July 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:1849-1: important: Recommended update for the Linux kernel
by maintenance＠opensuse.org 21 Jul '16

21 Jul '16

openSUSE Recommended Update: Recommended update for the Linux kernel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1849-1 Rating: important References: #987990 #989084 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes a regression introduced in a previous update to the Linux kernel. The following issues were fixed: * Regression in 4.1.27 affecting ecryptfs (boo#989084) The update also contains the VirtualBox kernel module package re-built to match the updated Linux kernel. (boo#987990) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-889=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.27-27.1 kernel-default-base-4.1.27-27.1 kernel-default-base-debuginfo-4.1.27-27.1 kernel-default-debuginfo-4.1.27-27.1 kernel-default-debugsource-4.1.27-27.1 kernel-default-devel-4.1.27-27.1 kernel-obs-build-4.1.27-27.2 kernel-obs-build-debugsource-4.1.27-27.2 kernel-obs-qa-4.1.27-27.1 kernel-obs-qa-xen-4.1.27-27.1 kernel-syms-4.1.27-27.1 - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.27-27.1 kernel-debug-base-4.1.27-27.1 kernel-debug-base-debuginfo-4.1.27-27.1 kernel-debug-debuginfo-4.1.27-27.1 kernel-debug-debugsource-4.1.27-27.1 kernel-debug-devel-4.1.27-27.1 kernel-debug-devel-debuginfo-4.1.27-27.1 kernel-ec2-4.1.27-27.1 kernel-ec2-base-4.1.27-27.1 kernel-ec2-base-debuginfo-4.1.27-27.1 kernel-ec2-debuginfo-4.1.27-27.1 kernel-ec2-debugsource-4.1.27-27.1 kernel-ec2-devel-4.1.27-27.1 kernel-pv-4.1.27-27.1 kernel-pv-base-4.1.27-27.1 kernel-pv-base-debuginfo-4.1.27-27.1 kernel-pv-debuginfo-4.1.27-27.1 kernel-pv-debugsource-4.1.27-27.1 kernel-pv-devel-4.1.27-27.1 kernel-vanilla-4.1.27-27.1 kernel-vanilla-debuginfo-4.1.27-27.1 kernel-vanilla-debugsource-4.1.27-27.1 kernel-vanilla-devel-4.1.27-27.1 kernel-xen-4.1.27-27.1 kernel-xen-base-4.1.27-27.1 kernel-xen-base-debuginfo-4.1.27-27.1 kernel-xen-debuginfo-4.1.27-27.1 kernel-xen-debugsource-4.1.27-27.1 kernel-xen-devel-4.1.27-27.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.27-27.1 kernel-docs-4.1.27-27.2 kernel-docs-html-4.1.27-27.2 kernel-docs-pdf-4.1.27-27.2 kernel-macros-4.1.27-27.1 kernel-source-4.1.27-27.1 kernel-source-vanilla-4.1.27-27.1 virtualbox-guest-desktop-icons-5.0.24-25.1 virtualbox-host-source-5.0.24-25.1 - openSUSE Leap 42.1 (x86_64): python-virtualbox-5.0.24-25.1 python-virtualbox-debuginfo-5.0.24-25.1 virtualbox-5.0.24-25.1 virtualbox-debuginfo-5.0.24-25.1 virtualbox-debugsource-5.0.24-25.1 virtualbox-devel-5.0.24-25.1 virtualbox-guest-kmp-default-5.0.24_k4.1.27_27-25.1 virtualbox-guest-kmp-default-debuginfo-5.0.24_k4.1.27_27-25.1 virtualbox-guest-tools-5.0.24-25.1 virtualbox-guest-tools-debuginfo-5.0.24-25.1 virtualbox-guest-x11-5.0.24-25.1 virtualbox-guest-x11-debuginfo-5.0.24-25.1 virtualbox-host-kmp-default-5.0.24_k4.1.27_27-25.1 virtualbox-host-kmp-default-debuginfo-5.0.24_k4.1.27_27-25.1 virtualbox-qt-5.0.24-25.1 virtualbox-qt-debuginfo-5.0.24-25.1 virtualbox-websrv-5.0.24-25.1 virtualbox-websrv-debuginfo-5.0.24-25.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.27-27.1 kernel-pae-base-4.1.27-27.1 kernel-pae-base-debuginfo-4.1.27-27.1 kernel-pae-debuginfo-4.1.27-27.1 kernel-pae-debugsource-4.1.27-27.1 kernel-pae-devel-4.1.27-27.1 References: https://bugzilla.suse.com/987990 https://bugzilla.suse.com/989084

1 0

openSUSE-OU-2016:1845-1: Optional update for fwts
by maintenance＠opensuse.org 21 Jul '16

21 Jul '16

openSUSE Optional Update: Optional update for fwts ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:1845-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds fwts to the SLE-12 Package Hub Project. The FirmWare Test Suite (fwts) is a tool to do automatic testing of a PC's firmware. There can be a lot of subtle or vexing Linux Kernel/firmware issues caused when firmware is buggy, so it's useful to have a tool that can automatically check for common BIOS and ACPI errors. Where possible the tool will give some form of advice on how to fix issues or workaround firmware issues. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-888=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): fwts-16.06.00-2.1 References:

