June 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1566-1: important: Security update for nodejs
by opensuse-security＠opensuse.org 14 Jun '16

14 Jun '16

openSUSE Security Update: Security update for nodejs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1566-1 Rating: important References: #968047 #968048 #968050 #977614 #977616 Cross-References: CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-2105 CVE-2016-2107 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs to version 4.4.5 fixes the several issues. These security issues introduced by the bundled openssl were fixed by going to version 1.0.2h: - CVE-2016-2107: The AES-NI implementation in OpenSSL did not consider memory allocation during a certain padding check, which allowed remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session (bsc#977616). - CVE-2016-2105: Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL allowed remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data (bsc#977614). - CVE-2016-0705: Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL allowed remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key (bsc#968047). - CVE-2016-0797: Multiple integer overflows in OpenSSL allowed remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c (bsc#968048). - CVE-2016-0702: The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL did not properly consider cache-bank access times during modular exponentiation, which made it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack (bsc#968050). These non-security issues were fixed: - Fix faulty "if" condition (string cannot equal a boolean). - buffer: Buffer no longer errors if you call lastIndexOf with a search term longer than the buffer. - contextify: Context objects are now properly garbage collected, this solves a problem some individuals were experiencing with extreme memory growth. - Update npm to 2.15.5. - http: Invalid status codes can no longer be sent. Limited to 3 digit numbers between 100 - 999. - deps: Fix --gdbjit for embedders. Backported from v8 upstream. - querystring: Restore throw when attempting to stringify bad surrogate pair. - https: Under certain conditions SSL sockets may have been causing a memory leak when keepalive is enabled. This is no longer the case. - lib: The way that we were internally passing arguments was causing a potential leak. By copying the arguments into an array we can avoid this. - repl: Previously if you were using the repl in strict mode the column number would be wrong in a stack trace. This is no longer an issue. - deps: An update to v8 that introduces a new flag --perf_basic_prof_only_functions. - http: A new feature in http(s) agent that catches errors on keep alived connections. - src: Better support for big-endian systems. - tls: A new feature that allows you to pass common SSL options to tls.createSecurePair. - build: Support python path that includes spaces. - https: A potential fix for #3692 (HTTP/HTTPS client requests throwing EPROTO). - installer: More readable profiling information from isolate tick logs. - process: Add support for symbols in event emitters (symbols didn't exist when it was written). - querystring: querystring.parse() is now 13-22% faster! - streams: Performance improvements for moving small buffers that shows a 5% throughput gain. IoT projects have been seen to be as much as 10% faster with this change! Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-715=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-715=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nodejs-4.4.5-27.1 nodejs-debuginfo-4.4.5-27.1 nodejs-debugsource-4.4.5-27.1 nodejs-devel-4.4.5-27.1 npm-4.4.5-27.1 - openSUSE Leap 42.1 (noarch): nodejs-docs-4.4.5-27.1 - openSUSE 13.2 (i586 x86_64): nodejs-4.4.5-18.1 nodejs-debuginfo-4.4.5-18.1 nodejs-debugsource-4.4.5-18.1 nodejs-devel-4.4.5-18.1 - openSUSE 13.2 (noarch): nodejs-doc-4.4.5-18.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0705.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-2105.html https://www.suse.com/security/cve/CVE-2016-2107.html https://bugzilla.suse.com/968047 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968050 https://bugzilla.suse.com/977614 https://bugzilla.suse.com/977616

