July 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:1890-1: moderate: Recommended update for python-requests
by maintenance＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Recommended Update: Recommended update for python-requests ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1890-1 Rating: moderate References: #989371 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-requests fixes the following issues: - Use verification based on openSUSE's default CA bundle for HTTPS requests. (boo#989371) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-905=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python-requests-2.4.1-3.1 References: https://bugzilla.suse.com/989371

1 0

openSUSE-SU-2016:1889-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1889-1 Rating: moderate References: #964225 #984808 #984831 #984837 #984842 #987351 Cross-References: CVE-2016-5314 CVE-2016-5316 CVE-2016-5317 CVE-2016-5320 CVE-2016-5875 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-5314: Fixed an out-of-bounds write in PixarLogDecode() function (boo#984831) - CVE-2016-5316: Fixed an out-of-bounds read in PixarLogCleanup() function in tif_pixarlog.c (boo#984837) - CVE-2016-5317: Fixed an out-of-bounds write in PixarLogDecode() function in libtiff.so (boo#984842) - CVE-2016-5320: Fixed an out-of-bounds write in PixarLogDecode() function in tif_pixarlog.c (boo#984808) - CVE-2016-5875: Fixed a heap-based buffer overflow when using the PixarLog compressionformat (boo#987351) Bugs fixed: - boo#964225: Fixed writes for invalid images (upstream bug #2522) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-911=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libtiff-devel-4.0.6-10.26.1 libtiff5-4.0.6-10.26.1 libtiff5-debuginfo-4.0.6-10.26.1 tiff-4.0.6-10.26.1 tiff-debuginfo-4.0.6-10.26.1 tiff-debugsource-4.0.6-10.26.1 - openSUSE 13.2 (x86_64): libtiff-devel-32bit-4.0.6-10.26.1 libtiff5-32bit-4.0.6-10.26.1 libtiff5-debuginfo-32bit-4.0.6-10.26.1 References: https://www.suse.com/security/cve/CVE-2016-5314.html https://www.suse.com/security/cve/CVE-2016-5316.html https://www.suse.com/security/cve/CVE-2016-5317.html https://www.suse.com/security/cve/CVE-2016-5320.html https://www.suse.com/security/cve/CVE-2016-5875.html https://bugzilla.suse.com/964225 https://bugzilla.suse.com/984808 https://bugzilla.suse.com/984831 https://bugzilla.suse.com/984837 https://bugzilla.suse.com/984842 https://bugzilla.suse.com/987351

1 0

openSUSE-RU-2016:1888-1: Recommended update for cloud-init
by maintenance＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Recommended Update: Recommended update for cloud-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1888-1 Rating: low References: #903449 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cloud-init fixes the following issues: - Restore SIGPIPE default handler when executing shell scripts (bsc#903449) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-908=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): cloud-init-0.7.6-26.1 cloud-init-doc-0.7.6-26.1 cloud-init-test-0.7.6-26.1 References: https://bugzilla.suse.com/903449

1 0

openSUSE-RU-2016:1886-1: Recommended update for android-tools
by maintenance＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Recommended Update: Recommended update for android-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1886-1 Rating: low References: #965512 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for android-tools fixes the following issues: - updated 51-android.rules with missing EOL as it would make HUAWEI devices with device ID 19d2 not to be recognized (boo#965512) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-910=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): android-tools-5.1.1_r8-5.1 android-tools-debuginfo-5.1.1_r8-5.1 android-tools-debugsource-5.1.1_r8-5.1 References: https://bugzilla.suse.com/965512

