July 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:1768-1: moderate: Recommended update for rsnapshot
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for rsnapshot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1768-1 Rating: moderate References: #983149 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for rsnapshot fixes the following issues: - set cmd_ssh and cmd_logger to valid paths in /etc/rsnapshot.conf - fix wrong paths in /etc/rsnapshot.conf (boo#983149) - includes the rsnapshot-HOWTO.en.html file which explains how to setup rsnapshot Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-857=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): rsnapshot-1.3.1-25.3.1 References: https://bugzilla.suse.com/983149

1 0

openSUSE-SU-2016:1767-1: important: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1767-1 Rating: important References: #969894 #977333 #977375 #977376 #983549 #984126 #984637 #986162 Cross-References: CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1960 CVE-2016-1961 CVE-2016-1964 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 CVE-2016-2806 CVE-2016-2807 CVE-2016-2815 CVE-2016-2818 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update contains Mozilla Thunderbird 45.2. (boo#983549) It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail. The following vulnerabilities were fixed: - CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49) Contains the following security fixes from the 45.1 release: (boo#977333) - CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39) Contains the following security fixes from the 45.0 release: (boo#969894) - CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16) - CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17) - CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18) - CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19) - CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20) - CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23) - CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24) - CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27) - CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34) The graphite font shaping library was disabled, addressing the following font vulnerabilities: - MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 The following tracked packaging changes are included: - fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637) - gcc6 fixes (boo#986162) - running on 48bit va aarch64 (boo#984126) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-848=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-45.2-70.83.1 MozillaThunderbird-buildsymbols-45.2-70.83.1 MozillaThunderbird-debuginfo-45.2-70.83.1 MozillaThunderbird-debugsource-45.2-70.83.1 MozillaThunderbird-devel-45.2-70.83.1 MozillaThunderbird-translations-common-45.2-70.83.1 MozillaThunderbird-translations-other-45.2-70.83.1 References: https://www.suse.com/security/cve/CVE-2016-1952.html https://www.suse.com/security/cve/CVE-2016-1953.html https://www.suse.com/security/cve/CVE-2016-1954.html https://www.suse.com/security/cve/CVE-2016-1955.html https://www.suse.com/security/cve/CVE-2016-1956.html https://www.suse.com/security/cve/CVE-2016-1957.html https://www.suse.com/security/cve/CVE-2016-1960.html https://www.suse.com/security/cve/CVE-2016-1961.html https://www.suse.com/security/cve/CVE-2016-1964.html https://www.suse.com/security/cve/CVE-2016-1974.html https://www.suse.com/security/cve/CVE-2016-1977.html https://www.suse.com/security/cve/CVE-2016-2790.html https://www.suse.com/security/cve/CVE-2016-2791.html https://www.suse.com/security/cve/CVE-2016-2792.html https://www.suse.com/security/cve/CVE-2016-2793.html https://www.suse.com/security/cve/CVE-2016-2794.html https://www.suse.com/security/cve/CVE-2016-2795.html https://www.suse.com/security/cve/CVE-2016-2796.html https://www.suse.com/security/cve/CVE-2016-2797.html https://www.suse.com/security/cve/CVE-2016-2798.html https://www.suse.com/security/cve/CVE-2016-2799.html https://www.suse.com/security/cve/CVE-2016-2800.html https://www.suse.com/security/cve/CVE-2016-2801.html https://www.suse.com/security/cve/CVE-2016-2802.html https://www.suse.com/security/cve/CVE-2016-2806.html https://www.suse.com/security/cve/CVE-2016-2807.html https://www.suse.com/security/cve/CVE-2016-2815.html https://www.suse.com/security/cve/CVE-2016-2818.html https://bugzilla.suse.com/969894 https://bugzilla.suse.com/977333 https://bugzilla.suse.com/977375 https://bugzilla.suse.com/977376 https://bugzilla.suse.com/983549 https://bugzilla.suse.com/984126 https://bugzilla.suse.com/984637 https://bugzilla.suse.com/986162

