January 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0297-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 27 Jan '17

27 Jan '17

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0297-1 Rating: moderate References: #1013648 Cross-References: CVE-2016-8740 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for apache2 fixes the following issues: - CVE-2016-8740 Server memory can be exhausted and service denied when HTTP/2 is used [bsc#1013648] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-154=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-2.4.23-6.1 apache2-debuginfo-2.4.23-6.1 apache2-debugsource-2.4.23-6.1 apache2-devel-2.4.23-6.1 apache2-event-2.4.23-6.1 apache2-event-debuginfo-2.4.23-6.1 apache2-example-pages-2.4.23-6.1 apache2-prefork-2.4.23-6.1 apache2-prefork-debuginfo-2.4.23-6.1 apache2-utils-2.4.23-6.1 apache2-utils-debuginfo-2.4.23-6.1 apache2-worker-2.4.23-6.1 apache2-worker-debuginfo-2.4.23-6.1 - openSUSE Leap 42.2 (noarch): apache2-doc-2.4.23-6.1 References: https://www.suse.com/security/cve/CVE-2016-8740.html https://bugzilla.suse.com/1013648

1 0

openSUSE-RU-2017:0296-1: moderate: Recommended update for fate
by maintenance＠opensuse.org 27 Jan '17

27 Jan '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0296-1 Rating: moderate References: #980276 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fate fixes the following issues: - FATE may not show certain button icons in a fresh GNOME installation (boo#980276) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-155=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-155=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): fate-1.5.5.5-15.1 fate-debuginfo-1.5.5.5-15.1 fate-debugsource-1.5.5.5-15.1 - openSUSE Leap 42.1 (i586 x86_64): fate-1.5.5.5-15.1 fate-debuginfo-1.5.5.5-15.1 fate-debugsource-1.5.5.5-15.1 References: https://bugzilla.suse.com/980276

1 0

openSUSE-SU-2017:0291-1: moderate: Security update for gstreamer-0_10-plugins-bad
by opensuse-security＠opensuse.org 26 Jan '17

26 Jan '17

openSUSE Security Update: Security update for gstreamer-0_10-plugins-bad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0291-1 Rating: moderate References: #1013659 Cross-References: CVE-2016-9809 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-0_10-plugins-bad fixes the following issue: - CVE-2016-9809: Off by one read in gst_h264_parse_set_caps() (bsc#1013659) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-152=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gstreamer-0_10-plugins-bad-0.10.23-25.1 gstreamer-0_10-plugins-bad-debuginfo-0.10.23-25.1 gstreamer-0_10-plugins-bad-debugsource-0.10.23-25.1 gstreamer-0_10-plugins-bad-devel-0.10.23-25.1 gstreamer-0_10-plugins-bad-doc-0.10.23-25.1 libgstbasecamerabinsrc-0_10-23-0.10.23-25.1 libgstbasecamerabinsrc-0_10-23-debuginfo-0.10.23-25.1 libgstbasevideo-0_10-23-0.10.23-25.1 libgstbasevideo-0_10-23-debuginfo-0.10.23-25.1 libgstcodecparsers-0_10-23-0.10.23-25.1 libgstcodecparsers-0_10-23-debuginfo-0.10.23-25.1 libgstphotography-0_10-23-0.10.23-25.1 libgstphotography-0_10-23-debuginfo-0.10.23-25.1 libgstsignalprocessor-0_10-23-0.10.23-25.1 libgstsignalprocessor-0_10-23-debuginfo-0.10.23-25.1 libgstvdp-0_10-23-0.10.23-25.1 libgstvdp-0_10-23-debuginfo-0.10.23-25.1 - openSUSE Leap 42.1 (noarch): gstreamer-0_10-plugins-bad-lang-0.10.23-25.1 - openSUSE Leap 42.1 (x86_64): gstreamer-0_10-plugins-bad-32bit-0.10.23-25.1 gstreamer-0_10-plugins-bad-debuginfo-32bit-0.10.23-25.1 libgstbasecamerabinsrc-0_10-23-32bit-0.10.23-25.1 libgstbasecamerabinsrc-0_10-23-debuginfo-32bit-0.10.23-25.1 libgstbasevideo-0_10-23-32bit-0.10.23-25.1 libgstbasevideo-0_10-23-debuginfo-32bit-0.10.23-25.1 libgstcodecparsers-0_10-23-32bit-0.10.23-25.1 libgstcodecparsers-0_10-23-debuginfo-32bit-0.10.23-25.1 libgstphotography-0_10-23-32bit-0.10.23-25.1 libgstphotography-0_10-23-debuginfo-32bit-0.10.23-25.1 libgstsignalprocessor-0_10-23-32bit-0.10.23-25.1 libgstsignalprocessor-0_10-23-debuginfo-32bit-0.10.23-25.1 libgstvdp-0_10-23-32bit-0.10.23-25.1 libgstvdp-0_10-23-debuginfo-32bit-0.10.23-25.1 References: https://www.suse.com/security/cve/CVE-2016-9809.html https://bugzilla.suse.com/1013659

