openSUSE Updates September 2016

updates@lists.opensuse.org

2 participants
111 discussions

openSUSE-SU-2016:2425-1: important: Security update for postgresql93
by opensuse-security＠opensuse.org 01 Oct '16

01 Oct '16

openSUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2425-1 Rating: important References: #993453 #993454 Cross-References: CVE-2016-5423 CVE-2016-5424 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The postgresql server postgresql93 was updated to 9.3.14 fixes the following issues: Update to version 9.3.14: * Fix possible mis-evaluation of nested CASE-WHEN expressions (CVE-2016-5423, boo#993454) * Fix client programs' handling of special characters in database and role names (CVE-2016-5424, boo#993453) * Fix corner-case misbehaviors for IS NULL/IS NOT NULL applied to nested composite values * Make the inet and cidr data types properly reject IPv6 addresses with too many colon-separated fields * Prevent crash in close_ps() (the point ## lseg operator) for NaN input coordinates * Fix several one-byte buffer over-reads in to_number() * Avoid unsafe intermediate state during expensive paths through heap_update() * For the other bug fixes, see the release notes: https://www.postgresql.org/docs/9.3/static/release-9-3-14.html Update to version 9.3.13: This update fixes several problems which caused downtime for users, including: - Clearing the OpenSSL error queue before OpenSSL calls, preventing errors in SSL connections, particularly when using the Python, Ruby or PHP OpenSSL wrappers - Fixed the "failed to build N-way joins" planner error - Fixed incorrect handling of equivalence in multilevel nestloop query plans, which could emit rows which didn't match the WHERE clause. - Prevented two memory leaks with using GIN indexes, including a potential index corruption risk. The release also includes many other bug fixes for reported issues, many of which affect all supported versions: - Fix corner-case parser failures occurring when operator_precedence_warning is turned on - Prevent possible misbehavior of TH, th, and Y,YYY format codes in to_timestamp() - Correct dumping of VIEWs and RULEs which use ANY (array) in a subselect - Disallow newlines in ALTER SYSTEM parameter values - Avoid possible misbehavior after failing to remove a tablespace symlink - Fix crash in logical decoding on alignment-picky platforms - Avoid repeated requests for feedback from receiver while shutting down walsender - Multiple fixes for pg_upgrade - Support building with Visual Studio 2015 - This update also contains tzdata release 2016d, with updates for Russia, Venezuela, Kirov, and Tomsk. http://www.postgresql.org/docs/current/static/release-9-3-13.html Update to version 9.3.12: - Fix two bugs in indexed ROW() comparisons - Avoid data loss due to renaming files - Prevent an error in rechecking rows in SELECT FOR UPDATE/SHARE - Fix bugs in multiple json_ and jsonb_ functions - Log lock waits for INSERT ON CONFLICT correctly - Ignore recovery_min_apply_delay until reaching a consistent state - Fix issue with pg_subtrans XID wraparound - Fix assorted bugs in Logical Decoding - Fix planner error with nested security barrier views - Prevent memory leak in GIN indexes - Fix two issues with ispell dictionaries - Avoid a crash on old Windows versions - Skip creating an erroneous delete script in pg_upgrade - Correctly translate empty arrays into PL/Perl - Make PL/Python cope with identifier names For the full release notes, see: http://www.postgresql.org/docs/9.4/static/release-9-3-12.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1140=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libecpg6-9.3.14-2.13.1 libecpg6-debuginfo-9.3.14-2.13.1 libpq5-9.3.14-2.13.1 libpq5-debuginfo-9.3.14-2.13.1 postgresql93-9.3.14-2.13.1 postgresql93-contrib-9.3.14-2.13.1 postgresql93-contrib-debuginfo-9.3.14-2.13.1 postgresql93-debuginfo-9.3.14-2.13.1 postgresql93-debugsource-9.3.14-2.13.1 postgresql93-devel-9.3.14-2.13.1 postgresql93-devel-debuginfo-9.3.14-2.13.1 postgresql93-libs-debugsource-9.3.14-2.13.1 postgresql93-plperl-9.3.14-2.13.1 postgresql93-plperl-debuginfo-9.3.14-2.13.1 postgresql93-plpython-9.3.14-2.13.1 postgresql93-plpython-debuginfo-9.3.14-2.13.1 postgresql93-pltcl-9.3.14-2.13.1 postgresql93-pltcl-debuginfo-9.3.14-2.13.1 postgresql93-server-9.3.14-2.13.1 postgresql93-server-debuginfo-9.3.14-2.13.1 postgresql93-test-9.3.14-2.13.1 - openSUSE 13.2 (noarch): postgresql93-docs-9.3.14-2.13.1 - openSUSE 13.2 (x86_64): libecpg6-32bit-9.3.14-2.13.1 libecpg6-debuginfo-32bit-9.3.14-2.13.1 libpq5-32bit-9.3.14-2.13.1 libpq5-debuginfo-32bit-9.3.14-2.13.1 References: https://www.suse.com/security/cve/CVE-2016-5423.html https://www.suse.com/security/cve/CVE-2016-5424.html https://bugzilla.suse.com/993453 https://bugzilla.suse.com/993454