1 0

openSUSE-SU-2016:1766-1: moderate: Security update for libircclient
by opensuse-security＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Security Update: Security update for libircclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1766-1 Rating: moderate References: #857151 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update fixes an issue with libircclient using an insecure openssl cipher suite. - cipher suite fix from ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH to EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH bnc#857151 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-846=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libircclient-devel-1.6-6.3.1 libircclient-doc-1.6-6.3.1 libircclient1-1.6-6.3.1 References: https://bugzilla.suse.com/857151

1 0

openSUSE-RU-2016:1765-1: important: Recommended update for timezone
by maintenance＠opensuse.org 10 Jul '16

10 Jul '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1765-1 Rating: important References: #987720 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update contains the latest timezone definitions (2016f) and includes the following fixes: - Egypt (Africa/Cairo) DST change 2016-07-07 cancelled boo#987720 - Asia/Novosibirsk switches from +06 to +07 on 2016-07-24 02:00 - Asia/Novokuznetsk and Asia/Novosibirsk now use numeric time zone abbreviations instead of invented ones. - Europe/Minsk's 1992-03-29 spring-forward transition was at 02:00 not 00:00. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-847=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): timezone-2016f-55.1 timezone-debuginfo-2016f-55.1 timezone-debugsource-2016f-55.1 - openSUSE 13.1 (noarch): timezone-java-2016f-55.1 References: https://bugzilla.suse.com/987720

1 0

openSUSE-OU-2016:1762-1: moderate: Optional update for whois
by maintenance＠opensuse.org 07 Jul '16

07 Jul '16

openSUSE Optional Update: Optional update for whois ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:1762-1 Rating: moderate References: #986953 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This optional update for whois contains version 5.2.12 with updated TLD server lists, gTLDs and IPv4 allications. (boo#986953) Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-845=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-845=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): whois-5.2.12-6.1 whois-debuginfo-5.2.12-6.1 whois-debugsource-5.2.12-6.1 - openSUSE 13.2 (i586 x86_64): whois-5.2.12-3.1 whois-debuginfo-5.2.12-3.1 whois-debugsource-5.2.12-3.1 References: https://bugzilla.suse.com/986953

1 0

openSUSE-SU-2016:1761-1: important: Security update for php5
by opensuse-security＠opensuse.org 07 Jul '16