1 0

openSUSE-SU-2016:1558-1: moderate: Security update for proftpd
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for proftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1558-1 Rating: moderate References: #970890 Cross-References: CVE-2016-3125 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: proftpd was updated to fix one security issue. This security issue was fixed: - CVE-2016-3125: The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors. Aliased: (boo#970890). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-713=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): proftpd-1.3.5b-10.1 proftpd-debuginfo-1.3.5b-10.1 proftpd-debugsource-1.3.5b-10.1 proftpd-devel-1.3.5b-10.1 proftpd-doc-1.3.5b-10.1 proftpd-ldap-1.3.5b-10.1 proftpd-ldap-debuginfo-1.3.5b-10.1 proftpd-mysql-1.3.5b-10.1 proftpd-mysql-debuginfo-1.3.5b-10.1 proftpd-pgsql-1.3.5b-10.1 proftpd-pgsql-debuginfo-1.3.5b-10.1 proftpd-radius-1.3.5b-10.1 proftpd-radius-debuginfo-1.3.5b-10.1 proftpd-sqlite-1.3.5b-10.1 proftpd-sqlite-debuginfo-1.3.5b-10.1 - openSUSE 13.1 (noarch): proftpd-lang-1.3.5b-10.1 References: https://www.suse.com/security/cve/CVE-2016-3125.html https://bugzilla.suse.com/970890

1 0

openSUSE-SU-2016:1557-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1557-1 Rating: important References: #980384 #981695 #983549 #983632 #983638 #983639 #983640 #983643 #983644 #983646 #983649 #983651 #983652 #983653 #983655 Cross-References: CVE-2016-1950 CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2824 CVE-2016-2825 CVE-2016-2828 CVE-2016-2829 CVE-2016-2831 CVE-2016-2832 CVE-2016-2833 CVE-2016-2834 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has one errata is now available. Description: This update to Mozilla Firefox 47 fixes the following issues (boo#983549): Security fixes: - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards (boo#983638 MFSA 2016-49) - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (boo#983655 MFSA 2016-50) - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (boo#983653 MFSA 2016-51) - CVE-2016-2822: Addressbar spoofing though the SELECT element (boo#983652 MFSA 2016-52) - CVE-2016-2824: Out-of-bounds write with WebGL shader (boo#983651 MFSA 2016-53) - CVE-2016-2825: Partial same-origin-policy through setting location.host through data URI (boo#983649 MFSA 2016-54) - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (boo#983646 MFSA 2016-56) - CVE-2016-2829: Incorrect icon displayed on permissions notifications (boo#983644 MFSA 2016-57) - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (boo#983643 MFSA 2016-58) - CVE-2016-2832: Information disclosure of disabled plugins through CSS pseudo-classes (boo#983632 MFSA 2016-59) - CVE-2016-2833: Java applets bypass CSP protections (boo#983640 MFSA 2016-60) Mozilla NSS was updated to 3.23 to address the following vulnerabilities: - CVE-2016-2834: Memory safety bugs (boo#983639 MFSA-2016-61) The following non-security changes are included: - Enable VP9 video codec for users with fast machines - Embedded YouTube videos now play with HTML5 video if Flash is not installed - View and search open tabs from your smartphone or another computer in a sidebar - Allow no-cache on back/forward navigations for https resources The following packaging changes are included: - boo#981695: cleanup configure options, notably removing GStreamer support which is gone from FF - boo#980384: enable build with PIE and full relro on x86_64 The following new functionality is provided: - ChaCha20/Poly1305 cipher and TLS cipher suites now supported - The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-714=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-47.0-116.1 MozillaFirefox-branding-upstream-47.0-116.1 MozillaFirefox-buildsymbols-47.0-116.1 MozillaFirefox-debuginfo-47.0-116.1 MozillaFirefox-debugsource-47.0-116.1 MozillaFirefox-devel-47.0-116.1 MozillaFirefox-translations-common-47.0-116.1 MozillaFirefox-translations-other-47.0-116.1 libfreebl3-3.23-80.1 libfreebl3-debuginfo-3.23-80.1 libsoftokn3-3.23-80.1 libsoftokn3-debuginfo-3.23-80.1 mozilla-nss-3.23-80.1 mozilla-nss-certs-3.23-80.1 mozilla-nss-certs-debuginfo-3.23-80.1 mozilla-nss-debuginfo-3.23-80.1 mozilla-nss-debugsource-3.23-80.1 mozilla-nss-devel-3.23-80.1 mozilla-nss-sysinit-3.23-80.1 mozilla-nss-sysinit-debuginfo-3.23-80.1 mozilla-nss-tools-3.23-80.1 mozilla-nss-tools-debuginfo-3.23-80.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.23-80.1 libfreebl3-debuginfo-32bit-3.23-80.1 libsoftokn3-32bit-3.23-80.1 libsoftokn3-debuginfo-32bit-3.23-80.1 mozilla-nss-32bit-3.23-80.1 mozilla-nss-certs-32bit-3.23-80.1 mozilla-nss-certs-debuginfo-32bit-3.23-80.1 mozilla-nss-debuginfo-32bit-3.23-80.1 mozilla-nss-sysinit-32bit-3.23-80.1 mozilla-nss-sysinit-debuginfo-32bit-3.23-80.1 References: https://www.suse.com/security/cve/CVE-2016-1950.html https://www.suse.com/security/cve/CVE-2016-2815.html https://www.suse.com/security/cve/CVE-2016-2818.html https://www.suse.com/security/cve/CVE-2016-2819.html https://www.suse.com/security/cve/CVE-2016-2821.html https://www.suse.com/security/cve/CVE-2016-2822.html https://www.suse.com/security/cve/CVE-2016-2824.html https://www.suse.com/security/cve/CVE-2016-2825.html https://www.suse.com/security/cve/CVE-2016-2828.html https://www.suse.com/security/cve/CVE-2016-2829.html https://www.suse.com/security/cve/CVE-2016-2831.html https://www.suse.com/security/cve/CVE-2016-2832.html https://www.suse.com/security/cve/CVE-2016-2833.html https://www.suse.com/security/cve/CVE-2016-2834.html https://bugzilla.suse.com/980384 https://bugzilla.suse.com/981695 https://bugzilla.suse.com/983549 https://bugzilla.suse.com/983632 https://bugzilla.suse.com/983638 https://bugzilla.suse.com/983639 https://bugzilla.suse.com/983640 https://bugzilla.suse.com/983643 https://bugzilla.suse.com/983644 https://bugzilla.suse.com/983646 https://bugzilla.suse.com/983649 https://bugzilla.suse.com/983651 https://bugzilla.suse.com/983652 https://bugzilla.suse.com/983653 https://bugzilla.suse.com/983655

