October 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:2879-1: Recommended update for corosync
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for corosync ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2879-1 Rating: low References: #1032634 #1047862 #1060767 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for corosync fixes the following issues: - Don't terminate with assertion error after a network interface goes down. (bsc#1032634) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1204=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): corosync-2.3.6-7.1 corosync-debuginfo-2.3.6-7.1 corosync-debugsource-2.3.6-7.1 corosync-testagents-2.3.6-7.1 corosync-testagents-debuginfo-2.3.6-7.1 libcorosync-devel-2.3.6-7.1 libcorosync4-2.3.6-7.1 libcorosync4-debuginfo-2.3.6-7.1 - openSUSE Leap 42.3 (x86_64): libcorosync4-32bit-2.3.6-7.1 libcorosync4-debuginfo-32bit-2.3.6-7.1 References: https://bugzilla.suse.com/1032634 https://bugzilla.suse.com/1047862 https://bugzilla.suse.com/1060767

1 0

openSUSE-SU-2017:2878-1: moderate: Security update for libvirt
by opensuse-security＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2878-1 Rating: moderate References: #1062563 #1062620 Cross-References: CVE-2017-1000256 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libvirt fixes the following issues: Security issue fixed: - CVE-2017-1000256: Ensure TLS clients always verify the server certificate in the serial/TLS support. (bsc#1062563) Non security issue fixed: - libvirt-daemon-qemu requires libvirt-daemon-driver-storage (bsc#1062620) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1213=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libvirt-3.3.0-9.1 libvirt-admin-3.3.0-9.1 libvirt-admin-debuginfo-3.3.0-9.1 libvirt-client-3.3.0-9.1 libvirt-client-debuginfo-3.3.0-9.1 libvirt-daemon-3.3.0-9.1 libvirt-daemon-config-network-3.3.0-9.1 libvirt-daemon-config-nwfilter-3.3.0-9.1 libvirt-daemon-debuginfo-3.3.0-9.1 libvirt-daemon-driver-interface-3.3.0-9.1 libvirt-daemon-driver-interface-debuginfo-3.3.0-9.1 libvirt-daemon-driver-lxc-3.3.0-9.1 libvirt-daemon-driver-lxc-debuginfo-3.3.0-9.1 libvirt-daemon-driver-network-3.3.0-9.1 libvirt-daemon-driver-network-debuginfo-3.3.0-9.1 libvirt-daemon-driver-nodedev-3.3.0-9.1 libvirt-daemon-driver-nodedev-debuginfo-3.3.0-9.1 libvirt-daemon-driver-nwfilter-3.3.0-9.1 libvirt-daemon-driver-nwfilter-debuginfo-3.3.0-9.1 libvirt-daemon-driver-qemu-3.3.0-9.1 libvirt-daemon-driver-qemu-debuginfo-3.3.0-9.1 libvirt-daemon-driver-secret-3.3.0-9.1 libvirt-daemon-driver-secret-debuginfo-3.3.0-9.1 libvirt-daemon-driver-storage-3.3.0-9.1 libvirt-daemon-driver-storage-core-3.3.0-9.1 libvirt-daemon-driver-storage-core-debuginfo-3.3.0-9.1 libvirt-daemon-driver-storage-disk-3.3.0-9.1 libvirt-daemon-driver-storage-disk-debuginfo-3.3.0-9.1 libvirt-daemon-driver-storage-iscsi-3.3.0-9.1 libvirt-daemon-driver-storage-iscsi-debuginfo-3.3.0-9.1 libvirt-daemon-driver-storage-logical-3.3.0-9.1 libvirt-daemon-driver-storage-logical-debuginfo-3.3.0-9.1 libvirt-daemon-driver-storage-mpath-3.3.0-9.1 libvirt-daemon-driver-storage-mpath-debuginfo-3.3.0-9.1 libvirt-daemon-driver-storage-scsi-3.3.0-9.1 libvirt-daemon-driver-storage-scsi-debuginfo-3.3.0-9.1 libvirt-daemon-driver-uml-3.3.0-9.1 libvirt-daemon-driver-uml-debuginfo-3.3.0-9.1 libvirt-daemon-driver-vbox-3.3.0-9.1 libvirt-daemon-driver-vbox-debuginfo-3.3.0-9.1 libvirt-daemon-lxc-3.3.0-9.1 libvirt-daemon-qemu-3.3.0-9.1 libvirt-daemon-uml-3.3.0-9.1 libvirt-daemon-vbox-3.3.0-9.1 libvirt-debugsource-3.3.0-9.1 libvirt-devel-3.3.0-9.1 libvirt-doc-3.3.0-9.1 libvirt-libs-3.3.0-9.1 libvirt-libs-debuginfo-3.3.0-9.1 libvirt-lock-sanlock-3.3.0-9.1 libvirt-lock-sanlock-debuginfo-3.3.0-9.1 libvirt-nss-3.3.0-9.1 libvirt-nss-debuginfo-3.3.0-9.1 - openSUSE Leap 42.3 (x86_64): libvirt-client-debuginfo-32bit-3.3.0-9.1 libvirt-daemon-driver-libxl-3.3.0-9.1 libvirt-daemon-driver-libxl-debuginfo-3.3.0-9.1 libvirt-daemon-driver-storage-rbd-3.3.0-9.1 libvirt-daemon-driver-storage-rbd-debuginfo-3.3.0-9.1 libvirt-daemon-xen-3.3.0-9.1 libvirt-devel-32bit-3.3.0-9.1 References: https://www.suse.com/security/cve/CVE-2017-1000256.html https://bugzilla.suse.com/1062563 https://bugzilla.suse.com/1062620

1 0

openSUSE-RU-2017:2877-1: moderate: Recommended update for corosync
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for corosync ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2877-1 Rating: moderate References: #1023959 #1030437 #1032634 #1037226 #1043045 #1047862 #1047876 #1051638 #1060767 #996230 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for corosync provides the following fixes: - Don't terminate with assertion error after a network interface goes down. (bsc#1032634) - Don't fail to start when /etc/hosts contains IPv6 addresses. (bsc#1051638) - Ensure corosync processes are memory locked. (bsc#1037226) - Prefer nodelist over bindnetaddr when both are available. (bsc#1030437) - Set initial logging priority to a lower value to allow log filters configured in corosync.conf to be applied. (bsc#1023959) - Fix a failure when starting Corosync Cluster engine. (bsc#996230) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1203=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): corosync-2.3.5-8.3.1 corosync-debuginfo-2.3.5-8.3.1 corosync-debugsource-2.3.5-8.3.1 corosync-testagents-2.3.5-8.3.1 corosync-testagents-debuginfo-2.3.5-8.3.1 libcorosync-devel-2.3.5-8.3.1 libcorosync4-2.3.5-8.3.1 libcorosync4-debuginfo-2.3.5-8.3.1 - openSUSE Leap 42.2 (x86_64): libcorosync4-32bit-2.3.5-8.3.1 libcorosync4-debuginfo-32bit-2.3.5-8.3.1 References: https://bugzilla.suse.com/1023959 https://bugzilla.suse.com/1030437 https://bugzilla.suse.com/1032634 https://bugzilla.suse.com/1037226 https://bugzilla.suse.com/1043045 https://bugzilla.suse.com/1047862 https://bugzilla.suse.com/1047876 https://bugzilla.suse.com/1051638 https://bugzilla.suse.com/1060767 https://bugzilla.suse.com/996230

