January 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2017:0218-1: moderate: Optional update for fwts
by maintenance＠opensuse.org 19 Jan '17

19 Jan '17

openSUSE Optional Update: Optional update for fwts ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0218-1 Rating: moderate References: #1017763 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update to fwts 16.12.00 brings the following improvements: - updated acpica - improved support for secureboot - improved support for ppc64le - support for building on s390x The update also contains a number of upstream bug fixes and miscellaneous improvements. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-125=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-125=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): fwts-16.12.00-3.1 fwts-debuginfo-16.12.00-3.1 fwts-debugsource-16.12.00-3.1 - openSUSE Leap 42.1 (i586 x86_64): fwts-16.12.00-6.1 fwts-debuginfo-16.12.00-6.1 fwts-debugsource-16.12.00-6.1 References: https://bugzilla.suse.com/1017763

1 0

openSUSE-RU-2017:0217-1: Recommended update for clamav-database
by maintenance＠opensuse.org 19 Jan '17

19 Jan '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0217-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Jan 16th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-128=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-128=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201701160006-28.1 - openSUSE Leap 42.1 (noarch): clamav-database-201701160006-207.1 References:

1 0

openSUSE-RU-2017:0216-1: moderate: Recommended update for libosinfo
by maintenance＠opensuse.org 19 Jan '17

19 Jan '17

openSUSE Recommended Update: Recommended update for libosinfo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0216-1 Rating: moderate References: #1012005 #1013983 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libosinfo fixes the following issues: - Incomplete capabilities list of SLE and openSUSE distributions. (bsc#1013983) - Use of the wrong bootloader tool to boot SLES 12-SP3 PV kernel on Xen platform. (bsc#1012005) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-123=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libosinfo-0.3.0-6.1 libosinfo-1_0-0-0.3.0-6.1 libosinfo-1_0-0-debuginfo-0.3.0-6.1 libosinfo-debuginfo-0.3.0-6.1 libosinfo-debugsource-0.3.0-6.1 libosinfo-devel-0.3.0-6.1 typelib-1_0-Libosinfo-1_0-0.3.0-6.1 - openSUSE Leap 42.2 (noarch): libosinfo-lang-0.3.0-6.1 References: https://bugzilla.suse.com/1012005 https://bugzilla.suse.com/1013983

1 0

openSUSE-RU-2017:0213-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 19 Jan '17

19 Jan '17

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0213-1 Rating: moderate References: #1012390 #1012591 #1012818 #1013989 #1015515 #1018214 #1018399 #909418 #912715 #945340 #953807 #963290 #990538 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 13 recommended fixes can now be installed. Description: This update for systemd fixes the following issues: - core: Make mount units from /proc/self/mountinfo possibly bind to a device. Fixes unmounting issues when ejecting CDs or DVDs. (bsc#909418, bsc#912715, bsc#945340) - fstab-generator: Remove bogus condition that leads to warnings on boot. (bsc#1013989) - coredumpctl: Let gdb handle the SIGINT signal. (bsc#1012591) - Ship kbd-model-map with the correct contents. (bsc#1015515) - rules: Set SYSTEMD_READY=0 on DM_UDEV_DISABLE_OTHER_RULES_FLAG=1 only with ADD event. (bsc#963290, bsc#990538) - tmpfiles: Don't skip path_set_perms on error. (bsc#953807) - nspawn: Properly handle image/directory paths that are symbolic links. (bsc#1012390) - systemctl: Fix 'is-enabled' exit status on failure when executed in chroot. (bsc#1012818) - Warnings emitted when udev socket units are restarted during package upgrade were silenced. (bsc#1018214) - prevent assert in PID1 (bsc#1018399) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-124=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsystemd0-228-19.1 libsystemd0-debuginfo-228-19.1 libsystemd0-mini-228-19.1 libsystemd0-mini-debuginfo-228-19.1 libudev-devel-228-19.1 libudev-mini-devel-228-19.1 libudev-mini1-228-19.1 libudev-mini1-debuginfo-228-19.1 libudev1-228-19.1 libudev1-debuginfo-228-19.1 nss-myhostname-228-19.1 nss-myhostname-debuginfo-228-19.1 nss-mymachines-228-19.1 nss-mymachines-debuginfo-228-19.1 systemd-228-19.1 systemd-debuginfo-228-19.1 systemd-debugsource-228-19.1 systemd-devel-228-19.1 systemd-logger-228-19.1 systemd-mini-228-19.1 systemd-mini-debuginfo-228-19.1 systemd-mini-debugsource-228-19.1 systemd-mini-devel-228-19.1 systemd-mini-sysvinit-228-19.1 systemd-sysvinit-228-19.1 udev-228-19.1 udev-debuginfo-228-19.1 udev-mini-228-19.1 udev-mini-debuginfo-228-19.1 - openSUSE Leap 42.2 (x86_64): libsystemd0-32bit-228-19.1 libsystemd0-debuginfo-32bit-228-19.1 libudev1-32bit-228-19.1 libudev1-debuginfo-32bit-228-19.1 nss-myhostname-32bit-228-19.1 nss-myhostname-debuginfo-32bit-228-19.1 systemd-32bit-228-19.1 systemd-debuginfo-32bit-228-19.1 - openSUSE Leap 42.2 (noarch): systemd-bash-completion-228-19.1 systemd-mini-bash-completion-228-19.1 References: https://bugzilla.suse.com/1012390 https://bugzilla.suse.com/1012591 https://bugzilla.suse.com/1012818 https://bugzilla.suse.com/1013989 https://bugzilla.suse.com/1015515 https://bugzilla.suse.com/1018214 https://bugzilla.suse.com/1018399 https://bugzilla.suse.com/909418 https://bugzilla.suse.com/912715 https://bugzilla.suse.com/945340 https://bugzilla.suse.com/953807 https://bugzilla.suse.com/963290 https://bugzilla.suse.com/990538