1 0

openSUSE-SU-2016:1843-1: moderate: Security update for dhcp
by opensuse-security＠opensuse.org 21 Jul '16

21 Jul '16

openSUSE Security Update: Security update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1843-1 Rating: moderate References: #969820 #972907 Cross-References: CVE-2016-2774 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for dhcp fixes the following issues: Security issue fixed: - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional (bsc#969820). Non security issues fixed: - Rename freeaddrinfo(), getaddrinfo() and getnameinfo() in the internal libirs library that does not consider /etc/hosts and /etc/nsswitch.conf to use irs_ prefix. This prevents name conflicts which would result in overriding standard glibc functions used by libldap. (bsc#972907) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-887=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dhcp-4.3.3-7.1 dhcp-client-4.3.3-7.1 dhcp-client-debuginfo-4.3.3-7.1 dhcp-debuginfo-4.3.3-7.1 dhcp-debugsource-4.3.3-7.1 dhcp-devel-4.3.3-7.1 dhcp-doc-4.3.3-7.1 dhcp-relay-4.3.3-7.1 dhcp-relay-debuginfo-4.3.3-7.1 dhcp-server-4.3.3-7.1 dhcp-server-debuginfo-4.3.3-7.1 References: https://www.suse.com/security/cve/CVE-2016-2774.html https://bugzilla.suse.com/969820 https://bugzilla.suse.com/972907

1 0

openSUSE-RU-2016:1840-1: Recommended update for R-base
by maintenance＠opensuse.org 20 Jul '16

20 Jul '16

openSUSE Recommended Update: Recommended update for R-base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1840-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides R-base 3.2.5 for the Backports SLE12 project. After it includes downgrades of some packages, you need to install the update with: 'zypper in R-base=3.2.5 R-cluster=2.0.3 R-nlme=3.1.125 R-spatial=2.38.3' Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-886=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): R-KernSmooth-2.23.15-5.1 R-MASS-7.3.45-5.1 R-Matrix-1.2.4-5.1 R-Matrix-devel-1.2.4-5.1 R-base-3.2.5-5.1 R-base-devel-3.2.5-5.1 R-boot-1.3.18-5.1 R-class-7.3.14-5.1 R-cluster-2.0.3-5.1 R-codetools-0.2.14-5.1 R-compiler-3.2.5-5.1 R-core-3.2.5-5.1 R-core-devel-3.2.5-5.1 R-core-doc-3.2.5-5.1 R-core-libs-3.2.5-5.1 R-core-packages-3.2.5-5.1 R-datasets-3.2.5-5.1 R-foreign-0.8.66-5.1 R-grDevices-3.2.5-5.1 R-graphics-3.2.5-5.1 R-grid-3.2.5-5.1 R-lattice-0.20.33-5.1 R-methods-3.2.5-5.1 R-mgcv-1.8.12-5.1 R-nlme-3.1.125-5.1 R-nnet-7.3.12-5.1 R-parallel-3.2.5-5.1 R-recommended-packages-3.2.5-5.1 R-rpart-4.1.10-5.1 R-spatial-7.3.11-5.1 R-splines-3.2.5-5.1 R-stats-3.2.5-5.1 R-stats4-3.2.5-5.1 R-survival-2.38.3-5.1 R-tcltk-3.2.5-5.1 R-tools-3.2.5-5.1 R-utils-3.2.5-5.1 References:

1 0

openSUSE-OU-2016:1835-1: Optional update for lzip, mbedtls
by maintenance＠opensuse.org 20 Jul '16

20 Jul '16

openSUSE Optional Update: Optional update for lzip, mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-OU-2016:1835-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This optional update adds lzip and mbedtls to the SLE 12 Backports Project. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-885=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libmbedtls9-1.3.17-2.1 libmbedtls9-debuginfo-1.3.17-2.1 lzip-1.18-2.1 mbedtls-debugsource-1.3.17-2.1 mbedtls-devel-1.3.17-2.1 References:

1 0

openSUSE-SU-2016:1834-1: moderate: Security update for nodejs
by opensuse-security＠opensuse.org 20 Jul '16

20 Jul '16

openSUSE Security Update: Security update for nodejs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1834-1 Rating: moderate References: #987919 Cross-References: CVE-2016-1669 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs fixes the following issue: - CVE-2016-1669: * fix buffer overflow in v8 (boo#987919) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-884=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-884=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nodejs-4.4.5-30.2 nodejs-debuginfo-4.4.5-30.2 nodejs-debugsource-4.4.5-30.2 nodejs-devel-4.4.5-30.2 npm-4.4.5-30.2 - openSUSE Leap 42.1 (noarch): nodejs-docs-4.4.5-30.2 - openSUSE 13.2 (i586 x86_64): nodejs-4.4.5-21.1 nodejs-debuginfo-4.4.5-21.1 nodejs-debugsource-4.4.5-21.1 nodejs-devel-4.4.5-21.1 - openSUSE 13.2 (noarch): nodejs-doc-4.4.5-21.1 References: https://www.suse.com/security/cve/CVE-2016-1669.html https://bugzilla.suse.com/987919

