September 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2016:2257-1: moderate: Recommended update for libgweather
by maintenance＠opensuse.org 07 Sep '16

07 Sep '16

openSUSE Recommended Update: Recommended update for libgweather ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2257-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for libgweather fixes the following issue: - The existing weather service provider was expired, replace by a working provider instead; patch taken from upstream bug report and rebased for current version (bgo#770321). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1060=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1060=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgweather-3-6-3.16.1-7.1 libgweather-3-6-debuginfo-3.16.1-7.1 libgweather-debugsource-3.16.1-7.1 libgweather-devel-3.16.1-7.1 typelib-1_0-GWeather-3_0-3.16.1-7.1 - openSUSE Leap 42.1 (x86_64): libgweather-3-6-32bit-3.16.1-7.1 libgweather-3-6-debuginfo-32bit-3.16.1-7.1 - openSUSE Leap 42.1 (noarch): libgweather-data-3.16.1-7.1 libgweather-lang-3.16.1-7.1 - openSUSE 13.2 (i586 x86_64): libgweather-3-6-3.14.4-10.1 libgweather-3-6-debuginfo-3.14.4-10.1 libgweather-debugsource-3.14.4-10.1 libgweather-devel-3.14.4-10.1 typelib-1_0-GWeather-3_0-3.14.4-10.1 - openSUSE 13.2 (noarch): libgweather-data-3.14.4-10.1 libgweather-lang-3.14.4-10.1 - openSUSE 13.2 (x86_64): libgweather-3-6-32bit-3.14.4-10.1 libgweather-3-6-debuginfo-32bit-3.14.4-10.1 References:

1 0

openSUSE-RU-2016:2256-1: moderate: Recommended update for python3-websockets
by maintenance＠opensuse.org 07 Sep '16

07 Sep '16

openSUSE Recommended Update: Recommended update for python3-websockets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2256-1 Rating: moderate References: #996474 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update privdes version 3.2 for python3-websockets. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1061=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): python3-websockets-3.2-12.1 References: https://bugzilla.suse.com/996474

1 0

openSUSE-RU-2016:2255-1: moderate: Recommended update for screenfetch
by maintenance＠opensuse.org 07 Sep '16

07 Sep '16

openSUSE Recommended Update: Recommended update for screenfetch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2255-1 Rating: moderate References: #995916 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for screenfetch fixes the following issues: Improvements of detection of SLES and s390's. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1058=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): screenfetch-3.7.0+git.20160826-6.1 References: https://bugzilla.suse.com/995916

1 0

openSUSE-SU-2016:2254-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Sep '16

06 Sep '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2254-1 Rating: moderate References: #990856 #991809 Cross-References: CVE-2016-2830 CVE-2016-2836 CVE-2016-2837 CVE-2016-2838 CVE-2016-2839 CVE-2016-5252 CVE-2016-5254 CVE-2016-5258 CVE-2016-5259 CVE-2016-5262 CVE-2016-5263 CVE-2016-5264 CVE-2016-5265 CVE-2016-6354 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - update to Thunderbird 45.3.0 (boo#991809) * Disposition-Notification-To could not be used in mail.compose.other.header * "edit as new message" on a received message pre-filled the sender as the composing identity. * Certain messages caused corruption of the drafts summary database. security fixes: * MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards * MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed * MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content * MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 * MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering * MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus * MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown * MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events * MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes * MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback * MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation * MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects * MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file - Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch] - add a screenshot to appdata.xml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1057=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1057=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-45.3.0-19.2 MozillaThunderbird-buildsymbols-45.3.0-19.2 MozillaThunderbird-debuginfo-45.3.0-19.2 MozillaThunderbird-debugsource-45.3.0-19.2 MozillaThunderbird-devel-45.3.0-19.2 MozillaThunderbird-translations-common-45.3.0-19.2 MozillaThunderbird-translations-other-45.3.0-19.2 - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-45.3.0-46.2 MozillaThunderbird-buildsymbols-45.3.0-46.2 MozillaThunderbird-debuginfo-45.3.0-46.2 MozillaThunderbird-debugsource-45.3.0-46.2 MozillaThunderbird-devel-45.3.0-46.2 MozillaThunderbird-translations-common-45.3.0-46.2 MozillaThunderbird-translations-other-45.3.0-46.2 References: https://www.suse.com/security/cve/CVE-2016-2830.html https://www.suse.com/security/cve/CVE-2016-2836.html https://www.suse.com/security/cve/CVE-2016-2837.html https://www.suse.com/security/cve/CVE-2016-2838.html https://www.suse.com/security/cve/CVE-2016-2839.html https://www.suse.com/security/cve/CVE-2016-5252.html https://www.suse.com/security/cve/CVE-2016-5254.html https://www.suse.com/security/cve/CVE-2016-5258.html https://www.suse.com/security/cve/CVE-2016-5259.html https://www.suse.com/security/cve/CVE-2016-5262.html https://www.suse.com/security/cve/CVE-2016-5263.html https://www.suse.com/security/cve/CVE-2016-5264.html https://www.suse.com/security/cve/CVE-2016-5265.html https://www.suse.com/security/cve/CVE-2016-6354.html https://bugzilla.suse.com/990856 https://bugzilla.suse.com/991809

