June 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:1719-1: Recommended update for lyx
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for lyx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1719-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for lyx fixes the following issues: - Update to 2.1.5: + Ability to read and write 2.2.x files. + For details, please refer to http://www.lyx.org/announce/2_1_4.txt Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-817=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): lyx-2.1.5-6.2 lyx-debuginfo-2.1.5-6.2 lyx-debugsource-2.1.5-6.2 References:

1 0

openSUSE-RU-2016:1718-1: moderate: Recommended update for tclcurl
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for tclcurl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1718-1 Rating: moderate References: #907545 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tclcurl fixes the following issues: - Fix segfaults in the multi interface, caused by passing incompatible pointers. (boo#907545) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-813=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-813=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): tclcurl-7.22.0-12.1 tclcurl-debuginfo-7.22.0-12.1 tclcurl-debugsource-7.22.0-12.1 - openSUSE 13.2 (i586 x86_64): tclcurl-7.22.0-6.4.1 tclcurl-debuginfo-7.22.0-6.4.1 tclcurl-debugsource-7.22.0-6.4.1 References: https://bugzilla.suse.com/907545

1 0

openSUSE-RU-2016:1717-1: moderate: Recommended update for criu
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for criu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1717-1 Rating: moderate References: #986036 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for criu fixes the following issues: - Add missing dependency to python-protobuf. (boo#986036) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-816=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): criu-1.7-4.1 criu-debuginfo-1.7-4.1 criu-debugsource-1.7-4.1 criu-devel-1.7-4.1 libcriu1-1.7-4.1 libcriu1-debuginfo-1.7-4.1 References: https://bugzilla.suse.com/986036

1 0

openSUSE-RU-2016:1716-1: moderate: Recommended update for yast2-dns-server
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for yast2-dns-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1716-1 Rating: moderate References: #976286 #976643 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-dns-server fixes the following issues: - Keep non-ACL items in allow-transfer AKA Enable Zone Transport. (bsc#976643) - Fix parsing 'keyword{value;};' (no spaces) in named.conf. (bsc#976643) - Fix handling of trailing spaces in named.conf. (bsc#976643) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-818=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): yast2-dns-server-3.1.17.1-3.2 References: https://bugzilla.suse.com/976286 https://bugzilla.suse.com/976643

1 0

openSUSE-RU-2016:1715-1: moderate: Recommended update for bind
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1715-1 Rating: moderate References: #908850 #977657 #983505 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: The BIND DNS server was updated to version 9.9.9-P1, which brings fixes and enhancements. One new feature has been implemented: - Add quotas to be used in recursive resolvers that are under high query load for names in zones whose authoritative servers are non-responsive or are experiencing a denial of service attack. (fate#320694) The following fixes are also included in the update: - Make /var/lib/named owned by the named user. (bsc#908850) - Add systemd service macros. (bsc#977657) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-819=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.9P1-36.1 bind-chrootenv-9.9.9P1-36.1 bind-debuginfo-9.9.9P1-36.1 bind-debugsource-9.9.9P1-36.1 bind-devel-9.9.9P1-36.1 bind-libs-9.9.9P1-36.1 bind-libs-debuginfo-9.9.9P1-36.1 bind-lwresd-9.9.9P1-36.1 bind-lwresd-debuginfo-9.9.9P1-36.1 bind-utils-9.9.9P1-36.1 bind-utils-debuginfo-9.9.9P1-36.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.9P1-36.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.9P1-36.1 bind-libs-debuginfo-32bit-9.9.9P1-36.1 References: https://bugzilla.suse.com/908850 https://bugzilla.suse.com/977657 https://bugzilla.suse.com/983505

1 0

openSUSE-RU-2016:1714-1: Recommended update for postgresql-init
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for postgresql-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1714-1 Rating: low References: #964945 #966285 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for postgresql-init provides the following fixes: - Increase the default timeout for pg_ctl from 60 to 600 seconds and make it configurable. (bsc#966285) - Change the permissions and ownership of /var/run/postgresql to match those of /tmp (the traditional location of PostgreSQL's unix domain sockets and lock files), so that users other than "postgres" are able to start their own database instances. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-811=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): postgresql-init-9.4-9.1 References: https://bugzilla.suse.com/964945 https://bugzilla.suse.com/966285

1 0

openSUSE-RU-2016:1713-1: moderate: Recommended update for w3m
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for w3m ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1713-1 Rating: moderate References: #950468 #950800 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for w3m fixes the following issues: - w3mman would show invalid characters (boo#950800) - Fix a segfault when doing a https request to an unresolvable host (boo#950468) The package was also changed to build with imlib2 and PIE support. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-815=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): w3m-0.5.3-155.5.1 w3m-debuginfo-0.5.3-155.5.1 w3m-debugsource-0.5.3-155.5.1 w3m-inline-image-0.5.3-155.5.1 w3m-inline-image-debuginfo-0.5.3-155.5.1 References: https://bugzilla.suse.com/950468 https://bugzilla.suse.com/950800