1 0

openSUSE-RU-2017:2876-1: Recommended update for logrotate
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for logrotate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2876-1 Rating: low References: #1028353 #1057801 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for logrotate provides the following fixes: - Fixed an error while renaming to already existing files that was causing logs to stop rotating. (bsc#1028353) - Make sure log files continue to rotate properly when a stale status file is found. (bsc#1057801) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1206=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): logrotate-3.8.7-9.3.1 logrotate-debuginfo-3.8.7-9.3.1 logrotate-debugsource-3.8.7-9.3.1 References: https://bugzilla.suse.com/1028353 https://bugzilla.suse.com/1057801

1 0

openSUSE-SU-2017:2875-1: moderate: Security update for tcpdump
by opensuse-security＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Security Update: Security update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2875-1 Rating: moderate References: #1047873 #1057247 Cross-References: CVE-2017-11108 CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 CVE-2017-12893 CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902 CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989 CVE-2017-12990 CVE-2017-12991 CVE-2017-12992 CVE-2017-12993 CVE-2017-12994 CVE-2017-12995 CVE-2017-12996 CVE-2017-12997 CVE-2017-12998 CVE-2017-12999 CVE-2017-13000 CVE-2017-13001 CVE-2017-13002 CVE-2017-13003 CVE-2017-13004 CVE-2017-13005 CVE-2017-13006 CVE-2017-13007 CVE-2017-13008 CVE-2017-13009 CVE-2017-13010 CVE-2017-13011 CVE-2017-13012 CVE-2017-13013 CVE-2017-13014 CVE-2017-13015 CVE-2017-13016 CVE-2017-13017 CVE-2017-13018 CVE-2017-13019 CVE-2017-13020 CVE-2017-13021 CVE-2017-13022 CVE-2017-13023 CVE-2017-13024 CVE-2017-13025 CVE-2017-13026 CVE-2017-13027 CVE-2017-13028 CVE-2017-13029 CVE-2017-13030 CVE-2017-13031 CVE-2017-13032 CVE-2017-13033 CVE-2017-13034 CVE-2017-13035 CVE-2017-13036 CVE-2017-13037 CVE-2017-13038 CVE-2017-13039 CVE-2017-13040 CVE-2017-13041 CVE-2017-13042 CVE-2017-13043 CVE-2017-13044 CVE-2017-13045 CVE-2017-13046 CVE-2017-13047 CVE-2017-13048 CVE-2017-13049 CVE-2017-13050 CVE-2017-13051 CVE-2017-13052 CVE-2017-13053 CVE-2017-13054 CVE-2017-13055 CVE-2017-13687 CVE-2017-13688 CVE-2017-13689 CVE-2017-13690 CVE-2017-13725 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 90 vulnerabilities is now available. Description: This update for tcpdump to version 4.9.2 fixes several issues. These security issues were fixed: - CVE-2017-11108: Prevent remote attackers to cause DoS (heap-based buffer over-read and application crash) via crafted packet data. The crash occured in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol (bsc#1047873, bsc#1057247). - CVE-2017-11543: Prevent buffer overflow in the sliplink_print function in print-sl.c that allowed remote DoS (bsc#1057247). - CVE-2017-13011: Prevent buffer overflow in bittok2str_internal() that allowed remote DoS (bsc#1057247) - CVE-2017-12989: Prevent infinite loop in the RESP parser that allowed remote DoS (bsc#1057247) - CVE-2017-12990: Prevent infinite loop in the ISAKMP parser that allowed remote DoS (bsc#1057247) - CVE-2017-12995: Prevent infinite loop in the DNS parser that allowed remote DoS (bsc#1057247) - CVE-2017-12997: Prevent infinite loop in the LLDP parser that allowed remote DoS (bsc#1057247) - CVE-2017-11541: Prevent heap-based buffer over-read in the lldp_print function in print-lldp.c, related to util-print.c that allowed remote DoS (bsc#1057247). - CVE-2017-11542: Prevent heap-based buffer over-read in the pimv1_print function in print-pim.c that allowed remote DoS (bsc#1057247). - CVE-2017-12893: Prevent buffer over-read in the SMB/CIFS parser that allowed remote DoS (bsc#1057247) - CVE-2017-12894: Prevent buffer over-read in several protocol parsers that allowed remote DoS (bsc#1057247) - CVE-2017-12895: Prevent buffer over-read in the ICMP parser that allowed remote DoS (bsc#1057247) - CVE-2017-12896: Prevent buffer over-read in the ISAKMP parser that allowed remote DoS (bsc#1057247) - CVE-2017-12897: Prevent buffer over-read in the ISO CLNS parser that allowed remote DoS (bsc#1057247) - CVE-2017-12898: Prevent buffer over-read in the NFS parser that allowed remote DoS (bsc#1057247) - CVE-2017-12899: Prevent buffer over-read in the DECnet parser that allowed remote DoS (bsc#1057247) - CVE-2017-12900: Prevent buffer over-read in the in several protocol parsers that allowed remote DoS (bsc#1057247) - CVE-2017-12901: Prevent buffer over-read in the EIGRP parser that allowed remote DoS (bsc#1057247) - CVE-2017-12902: Prevent buffer over-read in the Zephyr parser that allowed remote DoS (bsc#1057247) - CVE-2017-12985: Prevent buffer over-read in the IPv6 parser that allowed remote DoS (bsc#1057247) - CVE-2017-12986: Prevent buffer over-read in the IPv6 routing header parser that allowed remote DoS (bsc#1057247) - CVE-2017-12987: Prevent buffer over-read in the 802.11 parser that allowed remote DoS (bsc#1057247) - CVE-2017-12988: Prevent buffer over-read in the telnet parser that allowed remote DoS (bsc#1057247) - CVE-2017-12991: Prevent buffer over-read in the BGP parser that allowed remote DoS (bsc#1057247) - CVE-2017-12992: Prevent buffer over-read in the RIPng parser that allowed remote DoS (bsc#1057247) - CVE-2017-12993: Prevent buffer over-read in the Juniper protocols parser that allowed remote DoS (bsc#1057247) - CVE-2017-12994: Prevent buffer over-read in the BGP parser that allowed remote DoS (bsc#1057247) - CVE-2017-12996: Prevent buffer over-read in the PIMv2 parser that allowed remote DoS (bsc#1057247) - CVE-2017-12998: Prevent buffer over-read in the IS-IS