1 0

openSUSE-SU-2017:0290-1: moderate: Security update for tigervnc
by opensuse-security＠opensuse.org 26 Jan '17

26 Jan '17

openSUSE Security Update: Security update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0290-1 Rating: moderate References: #1019274 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tigervnc fixes one issue. This security issue was fixed: - boo#1019274: Prevent the server from overflowing a buffer in the client, causing DoS or potentially code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-151=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-151=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libXvnc-devel-1.6.0-6.1 libXvnc1-1.6.0-6.1 libXvnc1-debuginfo-1.6.0-6.1 tigervnc-1.6.0-6.1 tigervnc-debuginfo-1.6.0-6.1 tigervnc-debugsource-1.6.0-6.1 xorg-x11-Xvnc-1.6.0-6.1 xorg-x11-Xvnc-debuginfo-1.6.0-6.1 - openSUSE Leap 42.1 (i586 x86_64): tigervnc-1.5.0-27.1 tigervnc-debuginfo-1.5.0-27.1 tigervnc-debugsource-1.5.0-27.1 xorg-x11-Xvnc-1.5.0-27.1 xorg-x11-Xvnc-debuginfo-1.5.0-27.1 References: https://bugzilla.suse.com/1019274

1 0

openSUSE-SU-2017:0287-1: important: Security update for systemd
by opensuse-security＠opensuse.org 25 Jan '17

25 Jan '17

openSUSE Security Update: Security update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0287-1 Rating: important References: #1012266 #1014560 #1014566 #1020601 #997682 Cross-References: CVE-2016-10156 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for systemd fixes the following issues: This security issue was fixed: - CVE-2016-10156: Fix permissions set on permanent timer timestamp files, preventing local unprivileged users from escalating privileges (bsc#1020601). These non-security issues were fixed: - Fix permission set on /var/lib/systemd/linger/* - install: follow config_path symlink (#3362) - install: fix disable when /etc/systemd/system is a symlink (bsc#1014560) - run: make --slice= work in conjunction with --scope (bsc#1014566) - core: don't dispatch load queue when setting Slice= for transient units - systemctl: remove duplicate entries showed by list-dependencies (#5049) (bsc#1012266) - rule: don't automatically online standby memory on s390x (bsc#997682) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-150=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsystemd0-228-22.1 libsystemd0-debuginfo-228-22.1 libsystemd0-mini-228-22.1 libsystemd0-mini-debuginfo-228-22.1 libudev-devel-228-22.1 libudev-mini-devel-228-22.1 libudev-mini1-228-22.1 libudev-mini1-debuginfo-228-22.1 libudev1-228-22.1 libudev1-debuginfo-228-22.1 nss-myhostname-228-22.1 nss-myhostname-debuginfo-228-22.1 nss-mymachines-228-22.1 nss-mymachines-debuginfo-228-22.1 systemd-228-22.1 systemd-debuginfo-228-22.1 systemd-debugsource-228-22.1 systemd-devel-228-22.1 systemd-logger-228-22.1 systemd-mini-228-22.1 systemd-mini-debuginfo-228-22.1 systemd-mini-debugsource-228-22.1 systemd-mini-devel-228-22.1 systemd-mini-sysvinit-228-22.1 systemd-sysvinit-228-22.1 udev-228-22.1 udev-debuginfo-228-22.1 udev-mini-228-22.1 udev-mini-debuginfo-228-22.1 - openSUSE Leap 42.2 (x86_64): libsystemd0-32bit-228-22.1 libsystemd0-debuginfo-32bit-228-22.1 libudev1-32bit-228-22.1 libudev1-debuginfo-32bit-228-22.1 nss-myhostname-32bit-228-22.1 nss-myhostname-debuginfo-32bit-228-22.1 systemd-32bit-228-22.1 systemd-debuginfo-32bit-228-22.1 - openSUSE Leap 42.2 (noarch): systemd-bash-completion-228-22.1 systemd-mini-bash-completion-228-22.1 References: https://www.suse.com/security/cve/CVE-2016-10156.html https://bugzilla.suse.com/1012266 https://bugzilla.suse.com/1014560 https://bugzilla.suse.com/1014566 https://bugzilla.suse.com/1020601 https://bugzilla.suse.com/997682

