May '16

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1298-1 Rating: moderate References: #972335 #975947 Cross-References: CVE-2016-3627 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libxml2 fixes two security issues: - libxml2 limits the number of recursions an XML document can contain so to protect against the "Billion Laughs" denial-of-service attack. Unfortunately, the underlying counter was not incremented properly in all necessary locations. Therefore, specially crafted XML documents could exhaust all available stack space and crash the XML parser without running into the recursion limit. This vulnerability has been fixed. (bsc#975947) - When running in recovery mode, certain invalid XML documents would trigger an infinite recursion in libxml2 that ran until all stack space was exhausted. This vulnerability could have been used to facilitate a denial-of-sevice attack. (CVE-2016-3627, bsc#972335) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-583=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libxml2-2-2.9.1-16.1 libxml2-2-debuginfo-2.9.1-16.1 libxml2-debugsource-2.9.1-16.1 libxml2-devel-2.9.1-16.1 libxml2-tools-2.9.1-16.1 libxml2-tools-debuginfo-2.9.1-16.1 python-libxml2-2.9.1-16.1 python-libxml2-debuginfo-2.9.1-16.1 python-libxml2-debugsource-2.9.1-16.1 - openSUSE Leap 42.1 (noarch): libxml2-doc-2.9.1-16.1 - openSUSE Leap 42.1 (x86_64): libxml2-2-32bit-2.9.1-16.1 libxml2-2-debuginfo-32bit-2.9.1-16.1 libxml2-devel-32bit-2.9.1-16.1 References: https://www.suse.com/security/cve/CVE-2016-3627.html https://bugzilla.suse.com/972335 https://bugzilla.suse.com/975947

1 0

openSUSE-RU-2016:1297-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 13 May '16

13 May '16

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1297-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update to Opera 37.0.2178.32 fixes the following issues: - HiDPI: page scrollbar too narrow. - Pinch to zoom is not working. - Crash in web_modal::WebContentsModalDialogManager::ShowDialogWithManager with simplified printing option. - Download resumption not working after restart. - Tabs page view sticks permanently when “Adjust Speed Dial animations for slower hardware” is enabled. - Tablet mode layout and tablet mode fullscreen button not working. - Chromium is updated to version 49.0.2623.110. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2016-581=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1:NonFree (x86_64): opera-37.0.2178.32-13.1 References:

1 0

openSUSE-RU-2016:1296-1: moderate: Recommended update for Software Update Stack
by maintenance＠opensuse.org 13 May '16

13 May '16

openSUSE Recommended Update: Recommended update for Software Update Stack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1296-1 Rating: moderate References: #933760 #956480 #964932 #967006 #967828 #971018 #971637 #972768 #974275 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update for the Software Update Stack fixes the following issues: libsolv: - Simplify handling of pseudo package updates. (bsc#967006) - Improve speed of rpmmd metadata parsing. libzypp: - Fix credential file parser losing entries with known URL but different user name. (bsc#933760) - RepoManager: Allow extraction of multiple baseurls for service repositories. (bsc#964932) - Fix service metadata TTL default value. (bsc#967828) - DiskUsageCounter: Limit estimated waste per file. (bsc#974275) - Use PluginExecutor for commit- and system-hooks. (bnc#971637) - Set libsolv-devel >= 0.6.19 as BuildRequires. (bnc#971018) zypper: - Fix testing for '-- download*' options. (bsc#956480) - Update sle-zypper-po.tar.bz2. (bsc#972768) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-580=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libsolv-debugsource-0.6.20-9.1 libsolv-demo-0.6.20-9.1 libsolv-demo-debuginfo-0.6.20-9.1 libsolv-devel-0.6.20-9.1 libsolv-devel-debuginfo-0.6.20-9.1 libsolv-tools-0.6.20-9.1 libsolv-tools-debuginfo-0.6.20-9.1 libzypp-15.22.0-9.1 libzypp-debuginfo-15.22.0-9.1 libzypp-debugsource-15.22.0-9.1 libzypp-devel-15.22.0-9.1 libzypp-devel-doc-15.22.0-9.1 perl-solv-0.6.20-9.1 perl-solv-debuginfo-0.6.20-9.1 python-solv-0.6.20-9.1 python-solv-debuginfo-0.6.20-9.1 ruby-solv-0.6.20-9.1 ruby-solv-debuginfo-0.6.20-9.1 zypper-1.12.40-9.1 zypper-debuginfo-1.12.40-9.1 zypper-debugsource-1.12.40-9.1 - openSUSE Leap 42.1 (noarch): zypper-aptitude-1.12.40-9.1 zypper-log-1.12.40-9.1 References: https://bugzilla.suse.com/933760 https://bugzilla.suse.com/956480 https://bugzilla.suse.com/964932 https://bugzilla.suse.com/967006 https://bugzilla.suse.com/967828 https://bugzilla.suse.com/971018 https://bugzilla.suse.com/971637 https://bugzilla.suse.com/972768 https://bugzilla.suse.com/974275

1 0