parser that allowed remote DoS (bsc#1057247) - CVE-2017-12999: Prevent buffer over-read in the IS-IS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13000: Prevent buffer over-read in the IEEE 802.15.4 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13001: Prevent buffer over-read in the NFS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13002: Prevent buffer over-read in the AODV parser that allowed remote DoS (bsc#1057247) - CVE-2017-13003: Prevent buffer over-read in the LMP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13004: Prevent buffer over-read in the Juniper protocols parser that allowed remote DoS (bsc#1057247) - CVE-2017-13005: Prevent buffer over-read in the NFS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13006: Prevent buffer over-read in the L2TP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13007: Prevent buffer over-read in the Apple PKTAP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13008: Prevent buffer over-read in the IEEE 802.11 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13009: Prevent buffer over-read in the IPv6 mobility parser that allowed remote DoS (bsc#1057247) - CVE-2017-13010: Prevent buffer over-read in the BEEP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13012: Prevent buffer over-read in the ICMP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13013: Prevent buffer over-read in the ARP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13014: Prevent buffer over-read in the White Board protocol parser that allowed remote DoS (bsc#1057247) - CVE-2017-13015: Prevent buffer over-read in the EAP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13016: Prevent buffer over-read in the ISO ES-IS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13017: Prevent buffer over-read in the DHCPv6 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13018: Prevent buffer over-read in the PGM parser that allowed remote DoS (bsc#1057247) - CVE-2017-13019: Prevent buffer over-read in the PGM parser that allowed remote DoS (bsc#1057247) - CVE-2017-13020: Prevent buffer over-read in the VTP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13021: Prevent buffer over-read in the ICMPv6 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13022: Prevent buffer over-read in the IP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13023: Prevent buffer over-read in the IPv6 mobility parser that allowed remote DoS (bsc#1057247) - CVE-2017-13024: Prevent buffer over-read in the IPv6 mobility parser that allowed remote DoS (bsc#1057247) - CVE-2017-13025: Prevent buffer over-read in the IPv6 mobility parser that allowed remote DoS (bsc#1057247) - CVE-2017-13026: Prevent buffer over-read in the ISO IS-IS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13027: Prevent buffer over-read in the LLDP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13028: Prevent buffer over-read in the BOOTP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13029: Prevent buffer over-read in the PPP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13030: Prevent buffer over-read in the PIM parser that allowed remote DoS (bsc#1057247) - CVE-2017-13031: Prevent buffer over-read in the IPv6 fragmentation header parser that allowed remote DoS (bsc#1057247) - CVE-2017-13032: Prevent buffer over-read in the RADIUS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13033: Prevent buffer over-read in the VTP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13034: Prevent buffer over-read in the PGM parser that allowed remote DoS (bsc#1057247) - CVE-2017-13035: Prevent buffer over-read in the ISO IS-IS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13036: Prevent buffer over-read in the OSPFv3 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13037: Prevent buffer over-read in the IP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13038: Prevent buffer over-read in the PPP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13039: Prevent buffer over-read in the ISAKMP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13040: Prevent buffer over-read in the MPTCP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13041: Prevent buffer over-read in the ICMPv6 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13042: Prevent buffer over-read in the HNCP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13043: Prevent buffer over-read in the BGP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13044: Prevent buffer over-read in the HNCP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13045: Prevent buffer over-read in the VQP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13046: Prevent buffer over-read in the BGP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13047: Prevent buffer over-read in the ISO ES-IS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13048: Prevent buffer over-read in the RSVP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13049: Prevent buffer over-read in the Rx protocol parser that allowed remote DoS (bsc#1057247) - CVE-2017-13050: Prevent buffer over-read in the RPKI-Router parser that allowed remote DoS (bsc#1057247) - CVE-2017-13051: Prevent buffer over-read in the RSVP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13052: Prevent buffer over-read in the CFM parser that allowed remote DoS (bsc#1057247) - CVE-2017-13053: Prevent buffer over-read in the BGP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13054: Prevent buffer over-read in the LLDP parser that allowed remote DoS (bsc#1057247) - CVE-2017-13055: Prevent buffer over-read in the ISO IS-IS parser that allowed remote DoS (bsc#1057247) - CVE-2017-13687: Prevent buffer over-read in the Cisco HDLC parser that allowed remote DoS (bsc#1057247) - CVE-2017-13688: Prevent