1 0

openSUSE-SU-2016:1885-1: moderate: Security update for python
by opensuse-security＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1885-1 Rating: moderate References: #964182 #984751 #985177 #985348 Cross-References: CVE-2016-0772 CVE-2016-5636 CVE-2016-5699 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: Python was updated to fix three security issues. The following vulnerabilities were fixed: - CVE-2016-0772: TLS stripping attack on smtplib (bsc#984751) - CVE-2016-5636: zipimporter heap overflow (bsc#985177) - CVE-2016-5699: httplib header injection (bsc#985348) This update also includes all upstream bug fixes and improvements in Python 2.7.12. It also includes the following packaging changes: - reintroduce support for CA directory path The following tracked packaging issues were fixed: - broken overflow checks (bsc#964182) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-906=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-906=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libpython2_7-1_0-2.7.12-23.1 libpython2_7-1_0-debuginfo-2.7.12-23.1 python-2.7.12-23.1 python-base-2.7.12-23.1 python-base-debuginfo-2.7.12-23.1 python-base-debugsource-2.7.12-23.1 python-curses-2.7.12-23.1 python-curses-debuginfo-2.7.12-23.1 python-debuginfo-2.7.12-23.1 python-debugsource-2.7.12-23.1 python-demo-2.7.12-23.1 python-devel-2.7.12-23.1 python-gdbm-2.7.12-23.1 python-gdbm-debuginfo-2.7.12-23.1 python-idle-2.7.12-23.1 python-tk-2.7.12-23.1 python-tk-debuginfo-2.7.12-23.1 python-xml-2.7.12-23.1 python-xml-debuginfo-2.7.12-23.1 - openSUSE Leap 42.1 (noarch): python-doc-2.7.12-23.1 python-doc-pdf-2.7.12-23.1 - openSUSE Leap 42.1 (x86_64): libpython2_7-1_0-32bit-2.7.12-23.1 libpython2_7-1_0-debuginfo-32bit-2.7.12-23.1 python-32bit-2.7.12-23.1 python-base-32bit-2.7.12-23.1 python-base-debuginfo-32bit-2.7.12-23.1 python-debuginfo-32bit-2.7.12-23.1 - openSUSE 13.2 (i586 x86_64): libpython2_7-1_0-2.7.12-3.1 libpython2_7-1_0-debuginfo-2.7.12-3.1 python-2.7.12-3.1 python-base-2.7.12-3.1 python-base-debuginfo-2.7.12-3.1 python-base-debugsource-2.7.12-3.1 python-curses-2.7.12-3.1 python-curses-debuginfo-2.7.12-3.1 python-debuginfo-2.7.12-3.1 python-debugsource-2.7.12-3.1 python-demo-2.7.12-3.1 python-devel-2.7.12-3.1 python-gdbm-2.7.12-3.1 python-gdbm-debuginfo-2.7.12-3.1 python-idle-2.7.12-3.1 python-tk-2.7.12-3.1 python-tk-debuginfo-2.7.12-3.1 python-xml-2.7.12-3.1 python-xml-debuginfo-2.7.12-3.1 - openSUSE 13.2 (noarch): python-doc-2.7.12-3.1 python-doc-pdf-2.7.12-3.1 - openSUSE 13.2 (x86_64): libpython2_7-1_0-32bit-2.7.12-3.1 libpython2_7-1_0-debuginfo-32bit-2.7.12-3.1 python-32bit-2.7.12-3.1 python-base-32bit-2.7.12-3.1 python-base-debuginfo-32bit-2.7.12-3.1 python-debuginfo-32bit-2.7.12-3.1 References: https://www.suse.com/security/cve/CVE-2016-0772.html https://www.suse.com/security/cve/CVE-2016-5636.html https://www.suse.com/security/cve/CVE-2016-5699.html https://bugzilla.suse.com/964182 https://bugzilla.suse.com/984751 https://bugzilla.suse.com/985177 https://bugzilla.suse.com/985348

1 0

openSUSE-SU-2016:1884-1: important: Security update for karchive
by opensuse-security＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Security Update: Security update for karchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1884-1 Rating: important References: #989698 Cross-References: CVE-2016-6232 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for karchive fixes the following issues: - CVE-2016-6232: A remote attacker could have been able to overwrite arbitrary files when tricking the user into downloading KDE extras such as wallpapers or Plasma Applets (boo#989698) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-904=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-904=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): karchive-debugsource-5.21.0-15.1 karchive-devel-5.21.0-15.1 libKF5Archive5-5.21.0-15.1 libKF5Archive5-debuginfo-5.21.0-15.1 - openSUSE Leap 42.1 (x86_64): karchive-devel-32bit-5.21.0-15.1 libKF5Archive5-32bit-5.21.0-15.1 libKF5Archive5-debuginfo-32bit-5.21.0-15.1 - openSUSE 13.2 (i586 x86_64): karchive-debugsource-5.11.0-27.1 karchive-devel-5.11.0-27.1 libKF5Archive5-5.11.0-27.1 libKF5Archive5-debuginfo-5.11.0-27.1 - openSUSE 13.2 (x86_64): karchive-devel-32bit-5.11.0-27.1 libKF5Archive5-32bit-5.11.0-27.1 libKF5Archive5-debuginfo-32bit-5.11.0-27.1 References: https://www.suse.com/security/cve/CVE-2016-6232.html https://bugzilla.suse.com/989698

1 0

openSUSE-RU-2016:1874-1: moderate: Recommended update for firebird
by maintenance＠opensuse.org 26 Jul '16