1 0

openSUSE-SU-2016:1833-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 20 Jul '16

20 Jul '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1833-1 Rating: important References: #983232 #983234 #983253 #983259 #983292 #983305 #983308 #983521 #983523 #983527 #983533 #983739 #983746 #983752 #983774 #983794 #983796 #983799 #983803 #984014 #984018 #984023 #984028 #984032 #984035 #984135 #984137 #984142 #984144 #984145 #984149 #984150 #984160 #984166 #984172 #984179 #984181 #984183 #984184 #984185 #984186 #984187 #984191 #984193 #984370 #984372 #984373 #984374 #984375 #984379 #984394 #984398 #984400 #984401 #984404 #984406 #984408 #984409 #984427 #984433 #984436 #985442 #985448 #985451 #985456 #985460 #986608 #986609 Cross-References: CVE-2014-9805 CVE-2014-9806 CVE-2014-9807 CVE-2014-9808 CVE-2014-9809 CVE-2014-9810 CVE-2014-9811 CVE-2014-9812 CVE-2014-9813 CVE-2014-9814 CVE-2014-9815 CVE-2014-9816 CVE-2014-9817 CVE-2014-9818 CVE-2014-9819 CVE-2014-9820 CVE-2014-9821 CVE-2014-9822 CVE-2014-9823 CVE-2014-9824 CVE-2014-9825 CVE-2014-9826 CVE-2014-9828 CVE-2014-9829 CVE-2014-9830 CVE-2014-9831 CVE-2014-9832 CVE-2014-9833 CVE-2014-9834 CVE-2014-9835 CVE-2014-9836 CVE-2014-9837 CVE-2014-9838 CVE-2014-9839 CVE-2014-9840 CVE-2014-9841 CVE-2014-9842 CVE-2014-9843 CVE-2014-9844 CVE-2014-9845 CVE-2014-9846 CVE-2014-9847 CVE-2014-9848 CVE-2014-9849 CVE-2014-9850 CVE-2014-9851 CVE-2014-9852 CVE-2014-9853 CVE-2014-9854 CVE-2015-8894 CVE-2015-8895 CVE-2015-8896 CVE-2015-8897 CVE-2015-8898 CVE-2015-8900 CVE-2015-8901 CVE-2015-8902 CVE-2015-8903 CVE-2016-4562 CVE-2016-4563 CVE-2016-4564 CVE-2016-5687 CVE-2016-5688 CVE-2016-5689 CVE-2016-5690 CVE-2016-5691 CVE-2016-5841 CVE-2016-5842 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 68 vulnerabilities is now available. Description: ImageMagick was updated to fix 66 security issues. These security issues were fixed: - CVE-2014-9810: SEGV in dpx file handler. (bsc#983803). - CVE-2014-9811: Crash in xwd file handler (bsc#984032). - CVE-2014-9812: NULL pointer dereference in ps file handling (bsc#984137). - CVE-2014-9813: Crash on corrupted viff file (bsc#984035). - CVE-2014-9814: NULL pointer dereference in wpg file handling (bsc#984193). - CVE-2014-9815: Crash on corrupted wpg file (bsc#984372). - CVE-2014-9816: Out of bound access in viff image (bsc#984398). - CVE-2014-9817: Heap buffer overflow in pdb file handling (bsc#984400). - CVE-2014-9818: Out of bound access on malformed sun file (bsc#984181). - CVE-2014-9819: Heap overflow in palm files (bsc#984142). - CVE-2014-9830: Handling of corrupted sun file (bsc#984135). - CVE-2014-9831: Handling of corrupted wpg file (bsc#984375). - CVE-2014-9850: Incorrect thread limit logic (bsc#984149). - CVE-2014-9851: Crash when parsing resource block (bsc#984160). - CVE-2014-9852: Incorrect usage of object after it has been destroyed (bsc#984191). - CVE-2014-9853: Memory leak in rle file handling (bsc#984408). - CVE-2015-8902: PDB file DoS (CPU consumption) (bsc#983253). - CVE-2015-8903: Denial of service (cpu) in vicar (bsc#983259). - CVE-2015-8900: HDR file DoS (endless loop) (bsc#983232). - CVE-2015-8901: MIFF file DoS (endless loop) (bsc#983234). - CVE-2016-5688: Various invalid memory reads in ImageMagick WPG (bsc#985442). - CVE-2014-9834: Heap overflow in pict file (bsc#984436). - CVE-2014-9806: Prevent leak of file descriptor due to corrupted file. (bsc#983774). - CVE-2016-5687: Out of bounds read in DDS coder (bsc#985448). - CVE-2014-9838: Out of memory crash in magick/cache.c (bsc#984370). - CVE-2014-9854: Filling memory during identification of TIFF image (bsc#984184). - CVE-2015-8898: Prevent null pointer access in magick/constitute.c (bsc#983746). - CVE-2014-9833: Heap overflow in psd file (bsc#984406). - CVE-2015-8894: Double free in coders/tga.c:221 (bsc#983523). - CVE-2015-8895: Integer and Buffer overflow in coders/icon.c (bsc#983527). - CVE-2015-8896: Double free / integer truncation issue in coders/pict.c:2000 (bsc#983533). - CVE-2015-8897: Out of bounds error in SpliceImage (bsc#983739). - CVE-2016-5690: Bad foor loop in DCM coder (bsc#985451). - CVE-2016-5691: Checks for pixel.red/green/blue in dcm coder (bsc#985456). - CVE-2014-9836: Crash in xpm file handling (bsc#984023). - CVE-2014-9808: SEGV due to corrupted dpc images. (bsc#983796). - CVE-2014-9821: Avoid heap overflow in pnm files. (bsc#984014). - CVE-2014-9820: Heap overflow in xpm files (bsc#984150). - CVE-2014-9823: Heap overflow in palm file (bsc#984401). - CVE-2014-9822: Heap overflow in quantum file (bsc#984187). - CVE-2014-9825: Heap overflow in corrupted psd file (bsc#984427). - CVE-2014-9824: Heap overflow