buffer over-read in the OLSR parser that allowed remote DoS (bsc#1057247) - CVE-2017-13689: Prevent buffer over-read in the IKEv1 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13690: Prevent buffer over-read in the IKEv2 parser that allowed remote DoS (bsc#1057247) - CVE-2017-13725: Prevent buffer over-read in the IPv6 routing header parser that allowed remote DoS (bsc#1057247) - Prevent segmentation fault in ESP decoder with OpenSSL 1.1 (bsc#1057247) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1205=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1205=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): tcpdump-4.9.2-9.1 tcpdump-debuginfo-4.9.2-9.1 tcpdump-debugsource-4.9.2-9.1 - openSUSE Leap 42.2 (x86_64): tcpdump-4.9.2-6.6.1 tcpdump-debuginfo-4.9.2-6.6.1 tcpdump-debugsource-4.9.2-6.6.1 References: https://www.suse.com/security/cve/CVE-2017-11108.html https://www.suse.com/security/cve/CVE-2017-11541.html https://www.suse.com/security/cve/CVE-2017-11542.html https://www.suse.com/security/cve/CVE-2017-11543.html https://www.suse.com/security/cve/CVE-2017-12893.html https://www.suse.com/security/cve/CVE-2017-12894.html https://www.suse.com/security/cve/CVE-2017-12895.html https://www.suse.com/security/cve/CVE-2017-12896.html https://www.suse.com/security/cve/CVE-2017-12897.html https://www.suse.com/security/cve/CVE-2017-12898.html https://www.suse.com/security/cve/CVE-2017-12899.html https://www.suse.com/security/cve/CVE-2017-12900.html https://www.suse.com/security/cve/CVE-2017-12901.html https://www.suse.com/security/cve/CVE-2017-12902.html https://www.suse.com/security/cve/CVE-2017-12985.html https://www.suse.com/security/cve/CVE-2017-12986.html https://www.suse.com/security/cve/CVE-2017-12987.html https://www.suse.com/security/cve/CVE-2017-12988.html https://www.suse.com/security/cve/CVE-2017-12989.html https://www.suse.com/security/cve/CVE-2017-12990.html https://www.suse.com/security/cve/CVE-2017-12991.html https://www.suse.com/security/cve/CVE-2017-12992.html https://www.suse.com/security/cve/CVE-2017-12993.html https://www.suse.com/security/cve/CVE-2017-12994.html https://www.suse.com/security/cve/CVE-2017-12995.html https://www.suse.com/security/cve/CVE-2017-12996.html https://www.suse.com/security/cve/CVE-2017-12997.html https://www.suse.com/security/cve/CVE-2017-12998.html https://www.suse.com/security/cve/CVE-2017-12999.html https://www.suse.com/security/cve/CVE-2017-13000.html https://www.suse.com/security/cve/CVE-2017-13001.html https://www.suse.com/security/cve/CVE-2017-13002.html https://www.suse.com/security/cve/CVE-2017-13003.html https://www.suse.com/security/cve/CVE-2017-13004.html https://www.suse.com/security/cve/CVE-2017-13005.html https://www.suse.com/security/cve/CVE-2017-13006.html https://www.suse.com/security/cve/CVE-2017-13007.html https://www.suse.com/security/cve/CVE-2017-13008.html https://www.suse.com/security/cve/CVE-2017-13009.html https://www.suse.com/security/cve/CVE-2017-13010.html https://www.suse.com/security/cve/CVE-2017-13011.html https://www.suse.com/security/cve/CVE-2017-13012.html https://www.suse.com/security/cve/CVE-2017-13013.html https://www.suse.com/security/cve/CVE-2017-13014.html https://www.suse.com/security/cve/CVE-2017-13015.html https://www.suse.com/security/cve/CVE-2017-13016.html https://www.suse.com/security/cve/CVE-2017-13017.html https://www.suse.com/security/cve/CVE-2017-13018.html https://www.suse.com/security/cve/CVE-2017-13019.html https://www.suse.com/security/cve/CVE-2017-13020.html https://www.suse.com/security/cve/CVE-2017-13021.html https://www.suse.com/security/cve/CVE-2017-13022.html https://www.suse.com/security/cve/CVE-2017-13023.html https://www.suse.com/security/cve/CVE-2017-13024.html https://www.suse.com/security/cve/CVE-2017-13025.html https://www.suse.com/security/cve/CVE-2017-13026.html https://www.suse.com/security/cve/CVE-2017-13027.html https://www.suse.com/security/cve/CVE-2017-13028.html https://www.suse.com/security/cve/CVE-2017-13029.html https://www.suse.com/security/cve/CVE-2017-13030.html https://www.suse.com/security/cve/CVE-2017-13031.html https://www.suse.com/security/cve/CVE-2017-13032.html https://www.suse.com/security/cve/CVE-2017-13033.html https://www.suse.com/security/cve/CVE-2017-13034.html https://www.suse.com/security/cve/CVE-2017-13035.html https://www.suse.com/security/cve/CVE-2017-13036.html https://www.suse.com/security/cve/CVE-2017-13037.html https://www.suse.com/security/cve/CVE-2017-13038.html https://www.suse.com/security/cve/CVE-2017-13039.html https://www.suse.com/security/cve/CVE-2017-13040.html https://www.suse.com/security/cve/CVE-2017-13041.html https://www.suse.com/security/cve/CVE-2017-13042.html https://www.suse.com/security/cve/CVE-2017-13043.html https://www.suse.com/security/cve/CVE-2017-13044.html https://www.suse.com/security/cve/CVE-2017-13045.html https://www.suse.com/security/cve/CVE-2017-13046.html https://www.suse.com/security/cve/CVE-2017-13047.html https://www.suse.com/security/cve/CVE-2017-13048.html https://www.suse.com/security/cve/CVE-2017-13049.html https://www.suse.com/security/cve/CVE-2017-13050.html https://www.suse.com/security/cve/CVE-2017-13051.html https://www.suse.com/security/cve/CVE-2017-13052.html https://www.suse.com/security/cve/CVE-2017-13053.html https://www.suse.com/security/cve/CVE-2017-13054.html https://www.suse.com/security/cve/CVE-2017-13055.html https://www.suse.com/security/cve/CVE-2017-13687.html https://www.suse.com/security/cve/CVE-2017-13688.html https://www.suse.com/security/cve/CVE-2017-13689.html https://www.suse.com/security/cve/CVE-2017-13690.html https://www.suse.com/security/cve/CVE-2017-13725.html https://bugzilla.suse.com/1047873 https://bugzilla.suse.com/1057247