1 0

openSUSE-RU-2017:0285-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 25 Jan '17

25 Jan '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0285-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database refreshes the database. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-149=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-149=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201701230006-31.1 - openSUSE Leap 42.1 (noarch): clamav-database-201701230006-210.1 References:

1 0

openSUSE-RU-2017:0284-1: Recommended update for dracut
by maintenance＠opensuse.org 25 Jan '17

25 Jan '17

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0284-1 Rating: low References: #1007648 #915218 #995812 #998440 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for dracut provides the following fixes: - Set persistent policy to by-path on s390 platforms to prevent the system from hanging during boot when vDISKs are used as swap devices. (bsc#915218) - Correctly handle incomplete ibft bootflag settings. (bsc#1007648) - Do not pass ifname for bonding devices. (bsc#995812) - Always try to load the pinctrl-cherryview kernel module. (bsc#998440) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-146=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dracut-044-14.1 dracut-debuginfo-044-14.1 dracut-debugsource-044-14.1 dracut-fips-044-14.1 dracut-tools-044-14.1 References: https://bugzilla.suse.com/1007648 https://bugzilla.suse.com/915218 https://bugzilla.suse.com/995812 https://bugzilla.suse.com/998440

1 0

openSUSE-RU-2017:0283-1: Recommended update for yast2-installation
by maintenance＠opensuse.org 25 Jan '17

25 Jan '17

openSUSE Recommended Update: Recommended update for yast2-installation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0283-1 Rating: low References: #1013976 #988377 #999895 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for yast2-installation provides the following fixes: - Do not crash when the proposal screen is configured through an AutoYaST profile and tabs are not being used. (bsc#1013976) - AutoYaST upgrade: Respect user-defined timeouts for errors, messages and pop-ups in general. (bsc#999895) - Fix missing icon next to SSH Key Import in AutoYaST. (bsc#988377) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-148=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): yast2-installation-3.1.218-3.1 References: https://bugzilla.suse.com/1013976 https://bugzilla.suse.com/988377 https://bugzilla.suse.com/999895

1 0

openSUSE-RU-2017:0282-1: Recommended update for libqt5-qtdeclarative
by maintenance＠opensuse.org 25 Jan '17

25 Jan '17

openSUSE Recommended Update: Recommended update for libqt5-qtdeclarative ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0282-1 Rating: low References: #1016882 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libqt5-qtdeclarative fixes the following issue: - Wrong string comparison in V4 javascript engine (bsc#1016882) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-145=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libQtQuick5-5.6.1-5.1 libQtQuick5-debuginfo-5.6.1-5.1 libqt5-qtdeclarative-debugsource-5.6.1-5.1 libqt5-qtdeclarative-devel-5.6.1-5.1 libqt5-qtdeclarative-devel-debuginfo-5.6.1-5.1 libqt5-qtdeclarative-examples-5.6.1-5.1 libqt5-qtdeclarative-examples-debuginfo-5.6.1-5.1 libqt5-qtdeclarative-tools-5.6.1-5.1 libqt5-qtdeclarative-tools-debuginfo-5.6.1-5.1 - openSUSE Leap 42.2 (noarch): libqt5-qtdeclarative-private-headers-devel-5.6.1-5.1 - openSUSE Leap 42.2 (x86_64): libQtQuick5-32bit-5.6.1-5.1 libQtQuick5-debuginfo-32bit-5.6.1-5.1 libqt5-qtdeclarative-devel-32bit-5.6.1-5.1 libqt5-qtdeclarative-devel-debuginfo-32bit-5.6.1-5.1 References: https://bugzilla.suse.com/1016882

1 0

openSUSE-RU-2017:0281-1: moderate: Recommended update for python-jenkins-job-builder
by maintenance＠opensuse.org 25 Jan '17

25 Jan '17

openSUSE Recommended Update: Recommended update for python-jenkins-job-builder ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0281-1 Rating: moderate References: #1019600 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-jenkins-job-builder fixes the following issues: - Fix creation of wrong timeout config by python-jenkins-job-builder. (boo#1019600) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-147=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): python-jenkins-job-builder-1.6.1-3.1 References: https://bugzilla.suse.com/1019600

1 0