in psd file (bsc#984185). - CVE-2014-9809: SEGV due to corrupted xwd images. (bsc#983799). - CVE-2014-9826: Incorrect error handling in sun files (bsc#984186). - CVE-2014-9843: Incorrect boundary checks in DecodePSDPixels (bsc#984179). - CVE-2014-9842: Memory leak in psd handling (bsc#984374). - CVE-2014-9841: Throwing of exceptions in psd handling (bsc#984172). - CVE-2014-9840: Out of bound access in palm file (bsc#984433). - CVE-2014-9847: Incorrect handling of "previous" image in the JNG decoder (bsc#984144). - CVE-2014-9846: Added checks to prevent overflow in rle file. (bsc#983521). - CVE-2014-9845: Crash due to corrupted dib file (bsc#984394). - CVE-2014-9844: Out of bound issue in rle file (bsc#984373). - CVE-2014-9849: Crash in png coder (bsc#984018). - CVE-2014-9848: Memory leak in quantum management (bsc#984404). - CVE-2014-9807: Double free in pdb coder. (bsc#983794). - CVE-2014-9829: Out of bound access in sun file (bsc#984409). - CVE-2014-9832: Heap overflow in pcx file (bsc#984183). - CVE-2014-9805: SEGV due to a corrupted pnm file. (bsc#983752). - CVE-2016-4564: The DrawImage function in MagickCore/draw.c in ImageMagick made an incorrect function call in attempting to locate the next token, which allowed remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file (bsc#983308). - CVE-2016-4563: The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick mishandled the relationship between the BezierQuantum value and certain strokes data, which allowed remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file (bsc#983305). - CVE-2016-4562: The DrawDashPolygon function in MagickCore/draw.c in ImageMagick mishandled calculations of certain vertices integer data, which allowed remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file (bsc#983292). - CVE-2014-9839: Theoretical out of bound access in magick/colormap-private.h (bsc#984379). - CVE-2016-5689: NULL ptr dereference in dcm coder (bsc#985460). - CVE-2014-9837: Additional PNM sanity checks (bsc#984166). - CVE-2014-9835: Heap overflow in wpf file (bsc#984145). - CVE-2014-9828: Corrupted (too many colors) psd file (bsc#984028). - CVE-2016-5841: Integer overflow could have read to RCE (bnc#986609). - CVE-2016-5842: Out-of-bounds read in MagickCore/property.c:1396 could have lead to memory leak (bnc#986608). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-883=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-15.1 ImageMagick-debuginfo-6.8.8.1-15.1 ImageMagick-debugsource-6.8.8.1-15.1 ImageMagick-devel-6.8.8.1-15.1 ImageMagick-extra-6.8.8.1-15.1 ImageMagick-extra-debuginfo-6.8.8.1-15.1 libMagick++-6_Q16-3-6.8.8.1-15.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-15.1 libMagick++-devel-6.8.8.1-15.1 libMagickCore-6_Q16-1-6.8.8.1-15.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-15.1 libMagickWand-6_Q16-1-6.8.8.1-15.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-15.1 perl-PerlMagick-6.8.8.1-15.1 perl-PerlMagick-debuginfo-6.8.8.1-15.1 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-15.1 libMagick++-6_Q16-3-32bit-6.8.8.1-15.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-15.1 libMagick++-devel-32bit-6.8.8.1-15.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-15.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-15.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-15.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-15.1 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-15.1 References: https://www.suse.com/security/cve/CVE-2014-9805.html https://www.suse.com/security/cve/CVE-2014-9806.html https://www.suse.com/security/cve/CVE-2014-9807.html https://www.suse.com/security/cve/CVE-2014-9808.html https://www.suse.com/security/cve/CVE-2014-9809.html https://www.suse.com/security/cve/CVE-2014-9810.html https://www.suse.com/security/cve/CVE-2014-9811.html https://www.suse.com/security/cve/CVE-2014-9812.html https://www.suse.com/security/cve/CVE-2014-9813.html https://www.suse.com/security/cve/CVE-2014-9814.html https://www.suse.com/security/cve/CVE-2014-9815.html https://www.suse.com/security/cve/CVE-2014-9816.html https://www.suse.com/security/cve/CVE-2014-9817.html https://www.suse.com/security/cve/CVE-2014-9818.html https://www.suse.com/security/cve/CVE-2014-9819.html https://www.suse.com/security/cve/CVE-2014-9820.html https://www.suse.com/security/cve/CVE-2014-9821.html https://www.suse.com/security/cve/CVE-2014-9822.html https://www.suse.com/security/cve/CVE-2014-9823.html https://www.suse.com/security/cve/CVE-2014-9824.html https://www.suse.com/security/cve/CVE-2014-9825.html https://www.suse.com/security/cve/CVE-2014-9826.html