1 0

openSUSE-RU-2017:2874-1: Recommended update for gnome-settings-daemon
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for gnome-settings-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2874-1 Rating: low References: #1045780 #990470 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gnome-settings-daemon provides the following fix: - Fix two-finger scrolling in the GNOME desktop environment. (bsc#990470) - Fix a crash when enabling headset output under some specific conditions. (bsc#1045780) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1208=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1208=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gnome-settings-daemon-3.20.1-15.1 gnome-settings-daemon-debuginfo-3.20.1-15.1 gnome-settings-daemon-debugsource-3.20.1-15.1 gnome-settings-daemon-devel-3.20.1-15.1 - openSUSE Leap 42.3 (noarch): gnome-settings-daemon-lang-3.20.1-15.1 - openSUSE Leap 42.2 (i586 x86_64): gnome-settings-daemon-3.20.1-9.9.1 gnome-settings-daemon-debuginfo-3.20.1-9.9.1 gnome-settings-daemon-debugsource-3.20.1-9.9.1 gnome-settings-daemon-devel-3.20.1-9.9.1 - openSUSE Leap 42.2 (noarch): gnome-settings-daemon-lang-3.20.1-9.9.1 References: https://bugzilla.suse.com/1045780 https://bugzilla.suse.com/990470

1 0

openSUSE-SU-2017:2868-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2868-1 Rating: important References: #1039034 #1064096 #1064100 #1064101 #1064102 #1064104 #1064105 #1064107 #1064108 #1064112 #1064115 #1064116 #1064117 #1064118 #1064119 Cross-References: CVE-2017-10155 CVE-2017-10227 CVE-2017-10268 CVE-2017-10276 CVE-2017-10279 CVE-2017-10283 CVE-2017-10286 CVE-2017-10294 CVE-2017-10314 CVE-2017-10378 CVE-2017-10379 CVE-2017-10384 CVE-2017-3731 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has two fixes is now available. Description: This update for mysql-community-server to 5.6.38 fixes the following issues: Full list of changes: http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-38.html CVEs fixed: - [boo#1064116] CVE-2017-10379 - [boo#1064117] CVE-2017-10384 - [boo#1064115] CVE-2017-10378 - [boo#1064101] CVE-2017-10268 - [boo#1064096] CVE-2017-10155 - [boo#1064118] CVE-2017-3731 - [boo#1064102] CVE-2017-10276 - [boo#1064105] CVE-2017-10283 - [boo#1064112] CVE-2017-10314 - [boo#1064100] CVE-2017-10227 - [boo#1064104] CVE-2017-10279 - [boo#1064108] CVE-2017-10294 - [boo#1064107] CVE-2017-10286 Additional changes: - add "BuildRequires: unixODBC-devel" to allow ODBC support for Connect engine [boo#1039034] - update filename in /var/adm/update-messages to match documentation, and build-compare pattern - some scripts from the tools subpackage, namely: wsrep_sst_xtrabackup, wsrep_sst_mariabackup.sh and wsrep_sst_xtrabackup-v2.sh need socat - fixed incorrect descriptions and mismatching RPM groups Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1196=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1196=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmysql56client18-5.6.38-30.1 libmysql56client18-debuginfo-5.6.38-30.1 libmysql56client_r18-5.6.38-30.1 mysql-community-server-5.6.38-30.1 mysql-community-server-bench-5.6.38-30.1 mysql-community-server-bench-debuginfo-5.6.38-30.1 mysql-community-server-client-5.6.38-30.1 mysql-community-server-client-debuginfo-5.6.38-30.1 mysql-community-server-debuginfo-5.6.38-30.1 mysql-community-server-debugsource-5.6.38-30.1 mysql-community-server-test-5.6.38-30.1 mysql-community-server-test-debuginfo-5.6.38-30.1 mysql-community-server-tools-5.6.38-30.1 mysql-community-server-tools-debuginfo-5.6.38-30.1 - openSUSE Leap 42.3 (noarch): mysql-community-server-errormessages-5.6.38-30.1 - openSUSE Leap 42.3 (x86_64): libmysql56client18-32bit-5.6.38-30.1 libmysql56client18-debuginfo-32bit-5.6.38-30.1 libmysql56client_r18-32bit-5.6.38-30.1 - openSUSE Leap 42.2 (i586 x86_64): libmysql56client18-5.6.38-24.12.1 libmysql56client18-debuginfo-5.6.38-24.12.1 libmysql56client_r18-5.6.38-24.12.1 mysql-community-server-5.6.38-24.12.1 mysql-community-server-bench-5.6.38-24.12.1 mysql-community-server-bench-debuginfo-5.6.38-24.12.1 mysql-community-server-client-5.6.38-24.12.1 mysql-community-server-client-debuginfo-5.6.38-24.12.1 mysql-community-server-debuginfo-5.6.38-24.12.1 mysql-community-server-debugsource-5.6.38-24.12.1 mysql-community-server-test-5.6.38-24.12.1 mysql-community-server-test-debuginfo-5.6.38-24.12.1 mysql-community-server-tools-5.6.38-24.12.1 mysql-community-server-tools-debuginfo-5.6.38-24.12.1 - openSUSE Leap 42.2 (x86_64): libmysql56client18-32bit-5.6.38-24.12.1 libmysql56client18-debuginfo-32bit-5.6.38-24.12.1 libmysql56client_r18-32bit-5.6.38-24.12.1 - openSUSE Leap 42.2 (noarch): mysql-community-server-errormessages-5.6.38-24.12.1 References: https://www.suse.com/security/cve/CVE-2017-10155.html https://www.suse.com/security/cve/CVE-2017-10227.html https://www.suse.com/security/cve/CVE-2017-10268.html https://www.suse.com/security/cve/CVE-2017-10276.html https://www.suse.com/security/cve/CVE-2017-10279.html https://www.suse.com/security/cve/CVE-2017-10283.html https://www.suse.com/security/cve/CVE-2017-10286.html https://www.suse.com/security/cve/CVE-2017-10294.html https://www.suse.com/security/cve/CVE-2017-10314.html https://www.suse.com/security/cve/CVE-2017-10378.html https://www.suse.com/security/cve/CVE-2017-10379.html https://www.suse.com/security/cve/CVE-2017-10384.html https://www.suse.com/security/cve/CVE-2017-3731.html https://bugzilla.suse.com/1039034 https://bugzilla.suse.com/1064096 https://bugzilla.suse.com/1064100 https://bugzilla.suse.com/1064101 https://bugzilla.suse.com/1064102 https://bugzilla.suse.com/1064104 https://bugzilla.suse.com/1064105 https://bugzilla.suse.com/1064107 https://bugzilla.suse.com/1064108 https://bugzilla.suse.com/1064112 https://bugzilla.suse.com/1064115 https://bugzilla.suse.com/1064116 https://bugzilla.suse.com/1064117 https://bugzilla.suse.com/1064118 https://bugzilla.suse.com/1064119

1 0

openSUSE-OU-2017:2863-1: Optional update to add nodejs6
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Optional Update: Optional update to add nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2863-1 Rating: low References: #1012780 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds Node.js Version 6 to openSUSE Leap 42.2. Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world. This version is a build dependency of Chromium 62. This package will continue to receive maintenance updates from SLES 12. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1195=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): nodejs6-6.11.1-2.1 nodejs6-debuginfo-6.11.1-2.1 nodejs6-debugsource-6.11.1-2.1 nodejs6-devel-6.11.1-2.1 npm6-6.11.1-2.1 - openSUSE Leap 42.2 (noarch): nodejs6-docs-6.11.1-2.1 References: https://bugzilla.suse.com/1012780

1 0

openSUSE-SU-2017:2848-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 25 Oct '17

25 Oct '17

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2848-1 Rating: moderate References: #1063798 Cross-References: CVE-2017-14608 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libraw fixes the following issues: Changes in libraw: * CVE-2017-14608: An out of bounds read in the kodak_65000_load_raw function could lead to an information leak. [boo#1063798] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1193=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1193=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libraw-debugsource-0.17.1-14.1 libraw-devel-0.17.1-14.1 libraw-devel-static-0.17.1-14.1 libraw-tools-0.17.1-14.1 libraw-tools-debuginfo-0.17.1-14.1 libraw15-0.17.1-14.1 libraw15-debuginfo-0.17.1-14.1 - openSUSE Leap 42.2 (i586 x86_64): libraw-debugsource-0.17.1-2.14.1 libraw-devel-0.17.1-2.14.1 libraw-devel-static-0.17.1-2.14.1 libraw-tools-0.17.1-2.14.1 libraw-tools-debuginfo-0.17.1-2.14.1 libraw15-0.17.1-2.14.1 libraw15-debuginfo-0.17.1-2.14.1 References: https://www.suse.com/security/cve/CVE-2017-14608.html https://bugzilla.suse.com/1063798

1 0

openSUSE-SU-2017:2846-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 25 Oct '17