07 Jul '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1761-1 Rating: important References: #986004 #986244 #986246 #986247 #986386 #986388 #986391 #986392 #986393 Cross-References: CVE-2015-8935 CVE-2016-5766 CVE-2016-5767 CVE-2016-5768 CVE-2016-5769 CVE-2016-5770 CVE-2016-5771 CVE-2016-5772 CVE-2016-5773 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: php5 was updated to fix nine security issues. These security issues were fixed: - CVE-2016-5773: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize (bsc#986247). - CVE-2016-5772: Double Free Courruption in wddx_deserialize (bsc#986244). - CVE-2016-5771: Use After Free Vulnerability in PHP's GC algorithm and unserialize (bsc#986391). - CVE-2016-5770: int/size_t confusion in SplFileObject::fread (bsc#986392). - CVE-2016-5768: Double free in _php_mb_regex_ereg_replace_exec - (bsc#986246). - CVE-2016-5769: mcrypt: Heap Overflow due to integer overflows (bsc#986388). - CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004). - CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow (bsc#986393). - CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow (bsc#986386). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-844=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-69.1 apache2-mod_php5-debuginfo-5.6.1-69.1 php5-5.6.1-69.1 php5-bcmath-5.6.1-69.1 php5-bcmath-debuginfo-5.6.1-69.1 php5-bz2-5.6.1-69.1 php5-bz2-debuginfo-5.6.1-69.1 php5-calendar-5.6.1-69.1 php5-calendar-debuginfo-5.6.1-69.1 php5-ctype-5.6.1-69.1 php5-ctype-debuginfo-5.6.1-69.1 php5-curl-5.6.1-69.1 php5-curl-debuginfo-5.6.1-69.1 php5-dba-5.6.1-69.1 php5-dba-debuginfo-5.6.1-69.1 php5-debuginfo-5.6.1-69.1 php5-debugsource-5.6.1-69.1 php5-devel-5.6.1-69.1 php5-dom-5.6.1-69.1 php5-dom-debuginfo-5.6.1-69.1 php5-enchant-5.6.1-69.1 php5-enchant-debuginfo-5.6.1-69.1 php5-exif-5.6.1-69.1 php5-exif-debuginfo-5.6.1-69.1 php5-fastcgi-5.6.1-69.1 php5-fastcgi-debuginfo-5.6.1-69.1 php5-fileinfo-5.6.1-69.1 php5-fileinfo-debuginfo-5.6.1-69.1 php5-firebird-5.6.1-69.1 php5-firebird-debuginfo-5.6.1-69.1 php5-fpm-5.6.1-69.1 php5-fpm-debuginfo-5.6.1-69.1 php5-ftp-5.6.1-69.1 php5-ftp-debuginfo-5.6.1-69.1 php5-gd-5.6.1-69.1 php5-gd-debuginfo-5.6.1-69.1 php5-gettext-5.6.1-69.1 php5-gettext-debuginfo-5.6.1-69.1 php5-gmp-5.6.1-69.1 php5-gmp-debuginfo-5.6.1-69.1 php5-iconv-5.6.1-69.1 php5-iconv-debuginfo-5.6.1-69.1 php5-imap-5.6.1-69.1 php5-imap-debuginfo-5.6.1-69.1 php5-intl-5.6.1-69.1 php5-intl-debuginfo-5.6.1-69.1 php5-json-5.6.1-69.1 php5-json-debuginfo-5.6.1-69.1 php5-ldap-5.6.1-69.1 php5-ldap-debuginfo-5.6.1-69.1 php5-mbstring-5.6.1-69.1 php5-mbstring-debuginfo-5.6.1-69.1 php5-mcrypt-5.6.1-69.1 php5-mcrypt-debuginfo-5.6.1-69.1 php5-mssql-5.6.1-69.1 php5-mssql-debuginfo-5.6.1-69.1 php5-mysql-5.6.1-69.1 php5-mysql-debuginfo-5.6.1-69.1 php5-odbc-5.6.1-69.1 php5-odbc-debuginfo-5.6.1-69.1 php5-opcache-5.6.1-69.1 php5-opcache-debuginfo-5.6.1-69.1 php5-openssl-5.6.1-69.1 php5-openssl-debuginfo-5.6.1-69.1 php5-pcntl-5.6.1-69.1 php5-pcntl-debuginfo-5.6.1-69.1 php5-pdo-5.6.1-69.1 php5-pdo-debuginfo-5.6.1-69.1 php5-pgsql-5.6.1-69.1 php5-pgsql-debuginfo-5.6.1-69.1 php5-phar-5.6.1-69.1 php5-phar-debuginfo-5.6.1-69.1 php5-posix-5.6.1-69.1 php5-posix-debuginfo-5.6.1-69.1 php5-pspell-5.6.1-69.1 php5-pspell-debuginfo-5.6.1-69.1 php5-readline-5.6.1-69.1 php5-readline-debuginfo-5.6.1-69.1 php5-shmop-5.6.1-69.1 php5-shmop-debuginfo-5.6.1-69.1 php5-snmp-5.6.1-69.1 php5-snmp-debuginfo-5.6.1-69.1 php5-soap-5.6.1-69.1 php5-soap-debuginfo-5.6.1-69.1 php5-sockets-5.6.1-69.1 php5-sockets-debuginfo-5.6.1-69.1 php5-sqlite-5.6.1-69.1 php5-sqlite-debuginfo-5.6.1-69.1 php5-suhosin-5.6.1-69.1 php5-suhosin-debuginfo-5.6.1-69.1 php5-sysvmsg-5.6.1-69.1 php5-sysvmsg-debuginfo-5.6.1-69.1 php5-sysvsem-5.6.1-69.1 php5-sysvsem-debuginfo-5.6.1-69.1 php5-sysvshm-5.6.1-69.1 php5-sysvshm-debuginfo-5.6.1-69.1 php5-tidy-5.6.1-69.1 php5-tidy-debuginfo-5.6.1-69.1 php5-tokenizer-5.6.1-69.1 php5-tokenizer-debuginfo-5.6.1-69.1 php5-wddx-5.6.1-69.1 php5-wddx-debuginfo-5.6.1-69.1 php5-xmlreader-5.6.1-69.1 php5-xmlreader-debuginfo-5.6.1-69.1 php5-xmlrpc-5.6.1-69.1 php5-xmlrpc-debuginfo-5.6.1-69.1 php5-xmlwriter-5.6.1-69.1 php5-xmlwriter-debuginfo-5.6.1-69.1 php5-xsl-5.6.1-69.1 php5-xsl-debuginfo-5.6.1-69.1 php5-zip-5.6.1-69.1 php5-zip-debuginfo-5.6.1-69.1 php5-zlib-5.6.1-69.1 php5-zlib-debuginfo-5.6.1-69.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-69.1 References: https://www.suse.com/security/cve/CVE-2015-8935.html https://www.suse.com/security/cve/CVE-2016-5766.html https://www.suse.com/security/cve/CVE-2016-5767.html https://www.suse.com/security/cve/CVE-2016-5768.html https://www.suse.com/security/cve/CVE-2016-5769.html https://www.suse.com/security/cve/CVE-2016-5770.html https://www.suse.com/security/cve/CVE-2016-5771.html https://www.suse.com/security/cve/CVE-2016-5772.html https://www.suse.com/security/cve/CVE-2016-5773.html https://bugzilla.suse.com/986004 https://bugzilla.suse.com/986244 https://bugzilla.suse.com/986246 https://bugzilla.suse.com/986247 https://bugzilla.suse.com/986386 https://bugzilla.suse.com/986388 https://bugzilla.suse.com/986391 https://bugzilla.suse.com/986392 https://bugzilla.suse.com/986393