1 0

openSUSE-SU-2016:2424-1: moderate: Security update for openjpeg
by opensuse-security＠opensuse.org 01 Oct '16

01 Oct '16

openSUSE Security Update: Security update for openjpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2424-1 Rating: moderate References: #999817 Cross-References: CVE-2016-7445 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openjpeg fixes the following issues: - CVE-2016-7445: Avoid a crash (NULL pointer dereference) when convertng images. (boo#999817, CVE-2016-7445). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1139=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenjpeg1-1.5.2-5.1 libopenjpeg1-debuginfo-1.5.2-5.1 openjpeg-1.5.2-5.1 openjpeg-debuginfo-1.5.2-5.1 openjpeg-debugsource-1.5.2-5.1 openjpeg-devel-1.5.2-5.1 - openSUSE Leap 42.1 (x86_64): libopenjpeg1-32bit-1.5.2-5.1 libopenjpeg1-debuginfo-32bit-1.5.2-5.1 openjpeg-devel-32bit-1.5.2-5.1 References: https://www.suse.com/security/cve/CVE-2016-7445.html https://bugzilla.suse.com/999817

1 0

openSUSE-SU-2016:2423-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 01 Oct '16

01 Oct '16

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2423-1 Rating: moderate References: #994157 Cross-References: CVE-2016-6313 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libgcrypt fixes the following issues: - RNG prediction vulnerability (bsc#994157, CVE-2016-6313) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1138=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgcrypt-cavs-1.6.1-32.1 libgcrypt-cavs-debuginfo-1.6.1-32.1 libgcrypt-debugsource-1.6.1-32.1 libgcrypt-devel-1.6.1-32.1 libgcrypt-devel-debuginfo-1.6.1-32.1 libgcrypt20-1.6.1-32.1 libgcrypt20-debuginfo-1.6.1-32.1 libgcrypt20-hmac-1.6.1-32.1 - openSUSE Leap 42.1 (x86_64): libgcrypt-devel-32bit-1.6.1-32.1 libgcrypt-devel-debuginfo-32bit-1.6.1-32.1 libgcrypt20-32bit-1.6.1-32.1 libgcrypt20-debuginfo-32bit-1.6.1-32.1 libgcrypt20-hmac-32bit-1.6.1-32.1 References: https://www.suse.com/security/cve/CVE-2016-6313.html https://bugzilla.suse.com/994157

1 0

openSUSE-RU-2016:2422-1: moderate: Recommended update for Opera
by maintenance＠opensuse.org 30 Sep '16

30 Sep '16

openSUSE Recommended Update: Recommended update for Opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2422-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: Opera was updated to 40.0.2308.62 to fix the following issues: - Alt+drag (text selection on links) opens O-menu Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2016-1137=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1:NonFree (x86_64): opera-40.0.2308.62-31.1 References:

1 0

openSUSE-RU-2016:2411-1: moderate: Recommended update for pidgin
by maintenance＠opensuse.org 29 Sep '16

29 Sep '16

1 0

openSUSE-RU-2016:2409-1: moderate: Recommended update for pidgin
by maintenance＠opensuse.org 28 Sep '16