1 0

openSUSE-SU-2016:2253-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Sep '16

06 Sep '16

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2253-1 Rating: moderate References: #990856 #991809 Cross-References: CVE-2016-2830 CVE-2016-2836 CVE-2016-2837 CVE-2016-2838 CVE-2016-2839 CVE-2016-5252 CVE-2016-5254 CVE-2016-5258 CVE-2016-5259 CVE-2016-5262 CVE-2016-5263 CVE-2016-5264 CVE-2016-5265 CVE-2016-6354 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - update to Thunderbird 45.3.0 (boo#991809) * Disposition-Notification-To could not be used in mail.compose.other.header * "edit as new message" on a received message pre-filled the sender as the composing identity. * Certain messages caused corruption of the drafts summary database. security fixes: * MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards * MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed * MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content * MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 * MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering * MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus * MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown * MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events * MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes * MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback * MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation * MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects * MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file - Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch] - add a screenshot to appdata.xml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1057=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): MozillaThunderbird-45.3.0-9.1 MozillaThunderbird-debuginfo-45.3.0-9.1 MozillaThunderbird-debugsource-45.3.0-9.1 MozillaThunderbird-devel-45.3.0-9.1 MozillaThunderbird-translations-common-45.3.0-9.1 MozillaThunderbird-translations-other-45.3.0-9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-buildsymbols-45.3.0-9.1 References: https://www.suse.com/security/cve/CVE-2016-2830.html https://www.suse.com/security/cve/CVE-2016-2836.html https://www.suse.com/security/cve/CVE-2016-2837.html https://www.suse.com/security/cve/CVE-2016-2838.html https://www.suse.com/security/cve/CVE-2016-2839.html https://www.suse.com/security/cve/CVE-2016-5252.html https://www.suse.com/security/cve/CVE-2016-5254.html https://www.suse.com/security/cve/CVE-2016-5258.html https://www.suse.com/security/cve/CVE-2016-5259.html https://www.suse.com/security/cve/CVE-2016-5262.html https://www.suse.com/security/cve/CVE-2016-5263.html https://www.suse.com/security/cve/CVE-2016-5264.html https://www.suse.com/security/cve/CVE-2016-5265.html https://www.suse.com/security/cve/CVE-2016-6354.html https://bugzilla.suse.com/990856 https://bugzilla.suse.com/991809

1 0

openSUSE-SU-2016:2252-1: moderate: Security update for tomcat
by opensuse-security＠opensuse.org 06 Sep '16

06 Sep '16

openSUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2252-1 Rating: moderate References: #986359 #988489 Cross-References: CVE-2016-3092 CVE-2016-5388 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for tomcat fixes the following issues: - CVE-2016-3092: Usage of vulnerable FileUpload package can result in denial of service. (bsc#986359) - CVE-2016-5388: Setting HTTP_PROXY environment variable via Proxy header. (bsc#988489) This update was imported from the SUSE:SLE-12-SP1:Update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1056=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): tomcat-8.0.32-8.1 tomcat-admin-webapps-8.0.32-8.1 tomcat-docs-webapp-8.0.32-8.1 tomcat-el-3_0-api-8.0.32-8.1 tomcat-embed-8.0.32-8.1 tomcat-javadoc-8.0.32-8.1 tomcat-jsp-2_3-api-8.0.32-8.1 tomcat-jsvc-8.0.32-8.1 tomcat-lib-8.0.32-8.1 tomcat-servlet-3_1-api-8.0.32-8.1 tomcat-webapps-8.0.32-8.1 References: https://www.suse.com/security/cve/CVE-2016-3092.html https://www.suse.com/security/cve/CVE-2016-5388.html https://bugzilla.suse.com/986359 https://bugzilla.suse.com/988489

1 0

openSUSE-SU-2016:2250-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 06 Sep '16

