January 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:0345-1: Recommended update for python-openqa_review
by maintenance＠opensuse.org 31 Jan '17

31 Jan '17

openSUSE Recommended Update: Recommended update for python-openqa_review ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0345-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides python-openqa_review 1.4.0, which brings several fixes and improvements: - Add tumblesle example scripts. - Use index.json to get job groups. - Prepare for wellformed json. - Handle broken bug-references gracefully. - Fix for parent groups: Use API to get job_groups. - Use JSON version of group_overview. - Add entry about configparser travis error. - Ensure configparser is available for py2+3. - Fix py27 errors only observable on travis. - Handle job groups with builds not having any 'done' jobs at all. - Try to get distribution/version for each build. - Ensure proper URL concatenation on py2 for bug details retrieval. - Show parent group in report. - Add tumblesle helper script for 12sp3. - Add update_jekyll for tumblesle release. - Use blank build value without version prefix. - Comment on old bugs with new failed test url. - Fix flake8 reported issues after 48fb659. - Fix parsing of job groups after openQA#9b50b22. - Run all environments on travis. - Add command line option for '--min-days-unchanged' for reminder comments. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-185=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): python-openqa_review-1.4.0-3.1 References:

1 0

openSUSE-SU-2017:0344-1: moderate: Security update for openssh
by opensuse-security＠opensuse.org 31 Jan '17

31 Jan '17

openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0344-1 Rating: moderate References: #1005480 #1005893 #1006221 #1016366 #1016368 #1016369 #1016370 #1021626 Cross-References: CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012 CVE-2016-8858 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for openssh fixes several issues. These security issues were fixed: - CVE-2016-8858: The kex_input_kexinit function in kex.c allowed remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests (bsc#1005480). - CVE-2016-10012: The shared memory manager (associated with pre-authentication compression) did not ensure that a bounds check is enforced by all compilers, which might allowed local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures (bsc#1016370). - CVE-2016-10009: Untrusted search path vulnerability in ssh-agent.c allowed remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket (bsc#1016366). - CVE-2016-10010: When forwarding unix domain sockets with privilege separation disabled, the resulting sockets have be created as 'root' instead of the authenticated user. Forwarding unix domain sockets without privilege separation enabled is now rejected. - CVE-2016-10011: authfile.c in sshd did not properly consider the effects of realloc on buffer contents, which might allowed local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process (bsc#1016369). These non-security issues were fixed: - Adjusted suggested command for removing conflicting server keys from the known_hosts file (bsc#1006221) - Properly verify CIDR masks in configuration (bsc#1005893 bsc#1021626) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-184=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): openssh-7.2p2-9.1 openssh-askpass-gnome-7.2p2-9.1 openssh-askpass-gnome-debuginfo-7.2p2-9.1 openssh-cavs-7.2p2-9.1 openssh-debuginfo-7.2p2-9.1 openssh-debugsource-7.2p2-9.1 openssh-fips-7.2p2-9.1 openssh-helpers-7.2p2-9.1 openssh-helpers-debuginfo-7.2p2-9.1 References: https://www.suse.com/security/cve/CVE-2016-10009.html https://www.suse.com/security/cve/CVE-2016-10010.html https://www.suse.com/security/cve/CVE-2016-10011.html https://www.suse.com/security/cve/CVE-2016-10012.html https://www.suse.com/security/cve/CVE-2016-8858.html https://bugzilla.suse.com/1005480 https://bugzilla.suse.com/1005893 https://bugzilla.suse.com/1006221 https://bugzilla.suse.com/1016366 https://bugzilla.suse.com/1016368 https://bugzilla.suse.com/1016369 https://bugzilla.suse.com/1016370 https://bugzilla.suse.com/1021626

1 0

openSUSE-RU-2017:0343-1: moderate: Recommended update for steam
by maintenance＠opensuse.org 31 Jan '17

31 Jan '17

openSUSE Recommended Update: Recommended update for steam ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0343-1 Rating: moderate References: #1022010 Affected Products: openSUSE Leap 42.2:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for steam fixes the following issues: - Fix steam controller in wireless mode. (boo#1022010) - Update udev rules for HTC Vive and order them so they run after 50-udev-default.rules but before 73-seat-late.rules. - Add appdata.xml for https://software.opensuse.org/appstore. - Surround all home directory usages with quotes. - Search and remove libstdc from steam library directories to ensure apps shipping their own incompatible versions work. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-183=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (i586 x86_64): steam-1.0.0.54-3.1 steam-controller-1.0.0.54-3.1 steam-vr-1.0.0.54-3.1 References: https://bugzilla.suse.com/1022010