1 0

openSUSE-RU-2016:1758-1: moderate: Recommended update for R-base
by maintenance＠opensuse.org 07 Jul '16

07 Jul '16

openSUSE Recommended Update: Recommended update for R-base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1758-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for R-base provides version 3.3.1 with various fixes and improvements. For a detailed description of all fixes please refer to the changelog. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-843=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): R-KernSmooth-2.23.15-4.1 R-KernSmooth-debuginfo-2.23.15-4.1 R-MASS-7.3.45-4.1 R-MASS-debuginfo-7.3.45-4.1 R-Matrix-1.2.6-4.1 R-Matrix-debuginfo-1.2.6-4.1 R-Matrix-devel-1.2.6-4.1 R-base-3.3.1-4.1 R-base-debugsource-3.3.1-4.1 R-base-devel-3.3.1-4.1 R-boot-1.3.18-4.1 R-class-7.3.14-4.1 R-class-debuginfo-7.3.14-4.1 R-cluster-2.0.4-4.1 R-cluster-debuginfo-2.0.4-4.1 R-codetools-0.2.14-4.1 R-compiler-3.3.1-4.1 R-core-3.3.1-4.1 R-core-debuginfo-3.3.1-4.1 R-core-devel-3.3.1-4.1 R-core-doc-3.3.1-4.1 R-core-libs-3.3.1-4.1 R-core-libs-debuginfo-3.3.1-4.1 R-core-packages-3.3.1-4.1 R-datasets-3.3.1-4.1 R-foreign-0.8.66-4.1 R-foreign-debuginfo-0.8.66-4.1 R-grDevices-3.3.1-4.1 R-grDevices-debuginfo-3.3.1-4.1 R-graphics-3.3.1-4.1 R-graphics-debuginfo-3.3.1-4.1 R-grid-3.3.1-4.1 R-grid-debuginfo-3.3.1-4.1 R-lattice-0.20.33-4.1 R-lattice-debuginfo-0.20.33-4.1 R-methods-3.3.1-4.1 R-methods-debuginfo-3.3.1-4.1 R-mgcv-1.8.12-4.1 R-mgcv-debuginfo-1.8.12-4.1 R-nlme-3.1.128-4.1 R-nlme-debuginfo-3.1.128-4.1 R-nnet-7.3.12-4.1 R-nnet-debuginfo-7.3.12-4.1 R-parallel-3.3.1-4.1 R-parallel-debuginfo-3.3.1-4.1 R-recommended-packages-3.3.1-4.1 R-rpart-4.1.10-4.1 R-rpart-debuginfo-4.1.10-4.1 R-spatial-7.3.11-4.1 R-spatial-debuginfo-7.3.11-4.1 R-splines-3.3.1-4.1 R-splines-debuginfo-3.3.1-4.1 R-stats-3.3.1-4.1 R-stats-debuginfo-3.3.1-4.1 R-stats4-3.3.1-4.1 R-survival-2.39.4-4.1 R-survival-debuginfo-2.39.4-4.1 R-tcltk-3.3.1-4.1 R-tcltk-debuginfo-3.3.1-4.1 R-tools-3.3.1-4.1 R-tools-debuginfo-3.3.1-4.1 R-utils-3.3.1-4.1 R-utils-debuginfo-3.3.1-4.1 References:

1 0

openSUSE-RU-2016:1752-1: moderate: Recommended update for timezone
by maintenance＠opensuse.org 07 Jul '16

07 Jul '16

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1752-1 Rating: moderate References: #987720 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2016f) for your system, including the following changes: - Egypt (Africa/Cairo) DST change 2016-07-07 cancelled (bsc#987720) - Asia/Novosibirsk switches from +06 to +07 on 2016-07-24 02:00 - Asia/Novokuznetsk and Asia/Novosibirsk now use numeric time zone abbreviations instead of invented ones - Europe/Minsk's 1992-03-29 spring-forward transition was at 02:00 not 00:00 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-841=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-841=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): timezone-2016f-0.22.1 timezone-debuginfo-2016f-0.22.1 timezone-debugsource-2016f-0.22.1 - openSUSE Leap 42.1 (noarch): timezone-java-2016f-0.22.1 - openSUSE 13.2 (i586 x86_64): timezone-2016f-49.1 timezone-debuginfo-2016f-49.1 timezone-debugsource-2016f-49.1 - openSUSE 13.2 (noarch): timezone-java-2016f-49.1 References: https://bugzilla.suse.com/987720

1 0

openSUSE-RU-2016:1751-1: Recommended update for clamav-database
by maintenance＠opensuse.org 07 Jul '16

07 Jul '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1751-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh July 4, 2016 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-842=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201607040002-121.1 References:

1 0

openSUSE-SU-2016:1750-1: important: Security update for qemu
by opensuse-security＠opensuse.org 06 Jul '16