1 0

openSUSE-RU-2016:1712-1: moderate: Recommended update for mdadm
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for mdadm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1712-1 Rating: moderate References: #853944 #939124 #953595 #954769 #956236 #957886 #958597 #966773 #974154 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update for mdadm fixes the following issues: - A segmentation fault when a disk is re-added to the system shortly after being removed. (bsc#974154) - A problem when adding a spare disk to a degraded array. (bsc#958597) - A misleading error code returned by mdadm --detail on inactive arrays. (bsc#966773) - "Insufficient head-space for reshape" error when attempting to expand array on s390x systems. (bsc#953595) - Message "Starting Activate md array even though degraded..." could be erroneously printed at boot time. (bsc#853944) - The mdcheck script could try to check a non-existent '/dev/md?*' device. (bsc#957886) - The mdcheck script could fail to parse the output of mdadm --detail. (bsc#957886) - Add sample crontab file to schedule mdcheck execution if enabled in sysconfig. (bsc#957886) - An issue when displaying detailed information on Number and RaidDevice fields. (bsc#954769) - A crash when running --detail on a dm device which contains an md device. (bsc#939124) - Ignore multipath devices when not yet ready. (bsc#956236) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-812=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): mdadm-3.3.1-13.1 mdadm-debuginfo-3.3.1-13.1 mdadm-debugsource-3.3.1-13.1 References: https://bugzilla.suse.com/853944 https://bugzilla.suse.com/939124 https://bugzilla.suse.com/953595 https://bugzilla.suse.com/954769 https://bugzilla.suse.com/956236 https://bugzilla.suse.com/957886 https://bugzilla.suse.com/958597 https://bugzilla.suse.com/966773 https://bugzilla.suse.com/974154

1 0

openSUSE-RU-2016:1711-1: Recommended update for procps
by maintenance＠opensuse.org 30 Jun '16

30 Jun '16

openSUSE Recommended Update: Recommended update for procps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1711-1 Rating: low References: #981616 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for procps fixes the following issues: - Improve pmap(1) to be compatible with kernel 4.4. (bsc#981616) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-814=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libprocps3-3.3.9-6.1 libprocps3-debuginfo-3.3.9-6.1 procps-3.3.9-6.1 procps-debuginfo-3.3.9-6.1 procps-debugsource-3.3.9-6.1 procps-devel-3.3.9-6.1 References: https://bugzilla.suse.com/981616

1 0

openSUSE-RU-2016:1704-1: moderate: Recommended update for xf86-video-intel
by maintenance＠opensuse.org 29 Jun '16

29 Jun '16

openSUSE Recommended Update: Recommended update for xf86-video-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1704-1 Rating: moderate References: #985467 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for xf86-video-intel fixes the following issues: - Fix '-configure' option (boo#985467). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-808=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xf86-video-intel-2.99.917-15.1 xf86-video-intel-debuginfo-2.99.917-15.1 xf86-video-intel-debugsource-2.99.917-15.1 - openSUSE Leap 42.1 (x86_64): xf86-video-intel-32bit-2.99.917-15.1 xf86-video-intel-debuginfo-32bit-2.99.917-15.1 References: https://bugzilla.suse.com/985467

1 0

openSUSE-RU-2016:1702-1: moderate: Recommended update for clamav
by maintenance＠opensuse.org 29 Jun '16

29 Jun '16

openSUSE Recommended Update: Recommended update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1702-1 Rating: moderate References: #958451 #960237 #969814 #978459 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for clamav fixes the following issues: - Update to version 0.99.2 (boo#978459) * 7z: Fix for FolderStartPackStreamIndex array index heck * Print all CDBNAME entries for a zip file when using the -z flag. * Try to minimize the err cleanup path * clamunrar: Notice if unpacking comment failed * Signature manual update. * Use temp var for realloc to prevent pointer loss. * Fix debug VI hex truncation * freshclam: Avoid random data in mirrors.dat. * libclamav: Print raw certificate metadata * freshclam manager check return code of strdup. * Additional suppress IP notification when using proxy * Fix download and verification of *.cld through PrivateMirrors * Suppress IP notification when using proxy * Remove redundant mempool assignment * Divide out dumpcerts output for better readability * Fix dconf and option handling for nocert and dumpcert * Patch by Jim Morris to increase clamd's soft file descriptor to its potential maximum on 64-bit systems * Move libfreshclam config to m4/reorganization. * Adding libfreshclam * Add 'cdb' datafile to sigtools list of datafile types. * NULL pointer check. * malloc() NULL pointer check. * clamscan 'block-macros' option. * Initialize cpio name buffer * Initialize mspack decompression buffers * Prevent memory allocations on used pointers (folder objects) * Prevent memory allocations on used pointers (boolvectors) * Initialize ARJ metadata structures * Change cli_malloc with cli_calloc * Check packSizes prior to dereference * Fixed inconsistent folder state on failure * Pre-check on (*unpackSizes) dereference * Fix on pre-checks on dereferenced array * Pre-checks on dereferenced array size values (not =0) * Adding sanity checks to 7z header parsing * Fixed mew source read issue * Documentation update on targets * Filetype consistency * Move llvm option flag handling to new m4 file * hwp5.x: Fix for streams without names Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-805=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): clamav-0.99.2-40.1 clamav-debuginfo-0.99.2-40.1 clamav-debugsource-0.99.2-40.1 References: https://bugzilla.suse.com/958451 https://bugzilla.suse.com/960237 https://bugzilla.suse.com/969814 https://bugzilla.suse.com/978459