1 0

openSUSE-RU-2017:0342-1: Recommended update for opera
by maintenance＠opensuse.org 31 Jan '17

31 Jan '17

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0342-1 Rating: low References: Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for Opera fixes the following issues: - Update to version 42.0.2393.517: - Wrong anchor to currency converter help link - LocationConfiguration retry timer can target wrong object - Currency converter not recognising decimal separator correctly Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-182=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2017-182=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-42.0.2393.517-18.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-42.0.2393.517-55.1 References:

1 0

openSUSE-RU-2017:0337-1: important: Recommended update for python-paramiko
by maintenance＠opensuse.org 31 Jan '17

31 Jan '17

openSUSE Recommended Update: Recommended update for python-paramiko ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0337-1 Rating: important References: #1020340 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-paramiko fixes the following issues: - Don't pass IV to pycrypto when using MODE_CTR. (boo#1020340) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-180=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): python-paramiko-1.15.2-4.1 References: https://bugzilla.suse.com/1020340

1 0

openSUSE-SU-2017:0336-1: moderate: Security update for lcms2
by opensuse-security＠opensuse.org 31 Jan '17

31 Jan '17

openSUSE Security Update: Security update for lcms2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0336-1 Rating: moderate References: #1021364 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for lcms2 to version 2.8 fixes the following issues: This security issue was fixed: - Fixed an out-of-bounds heap read in Type_MLU_Read that could be triggered by an untrusted image with a crafted ICC profile (boo#1021364). These non-security issues were fixed: * Fixed many typos in comments, thanks to Stefan Weil for doing that. * Fixed localization bug, added a new test case crayons.icc thnaks to Richard Hughes for providing the profile. * Fixed a bug in optimizer that made some formats (i.e, bits planar) unavailable * Fixed misalignment problems on Alpha. The compiler does not align strings, and accessing begin of string as a uint16 makes code to fail. * Added some extra checks to the tools and examples. * Fix a bug that prevented to read luminance tag * BIG amount of functionality contributed/Sponsored by Alien Skin Software: TransformStride, copyAlpha, performance plug-ins. Fixes some warnings as well. * added an extra _ to _stdcall to make it more portable * Fixed a bug in transicc for named color profiles * Fixed several compiler warnings * Added support for Visual Studio 2015 * Fixed for XCODE project * Update to GNOME 3.20 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-179=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): lcms2-2.8-3.1 lcms2-debuginfo-2.8-3.1 lcms2-debugsource-2.8-3.1 liblcms2-2-2.8-3.1 liblcms2-2-debuginfo-2.8-3.1 liblcms2-devel-2.8-3.1 - openSUSE Leap 42.1 (x86_64): liblcms2-2-32bit-2.8-3.1 liblcms2-2-debuginfo-32bit-2.8-3.1 liblcms2-devel-32bit-2.8-3.1 - openSUSE Leap 42.1 (noarch): liblcms2-doc-2.8-3.1 References: https://bugzilla.suse.com/1021364

1 0

openSUSE-SU-2017:0332-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 30 Jan '17