06 Jul '16

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1750-1 Rating: important References: #886378 #940929 #958491 #958917 #959005 #959386 #960334 #960708 #960725 #960835 #961332 #961333 #961358 #961556 #961691 #962320 #963782 #964411 #964413 #967969 #969121 #969122 #969350 #970036 #970037 #975128 #975136 #975700 #976109 #978158 #978160 #980711 #980723 #981266 Cross-References: CVE-2015-5745 CVE-2015-7549 CVE-2015-8504 CVE-2015-8558 CVE-2015-8567 CVE-2015-8568 CVE-2015-8613 CVE-2015-8619 CVE-2015-8743 CVE-2015-8744 CVE-2015-8745 CVE-2015-8817 CVE-2015-8818 CVE-2016-1568 CVE-2016-1714 CVE-2016-1922 CVE-2016-1981 CVE-2016-2197 CVE-2016-2198 CVE-2016-2538 CVE-2016-2841 CVE-2016-2857 CVE-2016-2858 CVE-2016-3710 CVE-2016-3712 CVE-2016-4001 CVE-2016-4002 CVE-2016-4020 CVE-2016-4037 CVE-2016-4439 CVE-2016-4441 CVE-2016-4952 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 32 vulnerabilities and has two fixes is now available. Description: qemu was updated to fix 29 security issues. These security issues were fixed: - CVE-2016-4439: Avoid OOB access in 53C9X emulation (bsc#980711) - CVE-2016-4441: Avoid OOB access in 53C9X emulation (bsc#980723) - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation (bsc#981266) - CVE-2015-8817: Avoid OOB access in PCI dma I/O (bsc#969121) - CVE-2015-8818: Avoid OOB access in PCI dma I/O (bsc#969122) - CVE-2016-3710: Fixed VGA emulation based OOB access with potential for guest escape (bsc#978158) - CVE-2016-3712: Fixed VGa emulation based DOS and OOB read access exploit (bsc#978160) - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109) - CVE-2016-2538: Fixed potential OOB access in USB net device emulation (bsc#967969) - CVE-2016-2841: Fixed OOB access / hang in ne2000 emulation (bsc#969350) - CVE-2016-2858: Avoid potential DOS when using QEMU pseudo random number generator (bsc#970036) - CVE-2016-2857: Fixed OOB access when processing IP checksums (bsc#970037) - CVE-2016-4001: Fixed OOB access in Stellaris enet emulated nic (bsc#975128) - CVE-2016-4002: Fixed OOB access in MIPSnet emulated controller (bsc#975136) - CVE-2016-4020: Fixed possible host data leakage to guest from TPR access (bsc#975700) - CVE-2016-2197: Prevent AHCI NULL pointer dereference when using FIS CLB engine (bsc#964411) - CVE-2015-5745: Buffer overflow in virtio-serial (bsc#940929). - CVE-2015-7549: PCI null pointer dereferences (bsc#958917). - CVE-2015-8504: VNC floating point exception (bsc#958491). - CVE-2015-8558: Infinite loop in ehci_advance_state resulting in DoS (bsc#959005). - CVE-2015-8567: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386). - CVE-2015-8568: A guest repeatedly activating a vmxnet3 device can leak host memory (bsc#959386). - CVE-2015-8613: Wrong sized memset in megasas command handler (bsc#961358). - CVE-2015-8619: Potential DoS for long HMP sendkey command argument (bsc#960334). - CVE-2015-8743: OOB memory access in ne2000 ioport r/w functions (bsc#960725). - CVE-2015-8744: Incorrect l2 header validation could have lead to a crash via assert(2) call (bsc#960835). - CVE-2015-8745: Reading IMR registers could have lead to a crash via assert(2) call (bsc#960708). - CVE-2016-1568: AHCI use-after-free in aio port commands (bsc#961332). - CVE-2016-1714: Potential OOB memory access in processing firmware configuration (bsc#961691). - CVE-2016-1922: NULL pointer dereference when processing hmp i/o command (bsc#962320). - CVE-2016-1981: Potential DoS (infinite loop) in e1000 device emulation by malicious privileged user within guest (bsc#963782). - CVE-2016-2198: Malicious privileged guest user were able to cause DoS by writing to read-only EHCI capabilities registers (bsc#964413). This non-security issue was fixed - bsc#886378: qemu truncates vhd images in virt-rescue