1 0

openSUSE-RU-2016:1701-1: Recommended update for timezone
by maintenance＠opensuse.org 29 Jun '16

29 Jun '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1701-1 Rating: low References: #982833 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016e) for your system, including the following changes: - Africa/Cairo observes DST in 2016 from July 7 to the end of October. This release also includes changes affecting past time stamps. For a comprehensive list, please refer to the release announcement from ICANN: http://mm.icann.org/pipermail/tz-announce/2016-June/000039.html Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-807=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): timezone-2016e-52.1 timezone-debuginfo-2016e-52.1 timezone-debugsource-2016e-52.1 - openSUSE 13.1 (noarch): timezone-java-2016e-52.1 References: https://bugzilla.suse.com/982833

1 0

openSUSE-SU-2016:1700-1: moderate: phpMyAdmin
by opensuse-security＠opensuse.org 29 Jun '16

29 Jun '16

openSUSE Security Update: phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1700-1 Rating: moderate References: #986154 Cross-References: CVE-2016-5701 CVE-2016-5703 CVE-2016-5705 CVE-2016-5706 CVE-2016-5730 CVE-2016-5731 CVE-2016-5733 CVE-2016-5739 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This phpMyAdmin update to version 4.4.15.7 fixes the following issues: Issues fixed: Setup script doesn't use input type 'password' in all relevant locations Security issues fixed: - PMASA-2016-17 (CVE-2016-5701, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-17/ - BBCode injection vulnerability - PMASA-2016-19 (CVE-2016-5703, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-19/ - SQL injection attack - PMASA-2016-21 (CVE-2016-5705, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-21/ - Multiple XSS vulnerabilities - PMASA-2016-22 (CVE-2016-5706, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-22/ - DOS attack - PMASA-2016-23 (CVE-2016-5730, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-23/ - Multiple full path disclosure vulnerabilities - PMASA-2016-24 (CVE-2016-5731, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-24/ - XSS through FPD - PMASA-2016-26 (CVE-2016-5733, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-26/ - Multiple XSS vulnerabilities - PMASA-2016-28 (CVE-2016-5739, CWE-661) https://www.phpmyadmin.net/security/PMASA-2016-28/ - Referrer leak in transformations Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-806=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): phpMyAdmin-4.4.15.7-60.1 References: https://www.suse.com/security/cve/CVE-2016-5701.html https://www.suse.com/security/cve/CVE-2016-5703.html https://www.suse.com/security/cve/CVE-2016-5705.html https://www.suse.com/security/cve/CVE-2016-5706.html https://www.suse.com/security/cve/CVE-2016-5730.html https://www.suse.com/security/cve/CVE-2016-5731.html https://www.suse.com/security/cve/CVE-2016-5733.html https://www.suse.com/security/cve/CVE-2016-5739.html https://bugzilla.suse.com/986154

1 0

openSUSE-SU-2016:1699-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 28 Jun '16

28 Jun '16

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1699-1 Rating: moderate References: #986154 Cross-References: CVE-2016-5701 CVE-2016-5703 CVE-2016-5705 CVE-2016-5706 CVE-2016-5730 CVE-2016-5731 CVE-2016-5733 CVE-2016-5739 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: phpMyAdmin was updated to version 4.4.15.7 to fix eight security issues. These security issues were fixed: - CVE-2016-5701: BBCode injection vulnerability (boo#986154) - CVE-2016-5703: SQL injection attack (boo#986154) - CVE-2016-5705: Multiple XSS vulnerabilities (boo#986154) - CVE-2016-5706: DOS attack (boo#986154) - CVE-2016-5730: Multiple full path disclosure vulnerabilities (boo#986154) - CVE-2016-5731: XSS through FPD (boo#986154) - CVE-2016-5733: Multiple XSS vulnerabilities (boo#986154) - CVE-2016-5739: Referrer leak in transformations (boo#986154) This non-security issues was fixed: - Fix issue Setup script doesn't use input type 'password' in all relevant locations Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-804=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-804=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): phpMyAdmin-4.4.15.7-22.1 - openSUSE 13.2 (noarch): phpMyAdmin-4.4.15.7-36.1 References: https://www.suse.com/security/cve/CVE-2016-5701.html https://www.suse.com/security/cve/CVE-2016-5703.html https://www.suse.com/security/cve/CVE-2016-5705.html https://www.suse.com/security/cve/CVE-2016-5706.html https://www.suse.com/security/cve/CVE-2016-5730.html https://www.suse.com/security/cve/CVE-2016-5731.html https://www.suse.com/security/cve/CVE-2016-5733.html https://www.suse.com/security/cve/CVE-2016-5739.html https://bugzilla.suse.com/986154

1 0

openSUSE-SU-2016:1695-1: moderate: Security update for rsync
by opensuse-security＠opensuse.org 28 Jun '16

28 Jun '16

openSUSE Security Update: Security update for rsync ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1695-1 Rating: moderate References: #915410 Cross-References: CVE-2014-9512 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rsync was updated to fix one security issue. This security issue was fixed: - CVE-2014-9512: rsync allowed remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path (boo#915410). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-803=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rsync-3.1.1-2.10.2 rsync-debuginfo-3.1.1-2.10.2 rsync-debugsource-3.1.1-2.10.2 References: https://www.suse.com/security/cve/CVE-2014-9512.html https://bugzilla.suse.com/915410