1 0

openSUSE-SU-2016:1556-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1556-1 Rating: moderate References: #982128 Cross-References: CVE-2016-5097 CVE-2016-5098 CVE-2016-5099 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This phpMyAdmin update to version 4.4.15.6 fixes the following issues: Security issues fixed: - PMASA-2016-16 (CVE-2016-5099, CWE-661): Self XSS, see https://www.phpmyadmin.net/security/PMASA-2016-16/ - PMASA-2016-15 (CVE-2016-5098, CWE-661): File Traversal Protection Bypass on Error Reporting, see https://www.phpmyadmin.net/security/PMASA-2016-15/ - PMASA-2016-14 (CVE-2016-5097, CWE-661): Sensitive Data in URL GET Query Parameters, see https://www.phpmyadmin.net/security/PMASA-2016-14/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-712=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): phpMyAdmin-4.4.15.6-57.1 References: https://www.suse.com/security/cve/CVE-2016-5097.html https://www.suse.com/security/cve/CVE-2016-5098.html https://www.suse.com/security/cve/CVE-2016-5099.html https://bugzilla.suse.com/982128

1 0

openSUSE-RU-2016:1555-1: Recommended update for openCryptoki
by maintenance＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Recommended Update: Recommended update for openCryptoki ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1555-1 Rating: low References: #963612 #982287 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openCryptoki fixes the following issues: - C_SignInit fails with CKR_MECHANISM_INVALID when CKM_DSA_SHA1 or CKM_ECDSA_SHA1 are used. (bsc#963612) - Wrapped "Requires: libica2-devel" in %ifarch for s390 and s390x. (bsc#982287) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-711=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): openCryptoki-3.2-7.1 openCryptoki-debuginfo-3.2-7.1 openCryptoki-debugsource-3.2-7.1 openCryptoki-devel-3.2-7.1 - openSUSE Leap 42.1 (x86_64): openCryptoki-64bit-3.2-7.1 openCryptoki-64bit-debuginfo-3.2-7.1 - openSUSE Leap 42.1 (i586): openCryptoki-32bit-3.2-7.1 openCryptoki-32bit-debuginfo-3.2-7.1 References: https://bugzilla.suse.com/963612 https://bugzilla.suse.com/982287

1 0

openSUSE-RU-2016:1554-1: Recommended update for xrdp
by maintenance＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Recommended Update: Recommended update for xrdp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1554-1 Rating: low References: #965647 #973130 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for xrdp enhances the startwm.sh script, allowing the administrator to easily configure which desktop session should be started on xrdp displays. Additionally, it fixes a logic error in the package's post installation script when checking if the rsakeys.ini file was correctly generated. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-708=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xrdp-0.6.1-3.1 xrdp-debuginfo-0.6.1-3.1 xrdp-debugsource-0.6.1-3.1 References: https://bugzilla.suse.com/965647 https://bugzilla.suse.com/973130