06 Sep '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2250-1 Rating: important References: #995932 #996032 #99606 #996648 Cross-References: CVE-2016-5147 CVE-2016-5148 CVE-2016-5149 CVE-2016-5150 CVE-2016-5151 CVE-2016-5152 CVE-2016-5153 CVE-2016-5154 CVE-2016-5155 CVE-2016-5156 CVE-2016-5157 CVE-2016-5158 CVE-2016-5159 CVE-2016-5160 CVE-2016-5161 CVE-2016-5162 CVE-2016-5163 CVE-2016-5164 CVE-2016-5165 CVE-2016-5166 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: Chromium was updated to 53.0.2785.89 to fix a number of security issues. The following vulnerabilities were fixed: (boo#996648) - CVE-2016-5147: Universal XSS in Blink. - CVE-2016-5148: Universal XSS in Blink. - CVE-2016-5149: Script injection in extensions. - CVE-2016-5150: Use after free in Blink. - CVE-2016-5151: Use after free in PDFium. - CVE-2016-5152: Heap overflow in PDFium. - CVE-2016-5153: Use after destruction in Blink. - CVE-2016-5154: Heap overflow in PDFium. - CVE-2016-5155: Address bar spoofing. - CVE-2016-5156: Use after free in event bindings. - CVE-2016-5157: Heap overflow in PDFium. - CVE-2016-5158: Heap overflow in PDFium. - CVE-2016-5159: Heap overflow in PDFium. - CVE-2016-5161: Type confusion in Blink. - CVE-2016-5162: Extensions web accessible resources bypass. - CVE-2016-5163: Address bar spoofing. - CVE-2016-5164: Universal XSS using DevTools. - CVE-2016-5165: Script injection in DevTools. - CVE-2016-5166: SMB Relay Attack via Save Page As. - CVE-2016-5160: Extensions web accessible resources bypass. A number of tracked build system fixes are included. (boo#996032, boo#99606, boo#995932) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch 5568=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): chromedriver-53.0.2785.89-68.1 chromedriver-debuginfo-53.0.2785.89-68.1 chromium-53.0.2785.89-68.1 chromium-debuginfo-53.0.2785.89-68.1 chromium-desktop-gnome-53.0.2785.89-68.1 chromium-desktop-kde-53.0.2785.89-68.1 chromium-ffmpegsumo-53.0.2785.89-68.1 chromium-ffmpegsumo-debuginfo-53.0.2785.89-68.1 References: https://www.suse.com/security/cve/CVE-2016-5147.html https://www.suse.com/security/cve/CVE-2016-5148.html https://www.suse.com/security/cve/CVE-2016-5149.html https://www.suse.com/security/cve/CVE-2016-5150.html https://www.suse.com/security/cve/CVE-2016-5151.html https://www.suse.com/security/cve/CVE-2016-5152.html https://www.suse.com/security/cve/CVE-2016-5153.html https://www.suse.com/security/cve/CVE-2016-5154.html https://www.suse.com/security/cve/CVE-2016-5155.html https://www.suse.com/security/cve/CVE-2016-5156.html https://www.suse.com/security/cve/CVE-2016-5157.html https://www.suse.com/security/cve/CVE-2016-5158.html https://www.suse.com/security/cve/CVE-2016-5159.html https://www.suse.com/security/cve/CVE-2016-5160.html https://www.suse.com/security/cve/CVE-2016-5161.html https://www.suse.com/security/cve/CVE-2016-5162.html https://www.suse.com/security/cve/CVE-2016-5163.html https://www.suse.com/security/cve/CVE-2016-5164.html https://www.suse.com/security/cve/CVE-2016-5165.html https://www.suse.com/security/cve/CVE-2016-5166.html https://bugzilla.suse.com/995932 https://bugzilla.suse.com/996032 https://bugzilla.suse.com/99606 https://bugzilla.suse.com/996648

1 0

openSUSE-RU-2016:2244-1: moderate: Recommended update for python-ec2metadata
by maintenance＠opensuse.org 06 Sep '16

06 Sep '16

openSUSE Recommended Update: Recommended update for python-ec2metadata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2244-1 Rating: moderate References: #994138 #994139 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python-ec2metadata fixes the following issues: - Do not use proxy when looking up EC2 meta data (bsc#994138, bsc#994139) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1055=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): python-ec2metadata-1.5.4-5.1 References: https://bugzilla.suse.com/994138 https://bugzilla.suse.com/994139

1 0

openSUSE-RU-2016:2243-1: Recommended update for clamav-database
by maintenance＠opensuse.org 06 Sep '16

06 Sep '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2243-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh September 5th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1054=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201609050003-152.1 References:

1 0

openSUSE-SU-2016:2242-1: moderate: Security update for eog
by opensuse-security＠opensuse.org 05 Sep '16

05 Sep '16

openSUSE Security Update: Security update for eog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2242-1 Rating: moderate References: #994819 Cross-References: CVE-2016-6855 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for eog fixes the following issues: - Update to version 3.16.5 (boo#994819, CVE-2016-6855): + Bug fixes: - bgo#770143: CVE-2016-6855 out-of-bounds write in eog 3.10.2. - bgo#770197: eog leaks error message if loading an SVG fails. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1053=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1053=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): eog-3.16.5-9.1 eog-debuginfo-3.16.5-9.1 eog-debugsource-3.16.5-9.1 eog-devel-3.16.5-9.1 - openSUSE Leap 42.1 (noarch): eog-lang-3.16.5-9.1 - openSUSE 13.2 (i586 x86_64): eog-3.14.5-13.1 eog-debuginfo-3.14.5-13.1 eog-debugsource-3.14.5-13.1 eog-devel-3.14.5-13.1 - openSUSE 13.2 (noarch): eog-lang-3.14.5-13.1 References: https://www.suse.com/security/cve/CVE-2016-6855.html https://bugzilla.suse.com/994819

1 0