1 0

openSUSE-RU-2016:1694-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 28 Jun '16

28 Jun '16

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1694-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update provides version 5.0.22 for virtualbox: - Version bump to 5.0.22 (released 2016-06-16 by Oracle) This is a maintenance release. The following items were fixed and/or added: VMM: fixes for certain Intel Atom hosts (bug #14915) VMM: properly restore the complete FPU state for 32-bit guests on 64-bit hosts on Intel Sandy Bridge and Ivy Bridge CPUs VMM: new I/O-APIC implementation fixing several bugs and improving the performance under certain conditions (bug #15295 and others) VMM: fixed a potential Linux guest panic on AMD hosts VMM: fixed a potential hang with 32-bit EFI guests on Intel CPUs (VT-x without unrestricted guest execution) GUI: don't allow to start subsequent separate VM instances GUI: raised upper limit for video capture screen resolution (bug #15432) GUI: warn if the VM has less than 128MB VRAM configured and 3D enabled Main: when monitoring DNS configuration changes on Windows hosts avoid false positives from competing DHCP renewals. This should fix NAT link flaps when host has multiple DHCP configured interfaces, in particular when the host uses OpnVPN. Main: properly display an error message if the VRDE server cannot be enabled at runtime, for example because another service is using the same port NAT: Initialize guest address guess for wildcard port-forwarding rules with default guest address (bug #15412) VGA: fix for a problem which made certain legacy guests crash under certain conditions (bug #14811) ACPI: properly notify the guest if the ACPI battery state changed OVF: fixed import problems for some appliances using an AHCI controller created by 3rd party applications SDK: reduced memory usage in the webservice Java bindings Linux hosts: EL 6.8 fix (bug #15411) Linux hosts: Linux 4.7 fix (bug #15459) Linux Additions: Linux 4.7 fixes (bug #15444) Linux Additions: fix for certain 32-bit guests (5.0.18 regression; bug #15320) Linux Additions: fixed mouse pointer offset (5.0.18 regression; bug #15324) Linux Additions: made old X.Org releases work again with kernels 3.11 and later (5.0.18 regression; bug #15319) Linux Additions: fixed X.Org crash after hard guest reset (5.0.18 regression; bug #15354) Linux Additions: don't stop the X11 setup if loading the shared folders module fails (5.0.18 regression) Linux Additions: don't complain if the Drag and Drop service is not available on the host Solaris Additions: added support for X.org 1.18 Local openSUSE specific changes: File "changeset_60565.diff" is no longer needced and has been removed. Version bump to 5.0.20 (released 2016-04-28 by Oracle) This is a maintenance release. The following items were fixed and/or added: Storage: fixed a regression causing write requests from the BIOS to cause a Guru Meditation with the LsiLogic SCSI controller (5.0.18 regression; bug #15317) Storage: several emulation fixes in the BusLogic SCSI controller emulation NAT Network: support TCP in DNS proxy (same problem as in bug #14736 for NAT) NAT: rework handling of port-forwarding rules (bug #13570) NAT: rewrite host resolver to handle more query types and make it asynchronous so that a stalled lookup doesn't block all NAT traffic Snapshots: don't crash when restoring a snapshot which has more network adapters than the current state (ie when the snapshot uses ICH9 and the current state uses PIIX3) Guest Control: various bugfixes for the copyfrom and copyto commands / API (bug #14336) VBoxManage: list processor features on list hostinfo (bug #15334) Linux hosts: fix for Linux 4.5 if CONFIG_NET_CLS_ACT is enabled (bug #15327) Windows Additions: fixed performance issues with PowerPoint 2010 and the WDDM graphics drivers if Aero is disabled Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-800=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): python-virtualbox-5.0.22-19.1 python-virtualbox-debuginfo-5.0.22-19.1 virtualbox-5.0.22-19.1 virtualbox-debuginfo-5.0.22-19.1 virtualbox-debugsource-5.0.22-19.1 virtualbox-devel-5.0.22-19.1 virtualbox-guest-kmp-default-5.0.22_k4.1.26_21-19.1 virtualbox-guest-kmp-default-debuginfo-5.0.22_k4.1.26_21-19.1 virtualbox-guest-tools-5.0.22-19.1 virtualbox-guest-tools-debuginfo-5.0.22-19.1 virtualbox-guest-x11-5.0.22-19.1 virtualbox-guest-x11-debuginfo-5.0.22-19.1 virtualbox-host-kmp-default-5.0.22_k4.1.26_21-19.1 virtualbox-host-kmp-default-debuginfo-5.0.22_k4.1.26_21-19.1 virtualbox-qt-5.0.22-19.1 virtualbox-qt-debuginfo-5.0.22-19.1 virtualbox-websrv-5.0.22-19.1 virtualbox-websrv-debuginfo-5.0.22-19.1 - openSUSE Leap 42.1 (noarch): virtualbox-guest-desktop-icons-5.0.22-19.1 virtualbox-host-source-5.0.22-19.1 References:

1 0

openSUSE-RU-2016:1693-1: Recommended update for clamav-database
by maintenance＠opensuse.org 28 Jun '16