https://www.suse.com/security/cve/CVE-2014-9828.html https://www.suse.com/security/cve/CVE-2014-9829.html https://www.suse.com/security/cve/CVE-2014-9830.html https://www.suse.com/security/cve/CVE-2014-9831.html https://www.suse.com/security/cve/CVE-2014-9832.html https://www.suse.com/security/cve/CVE-2014-9833.html https://www.suse.com/security/cve/CVE-2014-9834.html https://www.suse.com/security/cve/CVE-2014-9835.html https://www.suse.com/security/cve/CVE-2014-9836.html https://www.suse.com/security/cve/CVE-2014-9837.html https://www.suse.com/security/cve/CVE-2014-9838.html https://www.suse.com/security/cve/CVE-2014-9839.html https://www.suse.com/security/cve/CVE-2014-9840.html https://www.suse.com/security/cve/CVE-2014-9841.html https://www.suse.com/security/cve/CVE-2014-9842.html https://www.suse.com/security/cve/CVE-2014-9843.html https://www.suse.com/security/cve/CVE-2014-9844.html https://www.suse.com/security/cve/CVE-2014-9845.html https://www.suse.com/security/cve/CVE-2014-9846.html https://www.suse.com/security/cve/CVE-2014-9847.html https://www.suse.com/security/cve/CVE-2014-9848.html https://www.suse.com/security/cve/CVE-2014-9849.html https://www.suse.com/security/cve/CVE-2014-9850.html https://www.suse.com/security/cve/CVE-2014-9851.html https://www.suse.com/security/cve/CVE-2014-9852.html https://www.suse.com/security/cve/CVE-2014-9853.html https://www.suse.com/security/cve/CVE-2014-9854.html https://www.suse.com/security/cve/CVE-2015-8894.html https://www.suse.com/security/cve/CVE-2015-8895.html https://www.suse.com/security/cve/CVE-2015-8896.html https://www.suse.com/security/cve/CVE-2015-8897.html https://www.suse.com/security/cve/CVE-2015-8898.html https://www.suse.com/security/cve/CVE-2015-8900.html https://www.suse.com/security/cve/CVE-2015-8901.html https://www.suse.com/security/cve/CVE-2015-8902.html https://www.suse.com/security/cve/CVE-2015-8903.html https://www.suse.com/security/cve/CVE-2016-4562.html https://www.suse.com/security/cve/CVE-2016-4563.html https://www.suse.com/security/cve/CVE-2016-4564.html https://www.suse.com/security/cve/CVE-2016-5687.html https://www.suse.com/security/cve/CVE-2016-5688.html https://www.suse.com/security/cve/CVE-2016-5689.html https://www.suse.com/security/cve/CVE-2016-5690.html https://www.suse.com/security/cve/CVE-2016-5691.html https://www.suse.com/security/cve/CVE-2016-5841.html https://www.suse.com/security/cve/CVE-2016-5842.html https://bugzilla.suse.com/983232 https://bugzilla.suse.com/983234 https://bugzilla.suse.com/983253 https://bugzilla.suse.com/983259 https://bugzilla.suse.com/983292 https://bugzilla.suse.com/983305 https://bugzilla.suse.com/983308 https://bugzilla.suse.com/983521 https://bugzilla.suse.com/983523 https://bugzilla.suse.com/983527 https://bugzilla.suse.com/983533 https://bugzilla.suse.com/983739 https://bugzilla.suse.com/983746 https://bugzilla.suse.com/983752 https://bugzilla.suse.com/983774 https://bugzilla.suse.com/983794 https://bugzilla.suse.com/983796 https://bugzilla.suse.com/983799 https://bugzilla.suse.com/983803 https://bugzilla.suse.com/984014 https://bugzilla.suse.com/984018 https://bugzilla.suse.com/984023 https://bugzilla.suse.com/984028 https://bugzilla.suse.com/984032 https://bugzilla.suse.com/984035 https://bugzilla.suse.com/984135 https://bugzilla.suse.com/984137 https://bugzilla.suse.com/984142 https://bugzilla.suse.com/984144 https://bugzilla.suse.com/984145 https://bugzilla.suse.com/984149 https://bugzilla.suse.com/984150 https://bugzilla.suse.com/984160 https://bugzilla.suse.com/984166 https://bugzilla.suse.com/984172 https://bugzilla.suse.com/984179 https://bugzilla.suse.com/984181 https://bugzilla.suse.com/984183 https://bugzilla.suse.com/984184 https://bugzilla.suse.com/984185 https://bugzilla.suse.com/984186 https://bugzilla.suse.com/984187 https://bugzilla.suse.com/984191 https://bugzilla.suse.com/984193 https://bugzilla.suse.com/984370 https://bugzilla.suse.com/984372 https://bugzilla.suse.com/984373 https://bugzilla.suse.com/984374 https://bugzilla.suse.com/984375 https://bugzilla.suse.com/984379 https://bugzilla.suse.com/984394 https://bugzilla.suse.com/984398 https://bugzilla.suse.com/984400 https://bugzilla.suse.com/984401 https://bugzilla.suse.com/984404 https://bugzilla.suse.com/984406 https://bugzilla.suse.com/984408 https://bugzilla.suse.com/984409 https://bugzilla.suse.com/984427 https://bugzilla.suse.com/984433 https://bugzilla.suse.com/984436 https://bugzilla.suse.com/985442 https://bugzilla.suse.com/985448 https://bugzilla.suse.com/985451 https://bugzilla.suse.com/985456 https://bugzilla.suse.com/985460 https://bugzilla.suse.com/986608 https://bugzilla.suse.com/986609