1 0

openSUSE-SU-2016:1553-1: important: Security update for php5
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1553-1 Rating: important References: #976775 #980366 #980373 #980375 #981049 #981050 #981061 #982009 #982010 #982011 #982012 #982013 #982162 Cross-References: CVE-2013-7456 CVE-2015-4116 CVE-2015-8873 CVE-2015-8874 CVE-2015-8876 CVE-2015-8877 CVE-2015-8879 CVE-2016-3074 CVE-2016-5093 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 CVE-2016-5114 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2013-7456: imagescale out-of-bounds read (bnc#982009). - CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010). - CVE-2016-5094: Don't create strings with lengths outside int range (bnc#982011). - CVE-2016-5095: Don't create strings with lengths outside int range (bnc#982012). - CVE-2016-5096: int/size_t confusion in fread (bsc#982013). - CVE-2016-5114: fpm_log.c memory leak and buffer overflow (bnc#982162). - CVE-2015-8877: The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd), as used in PHP, used inconsistent allocate and free approaches, which allowed remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function (bsc#981061). - CVE-2015-8876: Zend/zend_exceptions.c in PHP did not validate certain Exception objects, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data (bsc#981049). - CVE-2015-8879: The odbc_bindcols function in ext/odbc/php_odbc.c in PHP mishandled driver behavior for SQL_WVARCHAR columns, which allowed remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table Aliased: (bsc#981050). - CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP allowed remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation (bsc#980366). - CVE-2015-8874: Stack consumption vulnerability in GD in PHP allowed remote attackers to cause a denial of service via a crafted imagefilltoborder call (bsc#980375). - CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c in PHP allowed remote attackers to cause a denial of service (segmentation fault) via recursive method calls (bsc#980373). - CVE-2016-3074: Integer signedness error in GD Graphics Library (aka libgd or libgd2) allowed remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow (bsc#976775). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-703=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-66.1 apache2-mod_php5-debuginfo-5.6.1-66.1 php5-5.6.1-66.1 php5-bcmath-5.6.1-66.1 php5-bcmath-debuginfo-5.6.1-66.1 php5-bz2-5.6.1-66.1 php5-bz2-debuginfo-5.6.1-66.1 php5-calendar-5.6.1-66.1 php5-calendar-debuginfo-5.6.1-66.1 php5-ctype-5.6.1-66.1 php5-ctype-debuginfo-5.6.1-66.1 php5-curl-5.6.1-66.1 php5-curl-debuginfo-5.6.1-66.1 php5-dba-5.6.1-66.1 php5-dba-debuginfo-5.6.1-66.1 php5-debuginfo-5.6.1-66.1 php5-debugsource-5.6.1-66.1 php5-devel-5.6.1-66.1 php5-dom-5.6.1-66.1 php5-dom-debuginfo-5.6.1-66.1 php5-enchant-5.6.1-66.1 php5-enchant-debuginfo-5.6.1-66.1 php5-exif-5.6.1-66.1 php5-exif-debuginfo-5.6.1-66.1 php5-fastcgi-5.6.1-66.1 php5-fastcgi-debuginfo-5.6.1-66.1 php5-fileinfo-5.6.1-66.1 php5-fileinfo-debuginfo-5.6.1-66.1 php5-firebird-5.6.1-66.1 php5-firebird-debuginfo-5.6.1-66.1 php5-fpm-5.6.1-66.1 php5-fpm-debuginfo-5.6.1-66.1 php5-ftp-5.6.1-66.1 php5-ftp-debuginfo-5.6.1-66.1 php5-gd-5.6.1-66.1 php5-gd-debuginfo-5.6.1-66.1 php5-gettext-5.6.1-66.1 