28 Jun '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1693-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh June 27th This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-799=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201606270002-117.1 References:

1 0

openSUSE-RU-2016:1689-1: Recommended update for ffado
by maintenance＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Recommended Update: Recommended update for ffado ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1689-1 Rating: low References: #982957 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ffado fixes building of the package against newer versions of Gnome. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-778=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ffado-2.1.0-5.1 ffado-debuginfo-2.1.0-5.1 ffado-debugsource-2.1.0-5.1 libffado-devel-2.1.0-5.1 libffado2-2.1.0-5.1 libffado2-debuginfo-2.1.0-5.1 - openSUSE Leap 42.1 (noarch): ffado-doc-2.1.0-5.2 ffado-mixer-2.1.0-5.2 - openSUSE Leap 42.1 (x86_64): libffado2-32bit-2.1.0-5.1 libffado2-debuginfo-32bit-2.1.0-5.1 References: https://bugzilla.suse.com/982957

1 0

openSUSE-SU-2016:1688-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1688-1 Rating: moderate References: #981049 #981050 #981061 #982009 #982010 #982011 #982012 #982013 Cross-References: CVE-2013-7456 CVE-2015-8876 CVE-2015-8877 CVE-2015-8879 CVE-2016-5093 CVE-2016-5094 CVE-2016-5095 CVE-2016-5096 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2013-7456: imagescale out-of-bounds read (bnc#982009). - CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010). - CVE-2016-5094: Don't create strings with lengths outside of valid range (bnc#982011). - CVE-2016-5095: Don't create strings with lengths outside of valid range (bnc#982012). - CVE-2016-5096: int/size_t confusion in fread (bsc#982013). - CVE-2015-8877: The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) as used in PHP used inconsistent allocate and free approaches, which allowed remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function (bsc#981061). - CVE-2015-8876: Zend/zend_exceptions.c in PHP did not validate certain Exception objects, which allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data (bsc#981049). - CVE-2015-8879: The odbc_bindcols function in ext/odbc/php_odbc.c in PHP mishandles driver behavior for SQL_WVARCHAR columns, which allowed remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table (bsc#981050). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-776=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-53.1 apache2-mod_php5-debuginfo-5.5.14-53.1 imap-2007e_suse-22.1 imap-debuginfo-2007e_suse-22.1 imap-debugsource-2007e_suse-22.1 imap-devel-2007e_suse-22.1 libc-client2007e_suse-2007e_suse-22.1 libc-client2007e_suse-debuginfo-2007e_suse-22.1 php5-5.5.14-53.1 php5-bcmath-5.5.14-53.1 php5-bcmath-debuginfo-5.5.14-53.1 php5-bz2-5.5.14-53.1 php5-bz2-debuginfo-5.5.14-53.1 php5-calendar-5.5.14-53.1 php5-calendar-debuginfo-5.5.14-53.1 php5-ctype-5.5.14-53.1 php5-ctype-debuginfo-5.5.14-53.1 php5-curl-5.5.14-53.1 php5-curl-debuginfo-5.5.14-53.1 php5-dba-5.5.14-53.1 php5-dba-debuginfo-5.5.14-53.1 php5-debuginfo-5.5.14-53.1 php5-debugsource-5.5.14-53.1 php5-devel-5.5.14-53.1 php5-dom-5.5.14-53.1 php5-dom-debuginfo-5.5.14-53.1 php5-enchant-5.5.14-53.1 php5-enchant-debuginfo-5.5.14-53.1 