30 Jan '17

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0332-1 Rating: important References: #1020856 Cross-References: CVE-2016-5545 CVE-2017-3290 CVE-2017-3316 CVE-2017-3332 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for virtualbox to version 5.0.32 fixes the following issues: These security issues were fixed: - CVE-2016-5545: Vulnerability in the GUI subcomponent of virtualbox allows unauthenticated attacker unauthorized update, insert or delete access to some data as well as unauthorized read access to a subset of VirtualBox accessible data and unauthorized ability to cause a partial denial of service (bsc#1020856). - CVE-2017-3290: Vulnerability in the Shared Folder subcomponent of virtualbox allows high privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). - CVE-2017-3316: Vulnerability in the GUI subcomponent of virtualbox allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox (bsc#1020856). - CVE-2017-3332: Vulnerability in the SVGA Emulation subcomponent of virtualbox allows low privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). For other changes please read the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-178=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (x86_64): python-virtualbox-5.0.32-34.1 python-virtualbox-debuginfo-5.0.32-34.1 virtualbox-5.0.32-34.1 virtualbox-debuginfo-5.0.32-34.1 virtualbox-debugsource-5.0.32-34.1 virtualbox-devel-5.0.32-34.1 virtualbox-guest-kmp-default-5.0.32_k4.1.36_44-34.1 virtualbox-guest-kmp-default-debuginfo-5.0.32_k4.1.36_44-34.1 virtualbox-guest-tools-5.0.32-34.1 virtualbox-guest-tools-debuginfo-5.0.32-34.1 virtualbox-guest-x11-5.0.32-34.1 virtualbox-guest-x11-debuginfo-5.0.32-34.1 virtualbox-host-kmp-default-5.0.32_k4.1.36_44-34.1 virtualbox-host-kmp-default-debuginfo-5.0.32_k4.1.36_44-34.1 virtualbox-qt-5.0.32-34.1 virtualbox-qt-debuginfo-5.0.32-34.1 virtualbox-websrv-5.0.32-34.1 virtualbox-websrv-debuginfo-5.0.32-34.1 - openSUSE Leap 42.1 (noarch): virtualbox-guest-desktop-icons-5.0.32-34.1 virtualbox-host-source-5.0.32-34.1 References: https://www.suse.com/security/cve/CVE-2016-5545.html https://www.suse.com/security/cve/CVE-2017-3290.html https://www.suse.com/security/cve/CVE-2017-3316.html https://www.suse.com/security/cve/CVE-2017-3332.html https://bugzilla.suse.com/1020856

1 0

openSUSE-RU-2017:0328-1: Recommended update for yast2-network
by maintenance＠opensuse.org 28 Jan '17

28 Jan '17

openSUSE Recommended Update: Recommended update for yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0328-1 Rating: low References: #1005721 #1007172 #968692 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for yast2-network provides the following fixes: - Improved parsing of VLAN IDs that are longer than one character. (bsc#968692) - When an interface is enslaved in a bond the udev rule is modified using the bus_id instead of the mac address but some multiport cards could use the same bus_id. In such cases also the dev_port is needed. Taking this in account the dev_port will be added always when a udev rule based on bus_id is written. (bsc#1007172, bsc#1005721) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-177=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): yast2-network-3.1.140.10-15.1 yast2-network-devel-doc-3.1.140.10-15.1 References: https://bugzilla.suse.com/1005721 https://bugzilla.suse.com/1007172 https://bugzilla.suse.com/968692

1 0

openSUSE-OU-2017:0327-1: Initial update for cups-pdf
by maintenance＠opensuse.org 28 Jan '17

28 Jan '17

openSUSE Optional Update: Initial update for cups-pdf ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0327-1 Rating: low References: #1020127 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This optional update introduces cups-pdf to 42.2. cups-pdf is a PDF writer backend or CUPS. It provides a virtual CUPS-PDF printer which produces PDF file so that application programs which have no built-in support to "Save as PDF" could print to CUPS-PDF to get a PDF file. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-167=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): cups-pdf-3.0.0-2.1 cups-pdf-debuginfo-3.0.0-2.1 cups-pdf-debugsource-3.0.0-2.1 References: https://bugzilla.suse.com/1020127

1 0

openSUSE-RU-2017:0326-1: Recommended update for yast2-storage
by maintenance＠opensuse.org 28 Jan '17

28 Jan '17

openSUSE Recommended Update: Recommended update for yast2-storage ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0326-1 Rating: low References: #1008740 #907331 #933517 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for yast2-storage fixes the following issues: - Avoid recurring error pop-up in the expert partitioner (bsc#1008740) - Fixed installing required storage packages for unmounted filesystems (bsc#907331) - Removed displaying /var/log/messages (bsc#933517) - Make subvolumes configurable in control.xml (fate#321737) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-160=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-storage-3.1.106-3.1 yast2-storage-debuginfo-3.1.106-3.1 yast2-storage-debugsource-3.1.106-3.1 yast2-storage-devel-3.1.106-3.1 References: https://bugzilla.suse.com/1008740 https://bugzilla.suse.com/907331 https://bugzilla.suse.com/933517

1 0