php5-gettext-debuginfo-5.6.1-66.1 php5-gmp-5.6.1-66.1 php5-gmp-debuginfo-5.6.1-66.1 php5-iconv-5.6.1-66.1 php5-iconv-debuginfo-5.6.1-66.1 php5-imap-5.6.1-66.1 php5-imap-debuginfo-5.6.1-66.1 php5-intl-5.6.1-66.1 php5-intl-debuginfo-5.6.1-66.1 php5-json-5.6.1-66.1 php5-json-debuginfo-5.6.1-66.1 php5-ldap-5.6.1-66.1 php5-ldap-debuginfo-5.6.1-66.1 php5-mbstring-5.6.1-66.1 php5-mbstring-debuginfo-5.6.1-66.1 php5-mcrypt-5.6.1-66.1 php5-mcrypt-debuginfo-5.6.1-66.1 php5-mssql-5.6.1-66.1 php5-mssql-debuginfo-5.6.1-66.1 php5-mysql-5.6.1-66.1 php5-mysql-debuginfo-5.6.1-66.1 php5-odbc-5.6.1-66.1 php5-odbc-debuginfo-5.6.1-66.1 php5-opcache-5.6.1-66.1 php5-opcache-debuginfo-5.6.1-66.1 php5-openssl-5.6.1-66.1 php5-openssl-debuginfo-5.6.1-66.1 php5-pcntl-5.6.1-66.1 php5-pcntl-debuginfo-5.6.1-66.1 php5-pdo-5.6.1-66.1 php5-pdo-debuginfo-5.6.1-66.1 php5-pgsql-5.6.1-66.1 php5-pgsql-debuginfo-5.6.1-66.1 php5-phar-5.6.1-66.1 php5-phar-debuginfo-5.6.1-66.1 php5-posix-5.6.1-66.1 php5-posix-debuginfo-5.6.1-66.1 php5-pspell-5.6.1-66.1 php5-pspell-debuginfo-5.6.1-66.1 php5-readline-5.6.1-66.1 php5-readline-debuginfo-5.6.1-66.1 php5-shmop-5.6.1-66.1 php5-shmop-debuginfo-5.6.1-66.1 php5-snmp-5.6.1-66.1 php5-snmp-debuginfo-5.6.1-66.1 php5-soap-5.6.1-66.1 php5-soap-debuginfo-5.6.1-66.1 php5-sockets-5.6.1-66.1 php5-sockets-debuginfo-5.6.1-66.1 php5-sqlite-5.6.1-66.1 php5-sqlite-debuginfo-5.6.1-66.1 php5-suhosin-5.6.1-66.1 php5-suhosin-debuginfo-5.6.1-66.1 php5-sysvmsg-5.6.1-66.1 php5-sysvmsg-debuginfo-5.6.1-66.1 php5-sysvsem-5.6.1-66.1 php5-sysvsem-debuginfo-5.6.1-66.1 php5-sysvshm-5.6.1-66.1 php5-sysvshm-debuginfo-5.6.1-66.1 php5-tidy-5.6.1-66.1 php5-tidy-debuginfo-5.6.1-66.1 php5-tokenizer-5.6.1-66.1 php5-tokenizer-debuginfo-5.6.1-66.1 php5-wddx-5.6.1-66.1 php5-wddx-debuginfo-5.6.1-66.1 php5-xmlreader-5.6.1-66.1 php5-xmlreader-debuginfo-5.6.1-66.1 php5-xmlrpc-5.6.1-66.1 php5-xmlrpc-debuginfo-5.6.1-66.1 php5-xmlwriter-5.6.1-66.1 php5-xmlwriter-debuginfo-5.6.1-66.1 php5-xsl-5.6.1-66.1 php5-xsl-debuginfo-5.6.1-66.1 php5-zip-5.6.1-66.1 php5-zip-debuginfo-5.6.1-66.1 php5-zlib-5.6.1-66.1 php5-zlib-debuginfo-5.6.1-66.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-66.1 References: https://www.suse.com/security/cve/CVE-2013-7456.html https://www.suse.com/security/cve/CVE-2015-4116.html https://www.suse.com/security/cve/CVE-2015-8873.html https://www.suse.com/security/cve/CVE-2015-8874.html https://www.suse.com/security/cve/CVE-2015-8876.html https://www.suse.com/security/cve/CVE-2015-8877.html https://www.suse.com/security/cve/CVE-2015-8879.html https://www.suse.com/security/cve/CVE-2016-3074.html https://www.suse.com/security/cve/CVE-2016-5093.html https://www.suse.com/security/cve/CVE-2016-5094.html https://www.suse.com/security/cve/CVE-2016-5095.html https://www.suse.com/security/cve/CVE-2016-5096.html https://www.suse.com/security/cve/CVE-2016-5114.html https://bugzilla.suse.com/976775 https://bugzilla.suse.com/980366 https://bugzilla.suse.com/980373 https://bugzilla.suse.com/980375 https://bugzilla.suse.com/981049 https://bugzilla.suse.com/981050 https://bugzilla.suse.com/981061 https://bugzilla.suse.com/982009 https://bugzilla.suse.com/982010 https://bugzilla.suse.com/982011 https://bugzilla.suse.com/982012 https://bugzilla.suse.com/982013 https://bugzilla.suse.com/982162