php5-exif-5.5.14-53.1 php5-exif-debuginfo-5.5.14-53.1 php5-fastcgi-5.5.14-53.1 php5-fastcgi-debuginfo-5.5.14-53.1 php5-fileinfo-5.5.14-53.1 php5-fileinfo-debuginfo-5.5.14-53.1 php5-firebird-5.5.14-53.1 php5-firebird-debuginfo-5.5.14-53.1 php5-fpm-5.5.14-53.1 php5-fpm-debuginfo-5.5.14-53.1 php5-ftp-5.5.14-53.1 php5-ftp-debuginfo-5.5.14-53.1 php5-gd-5.5.14-53.1 php5-gd-debuginfo-5.5.14-53.1 php5-gettext-5.5.14-53.1 php5-gettext-debuginfo-5.5.14-53.1 php5-gmp-5.5.14-53.1 php5-gmp-debuginfo-5.5.14-53.1 php5-iconv-5.5.14-53.1 php5-iconv-debuginfo-5.5.14-53.1 php5-imap-5.5.14-53.1 php5-imap-debuginfo-5.5.14-53.1 php5-intl-5.5.14-53.1 php5-intl-debuginfo-5.5.14-53.1 php5-json-5.5.14-53.1 php5-json-debuginfo-5.5.14-53.1 php5-ldap-5.5.14-53.1 php5-ldap-debuginfo-5.5.14-53.1 php5-mbstring-5.5.14-53.1 php5-mbstring-debuginfo-5.5.14-53.1 php5-mcrypt-5.5.14-53.1 php5-mcrypt-debuginfo-5.5.14-53.1 php5-mssql-5.5.14-53.1 php5-mssql-debuginfo-5.5.14-53.1 php5-mysql-5.5.14-53.1 php5-mysql-debuginfo-5.5.14-53.1 php5-odbc-5.5.14-53.1 php5-odbc-debuginfo-5.5.14-53.1 php5-opcache-5.5.14-53.1 php5-opcache-debuginfo-5.5.14-53.1 php5-openssl-5.5.14-53.1 php5-openssl-debuginfo-5.5.14-53.1 php5-pcntl-5.5.14-53.1 php5-pcntl-debuginfo-5.5.14-53.1 php5-pdo-5.5.14-53.1 php5-pdo-debuginfo-5.5.14-53.1 php5-pgsql-5.5.14-53.1 php5-pgsql-debuginfo-5.5.14-53.1 php5-phar-5.5.14-53.1 php5-phar-debuginfo-5.5.14-53.1 php5-posix-5.5.14-53.1 php5-posix-debuginfo-5.5.14-53.1 php5-pspell-5.5.14-53.1 php5-pspell-debuginfo-5.5.14-53.1 php5-readline-5.5.14-53.1 php5-readline-debuginfo-5.5.14-53.1 php5-shmop-5.5.14-53.1 php5-shmop-debuginfo-5.5.14-53.1 php5-snmp-5.5.14-53.1 php5-snmp-debuginfo-5.5.14-53.1 php5-soap-5.5.14-53.1 php5-soap-debuginfo-5.5.14-53.1 php5-sockets-5.5.14-53.1 php5-sockets-debuginfo-5.5.14-53.1 php5-sqlite-5.5.14-53.1 php5-sqlite-debuginfo-5.5.14-53.1 php5-suhosin-5.5.14-53.1 php5-suhosin-debuginfo-5.5.14-53.1 php5-sysvmsg-5.5.14-53.1 php5-sysvmsg-debuginfo-5.5.14-53.1 php5-sysvsem-5.5.14-53.1 php5-sysvsem-debuginfo-5.5.14-53.1 php5-sysvshm-5.5.14-53.1 php5-sysvshm-debuginfo-5.5.14-53.1 php5-tidy-5.5.14-53.1 php5-tidy-debuginfo-5.5.14-53.1 php5-tokenizer-5.5.14-53.1 php5-tokenizer-debuginfo-5.5.14-53.1 php5-wddx-5.5.14-53.1 php5-wddx-debuginfo-5.5.14-53.1 php5-xmlreader-5.5.14-53.1 php5-xmlreader-debuginfo-5.5.14-53.1 php5-xmlrpc-5.5.14-53.1 php5-xmlrpc-debuginfo-5.5.14-53.1 php5-xmlwriter-5.5.14-53.1 php5-xmlwriter-debuginfo-5.5.14-53.1 php5-xsl-5.5.14-53.1 php5-xsl-debuginfo-5.5.14-53.1 php5-zip-5.5.14-53.1 php5-zip-debuginfo-5.5.14-53.1 php5-zlib-5.5.14-53.1 php5-zlib-debuginfo-5.5.14-53.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-53.1 References: https://www.suse.com/security/cve/CVE-2013-7456.html https://www.suse.com/security/cve/CVE-2015-8876.html https://www.suse.com/security/cve/CVE-2015-8877.html https://www.suse.com/security/cve/CVE-2015-8879.html https://www.suse.com/security/cve/CVE-2016-5093.html https://www.suse.com/security/cve/CVE-2016-5094.html https://www.suse.com/security/cve/CVE-2016-5095.html https://www.suse.com/security/cve/CVE-2016-5096.html https://bugzilla.suse.com/981049 https://bugzilla.suse.com/981050 https://bugzilla.suse.com/981061 https://bugzilla.suse.com/982009 https://bugzilla.suse.com/982010 https://bugzilla.suse.com/982011 https://bugzilla.suse.com/982012 https://bugzilla.suse.com/982013