1 0

openSUSE-RU-2017:0212-1: moderate: Recommended update for krusader
by maintenance＠opensuse.org 19 Jan '17

19 Jan '17

openSUSE Recommended Update: Recommended update for krusader ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0212-1 Rating: moderate References: #1016980 #1017533 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for krusader fixes the following issues: - Fix behavior when pressing the left/right cursor keys in brief view. (boo#1017533, kde#374238) - Add KDE's service actions to the right click popup menu in krusader again. (boo#1016980, kde#372231) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-122=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kio_iso-2.5.0-6.1 kio_iso-debuginfo-2.5.0-6.1 krusader-2.5.0-6.1 krusader-debuginfo-2.5.0-6.1 krusader-debugsource-2.5.0-6.1 krusader-doc-2.5.0-6.1 References: https://bugzilla.suse.com/1016980 https://bugzilla.suse.com/1017533

1 0

openSUSE-SU-2017:0208-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 19 Jan '17

19 Jan '17

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0208-1 Rating: moderate References: #1003810 Cross-References: CVE-2016-8568 CVE-2016-8569 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libgit2 fixes the following issues: - CVE-2016-8568: Fixed and out-of-bounds read in git_oid_nfmt (bsc#1003810). - CVE-2016-8569: DoS using a null pointer dereference in git_commit_message (bsc#1003810). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-121=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgit2-22-0.22.1-5.1 libgit2-22-debuginfo-0.22.1-5.1 libgit2-debugsource-0.22.1-5.1 libgit2-devel-0.22.1-5.1 - openSUSE Leap 42.1 (x86_64): libgit2-22-32bit-0.22.1-5.1 libgit2-22-debuginfo-32bit-0.22.1-5.1 References: https://www.suse.com/security/cve/CVE-2016-8568.html https://www.suse.com/security/cve/CVE-2016-8569.html https://bugzilla.suse.com/1003810

1 0

openSUSE-SU-2017:0207-1: important: Security update for openjpeg2
by opensuse-security＠opensuse.org 19 Jan '17