1 0

openSUSE-SU-2016:1552-1: important: Security update for MozillaFirefox, mozilla-nss
by opensuse-security＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1552-1 Rating: important References: #980384 #981695 #983549 #983632 #983638 #983639 #983640 #983643 #983644 #983646 #983649 #983651 #983652 #983653 #983655 Cross-References: CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2824 CVE-2016-2825 CVE-2016-2828 CVE-2016-2829 CVE-2016-2831 CVE-2016-2832 CVE-2016-2833 CVE-2016-2834 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has two fixes is now available. Description: This update to Mozilla Firefox 47 fixes the following issues (boo#983549): Security fixes: - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards (boo#983638 MFSA 2016-49) - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (boo#983655 MFSA 2016-50) - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (boo#983653 MFSA 2016-51) - CVE-2016-2822: Addressbar spoofing though the SELECT element (boo#983652 MFSA 2016-52) - CVE-2016-2824: Out-of-bounds write with WebGL shader (boo#983651 MFSA 2016-53) - CVE-2016-2825: Partial same-origin-policy through setting location.host through data URI (boo#983649 MFSA 2016-54) - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (boo#983646 MFSA 2016-56) - CVE-2016-2829: Incorrect icon displayed on permissions notifications (boo#983644 MFSA 2016-57) - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (boo#983643 MFSA 2016-58) - CVE-2016-2832: Information disclosure of disabled plugins through CSS pseudo-classes (boo#983632 MFSA 2016-59) - CVE-2016-2833: Java applets bypass CSP protections (boo#983640 MFSA 2016-60) Mozilla NSS was updated to 3.23 to address the following vulnerabilities: - CVE-2016-2834: Memory safety bugs (boo#983639 MFSA-2016-61) The following non-security changes are included: - Enable VP9 video codec for users with fast machines - Embedded YouTube videos now play with HTML5 video if Flash is not installed - View and search open tabs from your smartphone or another computer in a sidebar - Allow no-cache on back/forward navigations for https resources The following packaging changes are included: - boo#981695: cleanup configure options, notably removing GStreamer support which is gone from FF - boo#980384: enable build with PIE and full relro on x86_64 The following new functionality is provided: - ChaCha20/Poly1305 cipher and TLS cipher suites now supported - The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-704=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-704=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-47.0-24.1 MozillaFirefox-branding-upstream-47.0-24.1 MozillaFirefox-buildsymbols-47.0-24.1 MozillaFirefox-debuginfo-47.0-24.1 MozillaFirefox-debugsource-47.0-24.1 MozillaFirefox-devel-47.0-24.1 MozillaFirefox-translations-common-47.0-24.1 MozillaFirefox-translations-other-47.0-24.1 libfreebl3-3.23-18.1 libfreebl3-debuginfo-3.23-18.1 libsoftokn3-3.23-18.1 libsoftokn3-debuginfo-3.23-18.1 mozilla-nss-3.23-18.1 mozilla-nss-certs-3.23-18.1 mozilla-nss-certs-debuginfo-3.23-18.1 mozilla-nss-debuginfo-3.23-18.1 mozilla-nss-debugsource-3.23-18.1 mozilla-nss-devel-3.23-18.1 mozilla-nss-sysinit-3.23-18.1 mozilla-nss-sysinit-debuginfo-3.23-18.1 mozilla-nss-tools-3.23-18.1 mozilla-nss-tools-debuginfo-3.23-18.