1 0

openSUSE-RU-2016:1687-1: Recommended update for perl-Net-SSLeay
by maintenance＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Recommended Update: Recommended update for perl-Net-SSLeay ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1687-1 Rating: low References: #982234 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-Net-SSLeay removes a test which is executed at build time and is now obsolete with newer (1.0.1n+) versions of OpenSSL. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-777=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): perl-Net-SSLeay-1.64-5.1 perl-Net-SSLeay-debuginfo-1.64-5.1 perl-Net-SSLeay-debugsource-1.64-5.1 References: https://bugzilla.suse.com/982234

1 0

openSUSE-SU-2016:1686-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1686-1 Rating: important References: #961935 #963806 #963810 #970287 #970295 #980904 Cross-References: CVE-2016-0505 CVE-2016-0546 CVE-2016-0596 CVE-2016-0597 CVE-2016-0598 CVE-2016-0600 CVE-2016-0606 CVE-2016-0608 CVE-2016-0609 CVE-2016-0616 CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0651 CVE-2016-0655 CVE-2016-0666 CVE-2016-0668 CVE-2016-2047 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: mariadb was updated to version 10.0.25 to fix 25 security issues. These security issues were fixed: - CVE-2016-0505: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Options (bsc#980904). - CVE-2016-0546: Unspecified vulnerability allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Client (bsc#980904). - CVE-2016-0596: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0597: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0598: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0600: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to InnoDB (bsc#980904). - CVE-2016-0606: Unspecified vulnerability allowed remote authenticated users to affect integrity via unknown vectors related to encryption (bsc#980904). - CVE-2016-0608: Unspecified vulnerability allowed remote authenticated users to affect availability via vectors related to UDF (bsc#980904). - CVE-2016-0609: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to privileges (bsc#980904). - CVE-2016-0616: Unspecified vulnerability allowed remote authenticated users to affect availability via unknown vectors related to Optimizer (bsc#980904). - CVE-2016-0640: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to DML (bsc#980904). - CVE-2016-0641: Unspecified vulnerability allowed local users to affect confidentiality and availability via vectors related to MyISAM (bsc#980904). - CVE-2016-0642: Unspecified vulnerability allowed local users to affect integrity and availability via vectors related to Federated (bsc#980904). - CVE-2016-0643: Unspecified vulnerability allowed local users to affect confidentiality via vectors related to DML (bsc#980904). - CVE-2016-0644: Unspecified vulnerability allowed local users to affect availability via vectors related to DDL (bsc#980904). - CVE-2016-0646: Unspecified vulnerability allowed local users to affect availability via vectors related to DML (bsc#980904). - CVE-2016-0647: Unspecified vulnerability allowed local users to affect availability via vectors related to FTS (bsc#980904). - CVE-2016-0648: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0649: Unspecified vulnerability allowed local users to affect availability via vectors related to PS (bsc#980904). - CVE-2016-0650: Unspecified vulnerability allowed local users to affect availability via vectors related to Replication (bsc#980904). - CVE-2016-0651: Unspecified vulnerability allowed local users to affect availability via vectors related to Optimizer (bsc#980904). - CVE-2016-0655: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-0666: Unspecified vulnerability allowed local users to affect availability via vectors related to Security: Privileges (bsc#980904). - CVE-2016-0668: Unspecified vulnerability allowed local users to affect availability via vectors related to InnoDB (bsc#980904). - CVE-2016-2047: The ssl_verify_server_cert function in sql-common/client.c did not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com (bsc#963806). These non-security issues were fixed: - bsc#961935: Remove the leftovers of "openSUSE" string in the '-DWITH_COMMENT' and 'DCOMPILATION_COMMENT' options - bsc#970287: remove ha_tokudb.so plugin and tokuft_logprint and tokuftdump binaries as TokuDB storage engine requires the jemalloc library that isn't present in SLE-12-SP1 - bsc#970295: Fix the leftovers of "logrotate.d/mysql" string in the logrotate error message. Occurrences of this string were changed to "logrotate.d/mariadb" - bsc#963810: Add 'log-error' and 'secure-file-priv' configuration options * add '/etc/my.cnf.d/error_log.conf' that specifies 'log-error = /var/log/mysql/mysqld.log'. If no path is set, the error log is written to '/var/lib/mysql/$HOSTNAME.err', which is not picked up by logrotate. * add '/etc/my.cnf.d/secure_file_priv.conf' which specifies that 'LOAD DATA', 'SELECT ... INTO' and 'LOAD FILE()' will only work with files in the directory specified by 'secure-file-priv' option (='/var/lib/mysql-files'). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-780=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmysqlclient-devel-10.0.25-6.1 libmysqlclient18-10.0.25-6.1 libmysqlclient18-debuginfo-10.0.25-6.1 libmysqlclient_r18-10.0.25-6.1 libmysqld-devel-10.0.25-6.1 libmysqld18-10.0.25-6.1 libmysqld18-debuginfo-10.0.25-6.1 mariadb-10.0.25-6.1 mariadb-bench-10.0.25-6.1 mariadb-bench-debuginfo-10.0.25-6.1 mariadb-client-10.0.25-6.1 mariadb-client-debuginfo-10.0.25-6.1 mariadb-debuginfo-10.0.25-6.1 mariadb-debugsource-10.0.25-6.1 mariadb-errormessages-10.0.25-6.1 mariadb-test-10.0.25-6.1 mariadb-test-debuginfo-10.0.25-6.1 mariadb-tools-10.0.25-6.1 mariadb-tools-debuginfo-10.0.25-6.1 - openSUSE Leap 42.1 (x86_64): libmysqlclient18-32bit-10.0.25-6.1 libmysqlclient18-debuginfo-32bit-10.0.25-6.1 libmysqlclient_r18-32bit-10.0.25-6.1 References: https://www.suse.com/security/cve/CVE-2016-0505.html https://www.suse.com/security/cve/CVE-2016-0546.html https://www.suse.com/security/cve/CVE-2016-0596.html https://www.suse.com/security/cve/CVE-2016-0597.html https://www.suse.com/security/cve/CVE-2016-0598.html https://www.suse.com/security/cve/CVE-2016-0600.html https://www.suse.com/security/cve/CVE-2016-0606.html https://www.suse.com/security/cve/CVE-2016-0608.html https://www.suse.com/security/cve/CVE-2016-0609.html https://www.suse.com/security/cve/CVE-2016-0616.html https://www.suse.com/security/cve/CVE-2016-0640.html https://www.suse.com/security/cve/CVE-2016-0641.html https://www.suse.com/security/cve/CVE-2016-0642.html https://www.suse.com/security/cve/CVE-2016-0643.html https://www.suse.com/security/cve/CVE-2016-0644.html https://www.suse.com/security/cve/CVE-2016-0646.html https://www.suse.com/security/cve/CVE-2016-0647.html https://www.suse.com/security/cve/CVE-2016-0648.html https://www.suse.com/security/cve/CVE-2016-0649.html https://www.suse.com/security/cve/CVE-2016-0650.html https://www.suse.com/security/cve/CVE-2016-0651.html https://www.suse.com/security/cve/CVE-2016-0655.html https://www.suse.com/security/cve/CVE-2016-0666.html https://www.suse.com/security/cve/CVE-2016-0668.html https://www.suse.com/security/cve/CVE-2016-2047.html https://bugzilla.suse.com/961935 https://bugzilla.suse.com/963806 https://bugzilla.suse.com/963810 https://bugzilla.suse.com/970287 https://bugzilla.suse.com/970295 https://bugzilla.suse.com/980904