19 Jan '17

openSUSE Security Update: Security update for openjpeg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0207-1 Rating: important References: #1002414 #1007739 #1007740 #1007741 #1007742 #1007743 #1007744 #1007747 #1014543 #1014975 #999817 Cross-References: CVE-2016-7445 CVE-2016-8332 CVE-2016-9112 CVE-2016-9113 CVE-2016-9114 CVE-2016-9115 CVE-2016-9116 CVE-2016-9117 CVE-2016-9118 CVE-2016-9572 CVE-2016-9573 CVE-2016-9580 CVE-2016-9581 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for openjpeg2 fixes the following issues: * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could lead to heap buffer overflow [bsc#1014543] * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer overflow and infite loop [bsc#1014975] * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash [bsc#999817] * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to code execution [bsc#1002414] * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523 [bsc#1007747] * CVE-2016-9113: NULL point dereference in function imagetobmp of convertbmp.c could lead to crash [bsc#1007739] * CVE-2016-9114: NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) could lead to crash [bsc#1007740] * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.c(jp2) [bsc#1007741] * CVE-2016-9116: NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) [bsc#1007742] * CVE-2016-9117: NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 [bsc#1007743] * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c [bsc#1007744] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-120=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenjp2-7-2.1.0-9.1 libopenjp2-7-debuginfo-2.1.0-9.1 openjpeg2-2.1.0-9.1 openjpeg2-debuginfo-2.1.0-9.1 openjpeg2-debugsource-2.1.0-9.1 openjpeg2-devel-2.1.0-9.1 - openSUSE Leap 42.1 (x86_64): libopenjp2-7-32bit-2.1.0-9.1 libopenjp2-7-debuginfo-32bit-2.1.0-9.1 References: https://www.suse.com/security/cve/CVE-2016-7445.html https://www.suse.com/security/cve/CVE-2016-8332.html https://www.suse.com/security/cve/CVE-2016-9112.html https://www.suse.com/security/cve/CVE-2016-9113.html https://www.suse.com/security/cve/CVE-2016-9114.html https://www.suse.com/security/cve/CVE-2016-9115.html https://www.suse.com/security/cve/CVE-2016-9116.html https://www.suse.com/security/cve/CVE-2016-9117.html https://www.suse.com/security/cve/CVE-2016-9118.html https://www.suse.com/security/cve/CVE-2016-9572.html https://www.suse.com/security/cve/CVE-2016-9573.html https://www.suse.com/security/cve/CVE-2016-9580.html https://www.suse.com/security/cve/CVE-2016-9581.html https://bugzilla.suse.com/1002414 https://bugzilla.suse.com/1007739 https://bugzilla.suse.com/1007740 https://bugzilla.suse.com/1007741 https://bugzilla.suse.com/1007742 https://bugzilla.suse.com/1007743 https://bugzilla.suse.com/1007744 https://bugzilla.suse.com/1007747 https://bugzilla.suse.com/1014543 https://bugzilla.suse.com/1014975 https://bugzilla.suse.com/999817

1 0

openSUSE-SU-2017:0199-1: moderate: Security update for v8
by opensuse-security＠opensuse.org 18 Jan '17

18 Jan '17

openSUSE Security Update: Security update for v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0199-1 Rating: moderate References: #1013274 Cross-References: CVE-2016-5219 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for v8 fixes the following issues: - maliciously crafted java script code could cause v8 in chromium to crash Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-119=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libv8-5-5.3.332-3.1 libv8-5-debuginfo-5.3.332-3.1 v8-5.3.332-3.1 v8-debuginfo-5.3.332-3.1 v8-debugsource-5.3.332-3.1 v8-devel-5.3.332-3.1 v8-private-headers-devel-5.3.332-3.1 References: https://www.suse.com/security/cve/CVE-2016-5219.html https://bugzilla.suse.com/1013274

1 0

openSUSE-RU-2017:0198-1: End of maintenance announcement for openSUSE 13.2
by maintenance＠opensuse.org 18 Jan '17

18 Jan '17

openSUSE Recommended Update: End of maintenance announcement for openSUSE 13.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0198-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This announcement marks the end of the maintenance period for openSUSE 13.2. In order to keep your systems up to date and secure, please migrate your systems to the current openSUSE version. For more information on how to upgrade to the current openSUSE version, please read: http://en.opensuse.org/SDB:Distribution-Upgrade Please make sure that you applied all maintenance updates provided for openSUSE 13.2 before starting the update. Thank you for using openSUSE, your Maintenance and Security Team Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2017-118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): release-notes-openSUSE-13.2.20170117-26.2 References:

1 0

openSUSE-SU-2017:0195-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 18 Jan '17

18 Jan '17

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0195-1 Rating: moderate References: #1003810 Cross-References: CVE-2016-8568 CVE-2016-8569 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: AThis update for libgit2 fixes the following issues: - CVE-2016-8568: invalid memory accesses parsing object files (out-of-bound read) (boo#1003810) - CVE-2016-8569: invalid memory accesses parsing object files (NULL pointer de-reference) (boo#1003810) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-117=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): libgit2-24-0.24.3-6.1 libgit2-devel-0.24.3-6.1 References: https://www.suse.com/security/cve/CVE-2016-8568.html https://www.suse.com/security/cve/CVE-2016-8569.html https://bugzilla.suse.com/1003810

1 0