28 Sep '16

openSUSE Recommended Update: Recommended update for pidgin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2409-1 Rating: moderate References: #942818 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update provides version 2.10.11 for pidgin: - fix a filedesriptor leak while playing sound files (pidgin.im#16752, boo#942818). - Update to version 2.10.11: + General: - Fix handling of Self-Signed SSL/TLS Certificates when using the NSS plugin (pidgin.im#16412). - Improve default cipher suites used with the NSS plugin (pidgin.im#16262). - Add NSS Preferences plugin which allows the SSL/TLS Versions and cipher suites to be configured (pidgin.im#8061). + Gadu-Gadu: - Fix a bug that prevented plugin to load when compiled without GnuTLS (pidgin.im#16431). - Fix build for platforms without AF_LOCAL definition (pidgin.im#16404). + MSN: - Fix broken login due to server change (pidgin.im#16451, pidgin.im#16455). - Fail early when buddy list is unavailable instead of wasting bandwidth endlessly re-trying. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1135=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): finch-2.10.11-5.7.1 finch-debuginfo-2.10.11-5.7.1 finch-devel-2.10.11-5.7.1 libpurple-2.10.11-5.7.1 libpurple-debuginfo-2.10.11-5.7.1 libpurple-devel-2.10.11-5.7.1 libpurple-meanwhile-2.10.11-5.7.1 libpurple-meanwhile-debuginfo-2.10.11-5.7.1 libpurple-tcl-2.10.11-5.7.1 libpurple-tcl-debuginfo-2.10.11-5.7.1 pidgin-2.10.11-5.7.1 pidgin-debuginfo-2.10.11-5.7.1 pidgin-debugsource-2.10.11-5.7.1 pidgin-devel-2.10.11-5.7.1 - openSUSE 13.2 (noarch): libpurple-branding-openSUSE-13.2-2.5.1 libpurple-branding-upstream-2.10.11-5.7.1 libpurple-lang-2.10.11-5.7.1 References: https://bugzilla.suse.com/942818

1 0

openSUSE-SU-2016:2407-1: important: Security update for openssl
by opensuse-security＠opensuse.org 28 Sep '16

28 Sep '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2407-1 Rating: important References: #979475 #982575 #982745 #983249 #988591 #990419 #993819 #994749 #994844 #995075 #995324 #995359 #995377 #998190 #999665 #999666 #999668 Cross-References: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6306 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 6 fixes is now available. Description: This update for openssl fixes the following issues: OpenSSL Security Advisory [22 Sep 2016] (bsc#999665) Severity: High * OCSP Status Request extension unbounded memory growth (CVE-2016-6304) (bsc#999666) Severity: Low * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575) * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249) * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844) * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419) * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749) * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819) * Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183) (bsc#995359) * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324) * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377) * Certificate message OOB reads (CVE-2016-6306) (bsc#999668) More information can be found on: https://www.openssl.org/news/secadv/20160922.txt Also following bugs were fixed: * update expired S/MIME certs (bsc#979475) * improve s390x performance (bsc#982745) * allow >= 64GB AESGCM transfers (bsc#988591) * fix crash in print_notice (bsc#998190) * resume reading from /dev/urandom when interrupted by a signal (bsc#995075) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1134=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl-devel-1.0.1i-18.1 libopenssl1_0_0-1.0.1i-18.1 libopenssl1_0_0-debuginfo-1.0.1i-18.1 libopenssl1_0_0-hmac-1.0.1i-18.1 openssl-1.0.1i-18.1 openssl-debuginfo-1.0.1i-18.1 openssl-debugsource-1.0.1i-18.1 - openSUSE Leap 42.1 (noarch): openssl-doc-1.0.1i-18.1 - openSUSE Leap 42.1 (x86_64): libopenssl-devel-32bit-1.0.1i-18.1 libopenssl1_0_0-32bit-1.0.1i-18.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-18.1 libopenssl1_0_0-hmac-32bit-1.0.1i-18.1 References: https://www.suse.com/security/cve/CVE-2016-2177.html https://www.suse.com/security/cve/CVE-2016-2178.html https://www.suse.com/security/cve/CVE-2016-2179.html https://www.suse.com/security/cve/CVE-2016-2180.html https://www.suse.com/security/cve/CVE-2016-2181.html https://www.suse.com/security/cve/CVE-2016-2182.html https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-6302.html https://www.suse.com/security/cve/CVE-2016-6303.html https://www.suse.com/security/cve/CVE-2016-6304.html https://www.suse.com/security/cve/CVE-2016-6306.html https://bugzilla.suse.com/979475 https://bugzilla.suse.com/982575 https://bugzilla.suse.com/982745 https://bugzilla.suse.com/983249 https://bugzilla.suse.com/988591 https://bugzilla.suse.com/990419 https://bugzilla.suse.com/993819 https://bugzilla.suse.com/994749 https://bugzilla.suse.com/994844 https://bugzilla.suse.com/995075 https://bugzilla.suse.com/995324 https://bugzilla.suse.com/995359 https://bugzilla.suse.com/995377 https://bugzilla.suse.com/998190 https://bugzilla.suse.com/999665 https://bugzilla.suse.com/999666 https://bugzilla.suse.com/999668

1 0

openSUSE-SU-2016:2406-1: critical: Security update for bind
by opensuse-security＠opensuse.org 28 Sep '16