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.23-18.1 libfreebl3-debuginfo-32bit-3.23-18.1 libsoftokn3-32bit-3.23-18.1 libsoftokn3-debuginfo-32bit-3.23-18.1 mozilla-nss-32bit-3.23-18.1 mozilla-nss-certs-32bit-3.23-18.1 mozilla-nss-certs-debuginfo-32bit-3.23-18.1 mozilla-nss-debuginfo-32bit-3.23-18.1 mozilla-nss-sysinit-32bit-3.23-18.1 mozilla-nss-sysinit-debuginfo-32bit-3.23-18.1 - openSUSE 13.2 (i586 x86_64): MozillaFirefox-47.0-71.1 MozillaFirefox-branding-upstream-47.0-71.1 MozillaFirefox-buildsymbols-47.0-71.1 MozillaFirefox-debuginfo-47.0-71.1 MozillaFirefox-debugsource-47.0-71.1 MozillaFirefox-devel-47.0-71.1 MozillaFirefox-translations-common-47.0-71.1 MozillaFirefox-translations-other-47.0-71.1 libfreebl3-3.23-34.1 libfreebl3-debuginfo-3.23-34.1 libsoftokn3-3.23-34.1 libsoftokn3-debuginfo-3.23-34.1 mozilla-nss-3.23-34.1 mozilla-nss-certs-3.23-34.1 mozilla-nss-certs-debuginfo-3.23-34.1 mozilla-nss-debuginfo-3.23-34.1 mozilla-nss-debugsource-3.23-34.1 mozilla-nss-devel-3.23-34.1 mozilla-nss-sysinit-3.23-34.1 mozilla-nss-sysinit-debuginfo-3.23-34.1 mozilla-nss-tools-3.23-34.1 mozilla-nss-tools-debuginfo-3.23-34.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.23-34.1 libfreebl3-debuginfo-32bit-3.23-34.1 libsoftokn3-32bit-3.23-34.1 libsoftokn3-debuginfo-32bit-3.23-34.1 mozilla-nss-32bit-3.23-34.1 mozilla-nss-certs-32bit-3.23-34.1 mozilla-nss-certs-debuginfo-32bit-3.23-34.1 mozilla-nss-debuginfo-32bit-3.23-34.1 mozilla-nss-sysinit-32bit-3.23-34.1 mozilla-nss-sysinit-debuginfo-32bit-3.23-34.1 References: https://www.suse.com/security/cve/CVE-2016-2815.html https://www.suse.com/security/cve/CVE-2016-2818.html https://www.suse.com/security/cve/CVE-2016-2819.html https://www.suse.com/security/cve/CVE-2016-2821.html https://www.suse.com/security/cve/CVE-2016-2822.html https://www.suse.com/security/cve/CVE-2016-2824.html https://www.suse.com/security/cve/CVE-2016-2825.html https://www.suse.com/security/cve/CVE-2016-2828.html https://www.suse.com/security/cve/CVE-2016-2829.html https://www.suse.com/security/cve/CVE-2016-2831.html https://www.suse.com/security/cve/CVE-2016-2832.html https://www.suse.com/security/cve/CVE-2016-2833.html https://www.suse.com/security/cve/CVE-2016-2834.html https://bugzilla.suse.com/980384 https://bugzilla.suse.com/981695 https://bugzilla.suse.com/983549 https://bugzilla.suse.com/983632 https://bugzilla.suse.com/983638 https://bugzilla.suse.com/983639 https://bugzilla.suse.com/983640 https://bugzilla.suse.com/983643 https://bugzilla.suse.com/983644 https://bugzilla.suse.com/983646 https://bugzilla.suse.com/983649 https://bugzilla.suse.com/983651 https://bugzilla.suse.com/983652 https://bugzilla.suse.com/983653 https://bugzilla.suse.com/983655