This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-839=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): qemu-2.3.1-15.1 qemu-arm-2.3.1-15.1 qemu-arm-debuginfo-2.3.1-15.1 qemu-block-curl-2.3.1-15.1 qemu-block-curl-debuginfo-2.3.1-15.1 qemu-debugsource-2.3.1-15.1 qemu-extra-2.3.1-15.1 qemu-extra-debuginfo-2.3.1-15.1 qemu-guest-agent-2.3.1-15.1 qemu-guest-agent-debuginfo-2.3.1-15.1 qemu-kvm-2.3.1-15.1 qemu-lang-2.3.1-15.1 qemu-linux-user-2.3.1-15.1 qemu-linux-user-debuginfo-2.3.1-15.1 qemu-linux-user-debugsource-2.3.1-15.1 qemu-ppc-2.3.1-15.1 qemu-ppc-debuginfo-2.3.1-15.1 qemu-s390-2.3.1-15.1 qemu-s390-debuginfo-2.3.1-15.1 qemu-tools-2.3.1-15.1 qemu-tools-debuginfo-2.3.1-15.1 qemu-x86-2.3.1-15.1 qemu-x86-debuginfo-2.3.1-15.1 - openSUSE Leap 42.1 (noarch): qemu-ipxe-1.0.0-15.1 qemu-seabios-1.8.1-15.1 qemu-sgabios-8-15.1 qemu-vgabios-1.8.1-15.1 - openSUSE Leap 42.1 (x86_64): qemu-block-rbd-2.3.1-15.1 qemu-block-rbd-debuginfo-2.3.1-15.1 qemu-testsuite-2.3.1-15.2 References: https://www.suse.com/security/cve/CVE-2015-5745.html https://www.suse.com/security/cve/CVE-2015-7549.html https://www.suse.com/security/cve/CVE-2015-8504.html https://www.suse.com/security/cve/CVE-2015-8558.html https://www.suse.com/security/cve/CVE-2015-8567.html https://www.suse.com/security/cve/CVE-2015-8568.html https://www.suse.com/security/cve/CVE-2015-8613.html https://www.suse.com/security/cve/CVE-2015-8619.html https://www.suse.com/security/cve/CVE-2015-8743.html https://www.suse.com/security/cve/CVE-2015-8744.html https://www.suse.com/security/cve/CVE-2015-8745.html https://www.suse.com/security/cve/CVE-2015-8817.html https://www.suse.com/security/cve/CVE-2015-8818.html https://www.suse.com/security/cve/CVE-2016-1568.html https://www.suse.com/security/cve/CVE-2016-1714.html https://www.suse.com/security/cve/CVE-2016-1922.html https://www.suse.com/security/cve/CVE-2016-1981.html https://www.suse.com/security/cve/CVE-2016-2197.html https://www.suse.com/security/cve/CVE-2016-2198.html https://www.suse.com/security/cve/CVE-2016-2538.html https://www.suse.com/security/cve/CVE-2016-2841.html https://www.suse.com/security/cve/CVE-2016-2857.html https://www.suse.com/security/cve/CVE-2016-2858.html https://www.suse.com/security/cve/CVE-2016-3710.html https://www.suse.com/security/cve/CVE-2016-3712.html https://www.suse.com/security/cve/CVE-2016-4001.html https://www.suse.com/security/cve/CVE-2016-4002.html https://www.suse.com/security/cve/CVE-2016-4020.html https://www.suse.com/security/cve/CVE-2016-4037.html https://www.suse.com/security/cve/CVE-2016-4439.html https://www.suse.com/security/cve/CVE-2016-4441.html https://www.suse.com/security/cve/CVE-2016-4952.html https://bugzilla.suse.com/886378 https://bugzilla.suse.com/940929 https://bugzilla.suse.com/958491 https://bugzilla.suse.com/958917 https://bugzilla.suse.com/959005 https://bugzilla.suse.com/959386 https://bugzilla.suse.com/960334 https://bugzilla.suse.com/960708 https://bugzilla.suse.com/960725 https://bugzilla.suse.com/960835 https://bugzilla.suse.com/961332 https://bugzilla.suse.com/961333 https://bugzilla.suse.com/961358 https://bugzilla.suse.com/961556 https://bugzilla.suse.com/961691 https://bugzilla.suse.com/962320 https://bugzilla.suse.com/963782 https://bugzilla.suse.com/964411 https://bugzilla.suse.com/964413 https://bugzilla.suse.com/967969 https://bugzilla.suse.com/969121 https://bugzilla.suse.com/969122 https://bugzilla.suse.com/969350 https://bugzilla.suse.com/970036 https://bugzilla.suse.com/970037 https://bugzilla.suse.com/975128 https://bugzilla.suse.com/975136 https://bugzilla.suse.com/975700 https://bugzilla.suse.com/976109 https://bugzilla.suse.com/978158 https://bugzilla.suse.com/978160 https://bugzilla.suse.com/980711 https://bugzilla.suse.com/980723 https://bugzilla.suse.com/981266

1 0