25 Oct '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2846-1 Rating: important References: #1004527 #1012382 #1015342 #1015343 #1019675 #1019680 #1019695 #1019699 #1020412 #1020989 #1022595 #1022604 #1022912 #1024346 #1024373 #1025461 #1032150 #1034075 #1037579 #1037890 #1050471 #1052360 #1055567 #1056230 #1056427 #1056587 #1056596 #1058135 #1059863 #1060249 #1060400 #1060985 #1061451 #1061721 #1061775 #1062279 #1062520 #1062962 #1063102 #1063349 #1063460 #1063475 #1063501 #1063509 #1063520 #1063570 #1063667 #1063695 #1064064 #1064206 #1064388 #1064436 #963575 #964944 #966170 #966172 #966186 #966191 #966316 #966318 #969476 #969477 #971975 Cross-References: CVE-2017-13080 CVE-2017-15265 CVE-2017-15649 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 60 fixes is now available. Description: The openSUSE Leap 42.3 kernel was updated to 4.4.92 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2) allowed reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (bnc#1063667). - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520). - CVE-2017-15649: net/packet/af_packet.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346 (bnc#1064388). The following non-security bugs were fixed: - acpi/processor: Check for duplicate processor ids at hotplug time (bnc#1056230). - acpi/processor: Implement DEVICE operator for processor enumeration (bnc#1056230). - add mainline tags to hyperv patches - alsa: au88x0: avoid theoretical uninitialized access (bnc#1012382). - alsa: compress: Remove unused variable (bnc#1012382). - alsa: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (bnc#1012382). - alsa: usx2y: Suppress kernel warning at page allocation failures (bnc#1012382). - arm64: add function to get a cpu's MADT GICC table (bsc#1062279). - arm64: dts: Add Broadcom Vulcan PMU in dts (fate#319481). - arm64/perf: Access pmu register using <read/write;gt;_sys_reg (bsc#1062279). - arm64/perf: Add Broadcom Vulcan PMU support (fate#319481). - arm64/perf: Changed events naming as per the ARM ARM (fate#319481). - arm64/perf: Define complete ARMv8 recommended implementation defined events (fate#319481). - arm64: perf: do not expose CHAIN event in sysfs (bsc#1062279). - arm64: perf: Extend event config for ARMv8.1 (bsc#1062279). - arm64/perf: Filter common events based on PMCEIDn_EL0 (fate#319481). - arm64: perf: Ignore exclude_hv when kernel is running in HYP (bsc#1062279). - arm64: perf: move to common attr_group fields (bsc#1062279). - arm64: perf: Use the builtin_platform_driver (bsc#1062279). - arm64: pmu: add fallback probe table (bsc#1062279). - arm64: pmu: Hoist pmu platform device name (bsc#1062279). - arm64: pmu: Probe default hw/cache counters (bsc#1062279). - arm64: pmuv3: handle pmuv3+ (bsc#1062279). - arm64: pmuv3: handle !PMUv3 when probing (bsc#1062279). - arm64: pmuv3: use arm_pmu ACPI framework (bsc#1062279). - arm64: pmu: Wire-up Cortex A53 L2 cache events and DTLB refills (bsc#1062279). - arm: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM (bnc#1012382). - arm: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes (bnc#1012382). - arm/perf: Convert to hotplug state machine (bsc#1062279). - arm/perf: Fix hotplug state machine conversion (bsc#1062279). - arm/perf: Use multi instance instead of custom list (bsc#1062279). - arm: remove duplicate 'const' annotations' (bnc#1012382). - asoc: dapm: fix some pointer error handling (bnc#1012382). - asoc: dapm: handle probe deferrals (bnc#1012382). - audit: log 32-bit socketcalls (bnc#1012382). - blacklist 0e7736c6b806 powerpc/powernv: Fix data type for @r in pnv_ioda_parse_m64_window() - blacklist.conf: fix commit exists twice in upstream, blacklist one of them - blacklist.conf: stack limit warning isn't triggered on SP3 - block: genhd: add device_add_disk_with_groups (bsc#1060400). - bnx2x: Do not log mc removal needlessly (bsc#1019680 FATE#321692). - bnxt_en: Do not setup MAC address in bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144). - bnxt_en: Free MSIX vectors when unregistering the device from bnxt_re (bsc#1020412 FATE#321671). - bnxt_re: Do not issue cmd to delete GID for QP1 GID entry before the QP is destroyed (bsc#1056596). - bnxt_re: Fix compare and swap atomic operands (bsc#1056596). - bnxt_re: Fix memory leak in FRMR path (bsc#1056596). - bnxt_re: Fix race between the netdev register and unregister events (bsc#1037579). - bnxt_re: Fix update of qplib_qp.mtu when modified (bsc#1056596). - bnxt_re: Free up devices in module_exit path (bsc#1056596). - bnxt_re: Remove RTNL lock dependency in bnxt_re_query_port (bsc#1056596). - bnxt_re: Stop issuing further cmds to FW once a cmd times out (bsc#1056596). - brcmfmac: setup passive scan if requested by user-space (bnc#1012382). - bridge: netlink: register netdevice before executing changelink (bnc#1012382). - ceph: avoid panic in create_session_open_msg() if utsname() returns NULL (bsc#1061451). - ceph: check negative offsets in ceph_llseek() (bsc#1061451). - ceph: fix message order check in handle_cap_export() (bsc#1061451). - ceph: fix NULL pointer dereference in ceph_flush_snaps() (bsc#1061451). - ceph: limit osd read size to CEPH_MSG_MAX_DATA_LEN (bsc#1061451). - ceph: limit osd write size (bsc#1061451). - ceph: stop on-going cached readdir if mds revokes FILE_SHARED cap (bsc#1061451). - ceph: validate correctness of some mount options (bsc#1061451). - documentation: arm64: pmu: Add Broadcom Vulcan PMU binding (fate#319481). - driver-core: platform: Add platform_irq_count() (bsc#1062279). - driver core: platform: Do not read past the end of "driver_override" buffer (bnc#1012382). - drivers: firmware: psci: drop duplicate const from psci_of_match (FATE#319482 bnc#1012382). - drivers: hv: fcopy: restore correct transfer length (bnc#1012382). - drivers/perf: arm_pmu_acpi: avoid perf IRQ init when guest PMU is off (bsc#1062279). - drivers/perf: arm_pmu_acpi: Release memory obtained by kasprintf (bsc#1062279). - drivers/perf: arm_pmu: add ACPI framework (bsc#1062279). - drivers/perf: arm_pmu: add common attr group fields (bsc#1062279). - drivers/perf: arm_pmu: Always consider IRQ0 as an error (bsc#1062279). - drivers/perf: arm_pmu: Avoid leaking pmu->irq_affinity on error (bsc#1062279). - drivers/perf: arm_pmu: avoid NULL dereference when not using devicetree (bsc#1062279). - drivers/perf: arm-pmu: convert arm_pmu_mutex to spinlock (bsc#1062279). - drivers/perf: arm_pmu: Defer the setting of __oprofile_cpu_pmu (bsc#1062279). - drivers/perf: arm_pmu: define armpmu_init_fn (bsc#1062279). - drivers/perf: arm_pmu: expose a cpumask in sysfs (bsc#1062279). - drivers/perf: arm_pmu: factor out pmu registration (bsc#1062279). - drivers/perf: arm-pmu: Fix handling of SPI lacking "interrupt-affinity" property (bsc#1062279). - drivers/perf: arm_pmu: Fix NULL pointer dereference during probe (bsc#1062279). - drivers/perf: arm-pmu: fix RCU usage on pmu resume from low-power (bsc#1062279). - drivers/perf: arm_pmu: Fix reference count of a device_node in of_pmu_irq_cfg (bsc#1062279). - drivers/perf: arm_pmu: fold init into alloc (bsc#1062279). - drivers/perf: arm_pmu: handle no platform_device (bsc#1062279). - drivers/perf: arm-pmu: Handle per-interrupt affinity mask (bsc#1062279). - drivers/perf: arm_pmu: implement CPU_PM notifier (bsc#1062279). - drivers/perf: arm_pmu: make info messages more verbose (bsc#1062279). - drivers/perf: arm_pmu: manage interrupts per-cpu (bsc#1062279). - drivers/perf: arm_pmu: move irq request/free into probe (bsc#1062279). - drivers/perf: arm_pmu: only use common attr_groups (bsc#1062279). - drivers/perf: arm_pmu: remove pointless PMU disabling (bsc#1062279). - drivers/perf: arm_pmu: rename irq request/free functions (bsc#1062279). - drivers/perf: arm_pmu: Request PMU SPIs with IRQF_PER_CPU (bsc#1062279). - drivers/perf: arm_pmu: rework per-cpu allocation (bsc#1062279). - drivers/perf: arm_pmu: simplify cpu_pmu_request_irqs() (bsc#1062279). - drivers/perf: arm_pmu: split cpu-local irq request/free (bsc#1062279). - drivers/perf: arm_pmu: split irq request from enable (bsc#1062279). - drivers/perf: arm_pmu: split out platform device probe logic (bsc#1062279). - drivers/perf: kill armpmu_register (bsc#1062279). - drm/amdkfd: fix improper return value on error (bnc#1012382). - drm: bridge: add DT bindings for TI ths8135 (bnc#1012382). - drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define (bnc#1012382). - drm/i915/bios: ignore HDMI on port A (bnc#1012382). - e1000e: use disable_hardirq() also for MSIX vectors in e1000_netpoll() (bsc#1022912 FATE#321246). - edac, sb_edac: Assign EDAC memory controller per h/w controller (bsc#1061721). - edac, sb_edac: Avoid creating SOCK memory controller (bsc#1061721). - edac, sb_edac: Bump driver version and do some cleanups (bsc#1061721). - edac, sb_edac: Carve out dimm-populating loop (bsc#1061721). - edac, sb_edac: Check if ECC enabled when at least one DIMM is present (bsc#1061721). - edac, sb_edac: Classify memory mirroring modes (bsc#1061721). - edac, sb_edac: Classify PCI-IDs by topology (bsc#1061721). - edac, sb_edac: Do not create a second memory controller if HA1 is not present (bsc#1061721). - edac, sb_edac: Do not use "Socket#" in the memory controller name (bsc#1061721). - edac, sb_edac: Drop NUM_CHANNELS from 8 back to 4 (bsc#1061721). - edac, sb_edac: Fix mod_name (bsc#1061721). - edac, sb_edac: Get rid of ->show_interleave_mode() (bsc#1061721). - edac, sb_edac: Remove double buffering of error records (bsc#1061721). - edac, sb_edac: Remove NULL pointer check on array pci_tad (bsc#1061721). - edac, skx_edac: Handle systems with segmented PCI busses (bsc#1063102). - ext4: do not allow encrypted operations without keys (bnc#1012382). - extcon: axp288: Use vbus-valid instead of -present to determine cable presence (bnc#1012382). - exynos-gsc: Do not swap cb/cr for semi planar formats (bnc#1012382). - fix flags ordering (bsc#1034075 comment 131) - Fix mpage_writepage() for pages with buffers (bsc#1050471). - fix whitespace according to upstream commit - fs/epoll: cache leftmost node (bsc#1056427). - fs/mpage.c: fix mpage_writepage() for pages with buffers (bsc#1050471). Update to version in mainline - ftrace: Fix kmemleak in unregister_ftrace_graph (bnc#1012382). - gfs2: Fix reference to ERR_PTR in gfs2_glock_iter_next (bnc#1012382). - hid: i2c-hid: allocate hid buffers for real worst case (bnc#1012382). - hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes (bnc#1012382). - i2c: meson: fix wrong variable usage in meson_i2c_put_data (bnc#1012382). - i40e: Initialize 64-bit statistics TX ring seqcount (bsc#1024346 FATE#321239 bsc#1024373 FATE#321247). - i40iw: Add missing memory barriers (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - i40iw: Fix port number for query QP (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - ib/core: Add generic function to extract IB speed from netdev (bsc#1056596). - ib/core: Add ordered workqueue for RoCE GID management (bsc#1056596). - ib/core: Fix for core panic (bsc#1022595 FATE#322350). - ib/core: Fix the validations of a multicast LID in attach or detach operations (bsc#1022595 FATE#322350). - ib/i40iw: Fix error code in i40iw_create_cq() (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - ib/ipoib: Fix deadlock over vlan_mutex (bnc#1012382 bsc#1022595 FATE#322350). - ib/ipoib: Replace list_del of the neigh->list with list_del_init (FATE#322350 bnc#1012382 bsc#1022595). - ib/ipoib: rtnl_unlock can not come after free_netdev (FATE#322350 bnc#1012382 bsc#1022595). - ib/mlx5: Change logic for dispatching IB events for port state (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - ib/mlx5: Fix cached MR allocation flow (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - ib/mlx5: Fix Raw Packet QP event handler assignment (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - ibmvnic: Set state UP (bsc#1062962). - ib/qib: fix false-postive maybe-uninitialized warning (FATE#321231 FATE#321473 FATE#322149 FATE#322153 bnc#1012382). - igb: re-assign hw address pointer on reset after PCI error (bnc#1012382). - iio: ad7793: Fix the serial interface reset (bnc#1012382). - iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications (bnc#1012382). - iio: adc: hx711: Add DT binding for avia,hx711 (bnc#1012382). - iio: adc: mcp320x: Fix oops on module unload (bnc#1012382). - iio: adc: mcp320x: Fix readout of negative voltages (bnc#1012382). - iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()' (bnc#1012382). - iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()' (bnc#1012382). - iio: ad_sigma_delta: Implement a dedicated reset function (bnc#1012382). - iio: core: Return error for failed read_reg (bnc#1012382). - iommu/io-pgtable-arm: Check for leaf entry before dereferencing it (bnc#1012382). - iwlwifi: add workaround to disable wide channels in 5GHz (bnc#1012382). - kabi fixup struct nvmet_sq (bsc#1063349). - kABI: protect enum fs_flow_table_type (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - kABI: protect struct