1 0

openSUSE-SU-2016:1685-1: moderate: Security update for libav
by opensuse-security＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Security Update: Security update for libav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1685-1 Rating: moderate References: #949760 #984487 Cross-References: CVE-2015-5479 CVE-2016-3062 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libav fixes the two following security issues: - CVE-2016-3062: A MP4 memory corruption was fixed that could lead to crashes or code execution. (boo#984487) - CVE-2015-5479: A crash due to a divide by zero was fixed in ff_h263_decode_mba() that could lead to decoder crashes. (boo#949760) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-779=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libav-debugsource-11.4-5.1 libav-tools-11.4-5.1 libav-tools-debuginfo-11.4-5.1 libavcodec-libav-devel-11.4-5.1 libavcodec-libav56-11.4-5.1 libavcodec-libav56-debuginfo-11.4-5.1 libavdevice-libav-devel-11.4-5.1 libavdevice-libav55-11.4-5.1 libavdevice-libav55-debuginfo-11.4-5.1 libavfilter-libav-devel-11.4-5.1 libavfilter-libav5-11.4-5.1 libavfilter-libav5-debuginfo-11.4-5.1 libavformat-libav-devel-11.4-5.1 libavformat-libav56-11.4-5.1 libavformat-libav56-debuginfo-11.4-5.1 libavresample-libav-devel-11.4-5.1 libavresample-libav2-11.4-5.1 libavresample-libav2-debuginfo-11.4-5.1 libavutil-libav-devel-11.4-5.1 libavutil-libav54-11.4-5.1 libavutil-libav54-debuginfo-11.4-5.1 libswscale-libav-devel-11.4-5.1 libswscale-libav3-11.4-5.1 libswscale-libav3-debuginfo-11.4-5.1 References: https://www.suse.com/security/cve/CVE-2015-5479.html https://www.suse.com/security/cve/CVE-2016-3062.html https://bugzilla.suse.com/949760 https://bugzilla.suse.com/984487

1 0

openSUSE-RU-2016:1684-1: Recommended update for clamav-database
by maintenance＠opensuse.org 27 Jun '16

27 Jun '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1684-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh June 20th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-775=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201606200004-113.1 References:

1 0

openSUSE-SU-2016:1683-1: moderate: Security update for libtorrent-rasterbar
by opensuse-security＠opensuse.org 26 Jun '16

26 Jun '16

openSUSE Security Update: Security update for libtorrent-rasterbar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1683-1 Rating: moderate References: #983228 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libtorrent-rasterbar fixes the following issues: - CVE-2016-5301: Crash on invalid input in http_parser could have allowed a remote attacker to perform a denial of service attack (boo#983228). In addition, the package was updated to 1.0.9 / 1.16.19, fixing various upstream bugs. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-774=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libtorrent-rasterbar-debugsource-0.16.17-2.5.1 libtorrent-rasterbar-devel-0.16.17-2.5.1 libtorrent-rasterbar-doc-0.16.17-2.5.1 libtorrent-rasterbar7-0.16.17-2.5.1 libtorrent-rasterbar7-debuginfo-0.16.17-2.5.1 python-libtorrent-rasterbar-0.16.17-2.5.1 python-libtorrent-rasterbar-debuginfo-0.16.17-2.5.1 References: https://bugzilla.suse.com/983228

1 0

openSUSE-SU-2016:1679-1: Security update for libarchive
by opensuse-security＠opensuse.org 24 Jun '16

24 Jun '16

openSUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1679-1 Rating: low References: #984990 Cross-References: CVE-2016-4809 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libarchive was updated to fix one security issue. This security issue was fixed: - CVE-2016-4809: Memory allocation error with gigantic symbolic links in cpio archives (bsc#984990). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-770=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bsdtar-3.1.2-7.11.1 bsdtar-debuginfo-3.1.2-7.11.1 libarchive-debugsource-3.1.2-7.11.1 libarchive-devel-3.1.2-7.11.1 libarchive13-3.1.2-7.11.1 libarchive13-debuginfo-3.1.2-7.11.1 - openSUSE 13.2 (x86_64): libarchive13-32bit-3.1.2-7.11.1 libarchive13-debuginfo-32bit-3.1.2-7.11.1 References: https://www.suse.com/security/cve/CVE-2016-4809.html https://bugzilla.suse.com/984990

1 0