26 Jul '16

openSUSE Recommended Update: Recommended update for firebird ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1874-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update provides version 2.5.6 for firebird: - update to upstream 2.5.6 point release * numerous bugfixes, including server crashes and hangs; for full list, see http://www.firebirdsql.org/file/documentation/release_notes/html/en/2_5/bug -253.html http://www.firebirdsql.org/file/documentation/release_notes/html/en/2_5/bug -254.html http://www.firebirdsql.org/file/documentation/release_notes/html/en/2_5/bug -255.html http://www.firebirdsql.org/file/documentation/release_notes/html/en/2_5/rnf b25-bug.html#bug-256 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-902=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-902=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): firebird-2.5.6.27020-7.1 firebird-classic-2.5.6.27020-7.1 firebird-classic-debuginfo-2.5.6.27020-7.1 firebird-classic-debugsource-2.5.6.27020-7.1 firebird-debuginfo-2.5.6.27020-7.1 firebird-debugsource-2.5.6.27020-7.1 firebird-devel-2.5.6.27020-7.1 firebird-superserver-2.5.6.27020-7.1 firebird-superserver-debuginfo-2.5.6.27020-7.1 libfbclient2-2.5.6.27020-7.1 libfbclient2-debuginfo-2.5.6.27020-7.1 libfbclient2-devel-2.5.6.27020-7.1 libfbembed-devel-2.5.6.27020-7.1 libfbembed2_5-2.5.6.27020-7.1 libfbembed2_5-debuginfo-2.5.6.27020-7.1 - openSUSE Leap 42.1 (noarch): firebird-doc-2.5.6.27020-7.1 - openSUSE Leap 42.1 (x86_64): firebird-32bit-2.5.6.27020-7.1 firebird-debuginfo-32bit-2.5.6.27020-7.1 libfbclient2-32bit-2.5.6.27020-7.1 libfbclient2-debuginfo-32bit-2.5.6.27020-7.1 libfbembed2_5-32bit-2.5.6.27020-7.1 libfbembed2_5-debuginfo-32bit-2.5.6.27020-7.1 - openSUSE 13.2 (i586 x86_64): firebird-2.5.6.27020-14.7.1 firebird-classic-2.5.6.27020-14.7.1 firebird-classic-debuginfo-2.5.6.27020-14.7.1 firebird-classic-debugsource-2.5.6.27020-14.7.1 firebird-debuginfo-2.5.6.27020-14.7.1 firebird-debugsource-2.5.6.27020-14.7.1 firebird-devel-2.5.6.27020-14.7.1 firebird-superserver-2.5.6.27020-14.7.1 firebird-superserver-debuginfo-2.5.6.27020-14.7.1 libfbclient2-2.5.6.27020-14.7.1 libfbclient2-debuginfo-2.5.6.27020-14.7.1 libfbclient2-devel-2.5.6.27020-14.7.1 libfbembed-devel-2.5.6.27020-14.7.1 libfbembed2_5-2.5.6.27020-14.7.1 libfbembed2_5-debuginfo-2.5.6.27020-14.7.1 - openSUSE 13.2 (noarch): firebird-doc-2.5.6.27020-14.7.1 - openSUSE 13.2 (x86_64): firebird-32bit-2.5.6.27020-14.7.1 firebird-debuginfo-32bit-2.5.6.27020-14.7.1 libfbclient2-32bit-2.5.6.27020-14.7.1 libfbclient2-debuginfo-32bit-2.5.6.27020-14.7.1 libfbembed2_5-32bit-2.5.6.27020-14.7.1 libfbembed2_5-debuginfo-32bit-2.5.6.27020-14.7.1 References:

1 0

openSUSE-SU-2016:1869-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 25 Jul '16

25 Jul '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1869-1 Rating: important References: #989901 Cross-References: CVE-2016-1705 CVE-2016-1706 CVE-2016-1707 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901): - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-900=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): chromedriver-52.0.2743.82-61.1 chromium-52.0.2743.82-61.1 chromium-desktop-gnome-52.0.2743.82-61.1 chromium-desktop-kde-52.0.2743.82-61.1 chromium-ffmpegsumo-52.0.2743.82-61.1 References: https://www.suse.com/security/cve/CVE-2016-1705.html https://www.suse.com/security/cve/CVE-2016-1706.html https://www.suse.com/security/cve/CVE-2016-1707.html https://www.suse.com/security/cve/CVE-2016-1708.html https://www.suse.com/security/cve/CVE-2016-1709.html https://www.suse.com/security/cve/CVE-2016-1710.html https://www.suse.com/security/cve/CVE-2016-1711.html https://www.suse.com/security/cve/CVE-2016-5127.html https://www.suse.com/security/cve/CVE-2016-5128.html https://www.suse.com/security/cve/CVE-2016-5129.html https://www.suse.com/security/cve/CVE-2016-5130.html https://www.suse.com/security/cve/CVE-2016-5131.html https://www.suse.com/security/cve/CVE-2016-5132.html https://www.suse.com/security/cve/CVE-2016-5133.html https://www.suse.com/security/cve/CVE-2016-5134.html https://www.suse.com/security/cve/CVE-2016-5135.html https://www.suse.com/security/cve/CVE-2016-5136.html https://www.suse.com/security/cve/CVE-2016-5137.html https://bugzilla.suse.com/989901