1 0

openSUSE-RU-2016:1831-1: moderate: Recommended update for collectd
by maintenance＠opensuse.org 19 Jul '16

19 Jul '16

openSUSE Recommended Update: Recommended update for collectd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1831-1 Rating: moderate References: #987323 #987462 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This recommended update for collectd fixes the following issues: - Fix used memory overestimation by proper accounting SLAB (boo#987323) - correct systemd service file to point to the correct configuration file (boo#987462) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-882=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): collectd-5.4.2-5.1 collectd-debuginfo-5.4.2-5.1 collectd-debugsource-5.4.2-5.1 collectd-plugin-dbi-5.4.2-5.1 collectd-plugin-dbi-debuginfo-5.4.2-5.1 collectd-plugin-ipmi-5.4.2-5.1 collectd-plugin-ipmi-debuginfo-5.4.2-5.1 collectd-plugin-java-5.4.2-5.1 collectd-plugin-java-debuginfo-5.4.2-5.1 collectd-plugin-memcachec-5.4.2-5.1 collectd-plugin-memcachec-debuginfo-5.4.2-5.1 collectd-plugin-mysql-5.4.2-5.1 collectd-plugin-mysql-debuginfo-5.4.2-5.1 collectd-plugin-notify-desktop-5.4.2-5.1 collectd-plugin-notify-desktop-debuginfo-5.4.2-5.1 collectd-plugin-pinba-5.4.2-5.1 collectd-plugin-pinba-debuginfo-5.4.2-5.1 collectd-plugin-postgresql-5.4.2-5.1 collectd-plugin-postgresql-debuginfo-5.4.2-5.1 collectd-plugin-python-5.4.2-5.1 collectd-plugin-python-debuginfo-5.4.2-5.1 collectd-plugin-snmp-5.4.2-5.1 collectd-plugin-snmp-debuginfo-5.4.2-5.1 collectd-plugin-virt-5.4.2-5.1 collectd-plugin-virt-debuginfo-5.4.2-5.1 collectd-plugins-all-5.4.2-5.1 collectd-spamassassin-5.4.2-5.1 collectd-web-5.4.2-5.1 collectd-web-js-5.4.2-5.1 libcollectdclient-devel-5.4.2-5.1 libcollectdclient1-5.4.2-5.1 libcollectdclient1-debuginfo-5.4.2-5.1 References: https://bugzilla.suse.com/987323 https://bugzilla.suse.com/987462

1 0

openSUSE-SU-2016:1830-1: moderate: Security update for samba
by opensuse-security＠opensuse.org 19 Jul '16