1 0

openSUSE-RU-2016:1551-1: Recommended update for spec-cleaner
by maintenance＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1551-1 Rating: low References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for spec-cleaner contains updates and fixes to the openSUSE standard spec file formatting and usage. The following changes are included: * Fix one more virtualenv issue * Fix one case of broken requires splitting * Properly initialize unbracketing in regexps * Fix one more case of double pkg-config dependency * Various install fixes for pypi * Few small fixes for copyiright parsing * Add ghc_ macros to known exclude for bracketing * Fix for pkgconfig adding in preamble section * set suffix for manpages/infopages * remove suse_update_config * remove more authors blobs * redo options passing to be more readable * few bracketing excludes updates * Fix the no-header option to do what everyone would expect * Add switch to disable copyright generating * Tweak pkgconfig addition to work on all distros not just openSUSE Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-705=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-705=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): spec-cleaner-0.8.9-17.1 spec-cleaner-format_spec_file-0.8.9-17.1 - openSUSE 13.2 (noarch): spec-cleaner-0.8.9-39.1 spec-cleaner-format_spec_file-0.8.9-39.1 References:

1 0

openSUSE-RU-2016:1550-1: moderate: Recommended update for irqbalance
by maintenance＠opensuse.org 11 Jun '16

11 Jun '16

openSUSE Recommended Update: Recommended update for irqbalance ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1550-1 Rating: moderate References: #949276 #968711 #968870 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for irqbalance fixes the following issues: - Fix banned IRQ balance list. (bsc#968711) - Remove unused sysconfig variable IRQBALANCE_BANNED_INTERRUPTS. (bsc#968870) - Balance correctly IRQs reappearing. (bsc#949276) - Classify PCI Sub-Class for better performance. (bsc#949276) - Follow latest PCI class code spec. (bsc#949276) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-706=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): irqbalance-1.0.7-6.1 irqbalance-debuginfo-1.0.7-6.1 irqbalance-debugsource-1.0.7-6.1 References: https://bugzilla.suse.com/949276 https://bugzilla.suse.com/968711 https://bugzilla.suse.com/968870

1 0