1 0

openSUSE-SU-2016:1868-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 25 Jul '16

25 Jul '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1868-1 Rating: important References: #989901 Cross-References: CVE-2016-1705 CVE-2016-1706 CVE-2016-1707 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901): - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-900=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-52.0.2743.82-89.1 chromedriver-debuginfo-52.0.2743.82-89.1 chromium-52.0.2743.82-89.1 chromium-debuginfo-52.0.2743.82-89.1 chromium-debugsource-52.0.2743.82-89.1 chromium-desktop-gnome-52.0.2743.82-89.1 chromium-desktop-kde-52.0.2743.82-89.1 chromium-ffmpegsumo-52.0.2743.82-89.1 chromium-ffmpegsumo-debuginfo-52.0.2743.82-89.1 References: https://www.suse.com/security/cve/CVE-2016-1705.html https://www.suse.com/security/cve/CVE-2016-1706.html https://www.suse.com/security/cve/CVE-2016-1707.html https://www.suse.com/security/cve/CVE-2016-1708.html https://www.suse.com/security/cve/CVE-2016-1709.html https://www.suse.com/security/cve/CVE-2016-1710.html https://www.suse.com/security/cve/CVE-2016-1711.html https://www.suse.com/security/cve/CVE-2016-5127.html https://www.suse.com/security/cve/CVE-2016-5128.html https://www.suse.com/security/cve/CVE-2016-5129.html https://www.suse.com/security/cve/CVE-2016-5130.html https://www.suse.com/security/cve/CVE-2016-5131.html https://www.suse.com/security/cve/CVE-2016-5132.html https://www.suse.com/security/cve/CVE-2016-5133.html https://www.suse.com/security/cve/CVE-2016-5134.html https://www.suse.com/security/cve/CVE-2016-5135.html https://www.suse.com/security/cve/CVE-2016-5136.html https://www.suse.com/security/cve/CVE-2016-5137.html https://bugzilla.suse.com/989901

1 0

openSUSE-SU-2016:1865-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 25 Jul '16

25 Jul '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1865-1 Rating: important References: #989901 Cross-References: CVE-2016-1705 CVE-2016-1706 CVE-2016-1707 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901): - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-901=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-52.0.2743.82-111.1 chromium-52.0.2743.82-111.1 chromium-desktop-gnome-52.0.2743.82-111.1 chromium-desktop-kde-52.0.2743.82-111.1 chromium-ffmpegsumo-52.0.2743.82-111.1 - openSUSE 13.2 (x86_64): chromedriver-debuginfo-52.0.2743.82-111.1 chromium-debuginfo-52.0.2743.82-111.1 chromium-debugsource-52.0.2743.82-111.1 chromium-ffmpegsumo-debuginfo-52.0.2743.82-111.1 References: https://www.suse.com/security/cve/CVE-2016-1705.html https://www.suse.com/security/cve/CVE-2016-1706.html https://www.suse.com/security/cve/CVE-2016-1707.html https://www.suse.com/security/cve/CVE-2016-1708.html https://www.suse.com/security/cve/CVE-2016-1709.html https://www.suse.com/security/cve/CVE-2016-1710.html https://www.suse.com/security/cve/CVE-2016-1711.html https://www.suse.com/security/cve/CVE-2016-5127.html https://www.suse.com/security/cve/CVE-2016-5128.html https://www.suse.com/security/cve/CVE-2016-5129.html https://www.suse.com/security/cve/CVE-2016-5130.html https://www.suse.com/security/cve/CVE-2016-5131.html https://www.suse.com/security/cve/CVE-2016-5132.html https://www.suse.com/security/cve/CVE-2016-5133.html https://www.suse.com/security/cve/CVE-2016-5134.html https://www.suse.com/security/cve/CVE-2016-5135.html https://www.suse.com/security/cve/CVE-2016-5136.html https://www.suse.com/security/cve/CVE-2016-5137.html https://bugzilla.suse.com/989901

1 0