19 Jul '16

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1830-1 Rating: moderate References: #969522 #975131 #986869 Cross-References: CVE-2016-2119 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for samba fixes the following issues: - Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (boo#986869). - Honor smb.conf socket options in winbind; (boo#975131). - Don't use htons() with IP_PROTO_RAW; (bso#11705); (boo#969522). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-881=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ctdb-4.2.4-40.1 ctdb-debuginfo-4.2.4-40.1 ctdb-devel-4.2.4-40.1 ctdb-pcp-pmda-4.2.4-40.1 ctdb-pcp-pmda-debuginfo-4.2.4-40.1 ctdb-tests-4.2.4-40.1 ctdb-tests-debuginfo-4.2.4-40.1 libdcerpc-atsvc-devel-4.2.4-40.1 libdcerpc-atsvc0-4.2.4-40.1 libdcerpc-atsvc0-debuginfo-4.2.4-40.1 libdcerpc-binding0-4.2.4-40.1 libdcerpc-binding0-debuginfo-4.2.4-40.1 libdcerpc-devel-4.2.4-40.1 libdcerpc-samr-devel-4.2.4-40.1 libdcerpc-samr0-4.2.4-40.1 libdcerpc-samr0-debuginfo-4.2.4-40.1 libdcerpc0-4.2.4-40.1 libdcerpc0-debuginfo-4.2.4-40.1 libgensec-devel-4.2.4-40.1 libgensec0-4.2.4-40.1 libgensec0-debuginfo-4.2.4-40.1 libndr-devel-4.2.4-40.1 libndr-krb5pac-devel-4.2.4-40.1 libndr-krb5pac0-4.2.4-40.1 libndr-krb5pac0-debuginfo-4.2.4-40.1 libndr-nbt-devel-4.2.4-40.1 libndr-nbt0-4.2.4-40.1 libndr-nbt0-debuginfo-4.2.4-40.1 libndr-standard-devel-4.2.4-40.1 libndr-standard0-4.2.4-40.1 libndr-standard0-debuginfo-4.2.4-40.1 libndr0-4.2.4-40.1 libndr0-debuginfo-4.2.4-40.1 libnetapi-devel-4.2.4-40.1 libnetapi0-4.2.4-40.1 libnetapi0-debuginfo-4.2.4-40.1 libregistry-devel-4.2.4-40.1 libregistry0-4.2.4-40.1 libregistry0-debuginfo-4.2.4-40.1 libsamba-credentials-devel-4.2.4-40.1 libsamba-credentials0-4.2.4-40.1 libsamba-credentials0-debuginfo-4.2.4-40.1 libsamba-hostconfig-devel-4.2.4-40.1 libsamba-hostconfig0-4.2.4-40.1 libsamba-hostconfig0-debuginfo-4.2.4-40.1 libsamba-passdb-devel-4.2.4-40.1 libsamba-passdb0-4.2.4-40.1 libsamba-passdb0-debuginfo-4.2.4-40.1 libsamba-policy-devel-4.2.4-40.1 libsamba-policy0-4.2.4-40.1 libsamba-policy0-debuginfo-4.2.4-40.1 libsamba-util-devel-4.2.4-40.1 libsamba-util0-4.2.4-40.1 libsamba-util0-debuginfo-4.2.4-40.1 libsamdb-devel-4.2.4-40.1 libsamdb0-4.2.4-40.1 libsamdb0-debuginfo-4.2.4-40.1 libsmbclient-devel-4.2.4-40.1 libsmbclient-raw-devel-4.2.4-40.1 libsmbclient-raw0-4.2.4-40.1 libsmbclient-raw0-debuginfo-4.2.4-40.1 libsmbclient0-4.2.4-40.1 libsmbclient0-debuginfo-4.2.4-40.1 libsmbconf-devel-4.2.4-40.1 libsmbconf0-4.2.4-40.1 libsmbconf0-debuginfo-4.2.4-40.1 libsmbldap-devel-4.2.4-40.1 libsmbldap0-4.2.4-40.1 libsmbldap0-debuginfo-4.2.4-40.1 libtevent-util-devel-4.2.4-40.1 libtevent-util0-4.2.4-40.1 libtevent-util0-debuginfo-4.2.4-40.1 libwbclient-devel-4.2.4-40.1 libwbclient0-4.2.4-40.1 libwbclient0-debuginfo-4.2.4-40.1 samba-4.2.4-40.1 samba-client-4.2.4-40.1 samba-client-debuginfo-4.2.4-40.1 samba-core-devel-4.2.4-40.1 samba-debuginfo-4.2.4-40.1 samba-debugsource-4.2.4-40.1 samba-libs-4.2.4-40.1 samba-libs-debuginfo-4.2.4-40.1 samba-pidl-4.2.4-40.1 samba-python-4.2.4-40.1 samba-python-debuginfo-4.2.4-40.1 samba-test-4.2.4-40.1 samba-test-debuginfo-4.2.4-40.1 samba-test-devel-4.2.4-40.1 samba-winbind-4.2.4-40.1 samba-winbind-debuginfo-4.2.4-40.1 - openSUSE 13.2 (noarch): samba-doc-4.2.4-40.1 - openSUSE 13.2 (x86_64): libdcerpc-atsvc0-32bit-4.2.4-40.1 libdcerpc-atsvc0-debuginfo-32bit-4.2.4-40.1 libdcerpc-binding0-32bit-4.2.4-40.1 libdcerpc-binding0-debuginfo-32bit-4.2.4-40.1 libdcerpc-samr0-32bit-4.2.4-40.1 libdcerpc-samr0-debuginfo-32bit-4.2.4-40.1 libdcerpc0-32bit-4.2.4-40.1 libdcerpc0-debuginfo-32bit-4.2.4-40.1 libgensec0-32bit-4.2.4-40.1 libgensec0-debuginfo-32bit-4.2.4-40.1 libndr-krb5pac0-32bit-4.2.4-40.1 libndr-krb5pac0-debuginfo-32bit-4.2.4-40.1 libndr-nbt0-32bit-4.2.4-40.1 libndr-nbt0-debuginfo-32bit-4.2.4-40.1 libndr-standard0-32bit-4.2.4-40.1 libndr-standard0-debuginfo-32bit-4.2.4-40.1 libndr0-32bit-4.2.4-40.1 libndr0-debuginfo-32bit-4.2.4-40.1 libnetapi0-32bit-4.2.4-40.1 libnetapi0-debuginfo-32bit-4.2.4-40.1 libregistry0-32bit-4.2.4-40.1 libregistry0-debuginfo-32bit-4.2.4-40.1 libsamba-credentials0-32bit-4.2.4-40.1 libsamba-credentials0-debuginfo-32bit-4.2.4-40.1 libsamba-hostconfig0-32bit-4.2.4-40.1 libsamba-hostconfig0-debuginfo-32bit-4.2.4-40.1 libsamba-passdb0-32bit-4.2.4-40.1 libsamba-passdb0-debuginfo-32bit-4.2.4-40.1 libsamba-policy0-32bit-4.2.4-40.1 libsamba-policy0-debuginfo-32bit-4.2.4-40.1 libsamba-util0-32bit-4.2.4-40.1 libsamba-util0-debuginfo-32bit-4.2.4-40.1 libsamdb0-32bit-4.2.4-40.1 libsamdb0-debuginfo-32bit-4.2.4-40.1 libsmbclient-raw0-32bit-4.2.4-40.1 libsmbclient-raw0-debuginfo-32bit-4.2.4-40.1 libsmbclient0-32bit-4.2.4-40.1 libsmbclient0-debuginfo-32bit-4.2.4-40.1 libsmbconf0-32bit-4.2.4-40.1 libsmbconf0-debuginfo-32bit-4.2.4-40.1 libsmbldap0-32bit-4.2.4-40.1 libsmbldap0-debuginfo-32bit-4.2.4-40.1 libtevent-util0-32bit-4.2.4-40.1 libtevent-util0-debuginfo-32bit-4.2.4-40.1 libwbclient0-32bit-4.2.4-40.1 libwbclient0-debuginfo-32bit-4.2.4-40.1 samba-32bit-4.2.4-40.1 samba-client-32bit-4.2.4-40.1 samba-client-debuginfo-32bit-4.2.4-40.1 samba-debuginfo-32bit-4.2.4-40.1 samba-libs-32bit-4.2.4-40.1 samba-libs-debuginfo-32bit-4.2.4-40.1 samba-winbind-32bit-4.2.4-40.1 samba-winbind-debuginfo-32bit-4.2.4-40.1 References: https://www.suse.com/security/cve/CVE-2016-2119.html https://bugzilla.suse.com/969522 https://bugzilla.suse.com/975131 https://bugzilla.suse.com/986869