28 Sep '16

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2406-1 Rating: critical References: #1000362 Cross-References: CVE-2016-2776 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nameserver bind was updated to fix a remote denial of service vulnerability, where a crafted packet could cause the nameserver to abort. (CVE-2016-2776, bsc#1000362) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1133=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1133=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.9P1-39.1 bind-chrootenv-9.9.9P1-39.1 bind-debuginfo-9.9.9P1-39.1 bind-debugsource-9.9.9P1-39.1 bind-devel-9.9.9P1-39.1 bind-libs-9.9.9P1-39.1 bind-libs-debuginfo-9.9.9P1-39.1 bind-lwresd-9.9.9P1-39.1 bind-lwresd-debuginfo-9.9.9P1-39.1 bind-utils-9.9.9P1-39.1 bind-utils-debuginfo-9.9.9P1-39.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.9P1-39.1 bind-libs-debuginfo-32bit-9.9.9P1-39.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.9P1-39.1 - openSUSE 13.2 (i586 x86_64): bind-9.9.6P1-2.22.1 bind-chrootenv-9.9.6P1-2.22.1 bind-debuginfo-9.9.6P1-2.22.1 bind-debugsource-9.9.6P1-2.22.1 bind-devel-9.9.6P1-2.22.1 bind-libs-9.9.6P1-2.22.1 bind-libs-debuginfo-9.9.6P1-2.22.1 bind-lwresd-9.9.6P1-2.22.1 bind-lwresd-debuginfo-9.9.6P1-2.22.1 bind-utils-9.9.6P1-2.22.1 bind-utils-debuginfo-9.9.6P1-2.22.1 - openSUSE 13.2 (noarch): bind-doc-9.9.6P1-2.22.1 - openSUSE 13.2 (x86_64): bind-libs-32bit-9.9.6P1-2.22.1 bind-libs-debuginfo-32bit-9.9.6P1-2.22.1 References: https://www.suse.com/security/cve/CVE-2016-2776.html https://bugzilla.suse.com/1000362

1 0

openSUSE-SU-2016:2402-1: moderate: Security update for freerdp
by opensuse-security＠opensuse.org 28 Sep '16

28 Sep '16

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2402-1 Rating: moderate References: #829013 #857491 Cross-References: CVE-2013-4118 CVE-2014-0791 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: Security issues fixed: - CVE-2013-4118: Add a NULL pointer check to fix a server crash (boo#829013). - CVE-2014-0791: The remaining length in the stream is checked before doing some malloc(), which could have lead to crashes. (boo#857491). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1131=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): freerdp-1.0.2-11.1 freerdp-debuginfo-1.0.2-11.1 freerdp-debugsource-1.0.2-11.1 freerdp-devel-1.0.2-11.1 libfreerdp-1_0-1.0.2-11.1 libfreerdp-1_0-debuginfo-1.0.2-11.1 libfreerdp-1_0-plugins-1.0.2-11.1 libfreerdp-1_0-plugins-debuginfo-1.0.2-11.1 References: https://www.suse.com/security/cve/CVE-2013-4118.html https://www.suse.com/security/cve/CVE-2014-0791.html https://bugzilla.suse.com/829013 https://bugzilla.suse.com/857491

1 0

openSUSE-SU-2016:2400-1: moderate: Security update for freerdp
by opensuse-security＠opensuse.org 28 Sep '16

28 Sep '16

openSUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2400-1 Rating: moderate References: #829013 #857491 Cross-References: CVE-2013-4118 CVE-2014-0791 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: Security issues fixed: - CVE-2013-4118: Add a NULL pointer check to fix a server crash (boo#829013). - CVE-2014-0791: The remaining length in the stream is checked before doing some malloc(), which could have lead to crashes. (boo#857491). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1132=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): freerdp-1.0.2-8.3.1 freerdp-debuginfo-1.0.2-8.3.1 freerdp-debugsource-1.0.2-8.3.1 freerdp-devel-1.0.2-8.3.1 libfreerdp-1_0-1.0.2-8.3.1 libfreerdp-1_0-debuginfo-1.0.2-8.3.1 libfreerdp-1_0-plugins-1.0.2-8.3.1 libfreerdp-1_0-plugins-debuginfo-1.0.2-8.3.1 References: https://www.suse.com/security/cve/CVE-2013-4118.html https://www.suse.com/security/cve/CVE-2014-0791.html https://bugzilla.suse.com/829013 https://bugzilla.suse.com/857491

1 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

openSUSE Updates September 2016