1 0

openSUSE-SU-2016:1824-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 19 Jul '16

19 Jul '16

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1824-1 Rating: moderate References: #988488 Cross-References: CVE-2016-5387 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2 fixes the following issues: * It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-5387). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated Apache server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes (unless a value has been explicitly configured by the administrator in the configuration file). (bsc#988488) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-880=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-880=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-2.4.16-12.1 apache2-debuginfo-2.4.16-12.1 apache2-debugsource-2.4.16-12.1 apache2-devel-2.4.16-12.1 apache2-event-2.4.16-12.1 apache2-event-debuginfo-2.4.16-12.1 apache2-example-pages-2.4.16-12.1 apache2-prefork-2.4.16-12.1 apache2-prefork-debuginfo-2.4.16-12.1 apache2-utils-2.4.16-12.1 apache2-utils-debuginfo-2.4.16-12.1 apache2-worker-2.4.16-12.1 apache2-worker-debuginfo-2.4.16-12.1 - openSUSE Leap 42.1 (noarch): apache2-doc-2.4.16-12.1 - openSUSE 13.2 (i586 x86_64): apache2-2.4.10-31.1 apache2-debuginfo-2.4.10-31.1 apache2-debugsource-2.4.10-31.1 apache2-devel-2.4.10-31.1 apache2-event-2.4.10-31.1 apache2-event-debuginfo-2.4.10-31.1 apache2-example-pages-2.4.10-31.1 apache2-prefork-2.4.10-31.1 apache2-prefork-debuginfo-2.4.10-31.1 apache2-utils-2.4.10-31.1 apache2-utils-debuginfo-2.4.10-31.1 apache2-worker-2.4.10-31.1 apache2-worker-debuginfo-2.4.10-31.1 - openSUSE 13.2 (noarch): apache2-doc-2.4.10-31.1 References: https://www.suse.com/security/cve/CVE-2016-5387.html https://bugzilla.suse.com/988488

1 0