mlx5_priv (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - kABI: protect struct rm_data_op (kabi). - kABI: protect struct sdio_func (kabi). - libata: transport: Remove circular dependency at free time (bnc#1012382). - libceph: do not allow bidirectional swap of pg-upmap-items (bsc#1061451). - lsm: fix smack_inode_removexattr and xattr_getsecurity memleak (bnc#1012382). - md/raid10: submit bio directly to replacement disk (bnc#1012382). - mips: Ensure bss section ends on a long-aligned address (bnc#1012382). - mips: Fix minimum alignment requirement of IRQ stack (git-fixes). - mips: IRQ Stack: Unwind IRQ stack onto task stack (bnc#1012382). - mips: Lantiq: Fix another request_mem_region() return code check (bnc#1012382). - mips: ralink: Fix incorrect assignment on ralink_soc (bnc#1012382). - mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms array (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - mm: avoid marking swap cached page as lazyfree (VM Functionality, bsc#1061775). - mm/backing-dev.c: fix an error handling path in 'cgwb_create()' (bnc#1063475). - mm,compaction: serialize waitqueue_active() checks (for real) (bsc#971975). - mmc: sdio: fix alignment issue in struct sdio_func (bnc#1012382). - mm: discard memblock data later (bnc#1063460). - mm: fix data corruption caused by lazyfree page (VM Functionality, bsc#1061775). - mm/memblock.c: reversed logic in memblock_discard() (bnc#1063460). - mm: meminit: mark init_reserved_page as __meminit (bnc#1063509). - mm/memory_hotplug: change pfn_to_section_nr/section_nr_to_pfn macro to inline function (bnc#1063501). - mm/memory_hotplug: define find_{smallest|biggest}_section_pfn as unsigned long (bnc#1063520). - net: core: Prevent from dereferencing null pointer when releasing SKB (bnc#1012382). - netfilter: invoke synchronize_rcu after set the _hook_ to NULL (bnc#1012382). - netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max (bnc#1012382). - net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - net/mlx5: Check device capability for maximum flow counters (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Delay events till ib registration ends (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Check for qos capability in dcbnl_initialize (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Do not add/remove 802.1ad rules when changing 802.1Q VLAN filter (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Fix calculated checksum offloads counters (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Fix dangling page pointer on DMA mapping error (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Fix DCB_CAP_ATTR_DCBX capability for DCBNL getcap (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Fix inline header size for small packets (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Print netdev features correctly in error message (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Schedule overflow check work to mlx5e workqueue (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5: E-Switch, Unload the representors in the correct order (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Fix arm SRQ command for ISSI version 0 (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Fix command completion after timeout access invalid structure (bsc#966318 FATE#320158 bsc#966316 FATE#320159). - net/mlx5: Fix counter list hardware structure (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Remove the flag MLX5_INTERFACE_STATE_SHUTDOWN (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5: Skip mlx5_unload_one if mlx5_load_one fails (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net: mvpp2: fix the mac address used when using PPv2.2 (bsc#1032150). - net: mvpp2: use {get, put}_cpu() instead of smp_processor_id() (bsc#1032150). - net/packet: check length in getsockopt() called with PACKET_HDRLEN (bnc#1012382). - netvsc: Initialize 64-bit stats seqcount (fate#320485). - nvme: allow timed-out ios to retry (bsc#1063349). - nvme: fix sqhd reference when admin queue connect fails (bsc#1063349). - nvme: fix visibility of "uuid" ns attribute (bsc#1060400). - nvme: protect against simultaneous shutdown invocations (FATE#319965 bnc#1012382 bsc#964944). - nvme: stop aer posting if controller state not live (bsc#1063349). - nvmet: implement valid sqhd values in completions (bsc#1063349). - nvmet: synchronize sqhd update (bsc#1063349). - nvme: use device_add_disk_with_groups() (bsc#1060400). - parisc: perf: Fix potential NULL pointer dereference (bnc#1012382). - partitions/efi: Fix integer overflow in GPT size calculation (FATE#322379 bnc#1012382 bsc#1020989). - perf: arm: acpi: remove cpu hotplug statemachine dependency (bsc#1062279). - perf: arm: platform: remove cpu hotplug statemachine dependency (bsc#1062279). - perf: arm: replace irq_get_percpu_devid_partition call (bsc#1062279). - perf: arm: temporary workaround for build errors (bsc#1062279). - perf: Convert to using %pOF instead of full_name (bsc#1062279). - powerpc: Fix unused function warning 'lmb_to_memblock' (FATE#322022). - powerpc/pseries: Add pseries hotplug workqueue (FATE#322022). - powerpc/pseries: Auto-online hotplugged memory (FATE#322022). - powerpc/pseries: Check memory device state before onlining/offlining (FATE#322022). - powerpc/pseries: Correct possible read beyond dlpar sysfs buffer (FATE#322022). - powerpc/pseries: Do not attempt to acquire drc during memory hot add for assigned lmbs (FATE#322022). - powerpc/pseries: Fix build break when MEMORY_HOTREMOVE=n (FATE#322022). - powerpc/pseries: fix memory leak in queue_hotplug_event() error path (FATE#322022). - powerpc/pseries: Implement indexed-count hotplug memory add (FATE#322022). - powerpc/pseries: Implement indexed-count hotplug memory remove (FATE#322022). - powerpc/pseries: Introduce memory hotplug READD operation (FATE#322022). - powerpc/pseries: Make the acquire/release of the drc for memory a seperate step (FATE#322022). - powerpc/pseries: Remove call to memblock_add() (FATE#322022). - powerpc/pseries: Revert 'Auto-online hotplugged memory' (FATE#322022). - powerpc/pseries: Use kernel hotplug queue for PowerVM hotplug events (FATE#322022). - powerpc/pseries: Use lmb_is_removable() to check removability (FATE#322022). - powerpc/pseries: Verify CPU does not exist before adding (FATE#322022). - rdma: Fix return value check for ib_get_eth_speed() (bsc#1056596). - rdma/qedr: Parse VLAN ID correctly and ignore the value of zero (bsc#1019695 FATE#321703 bsc#1019699 FATE#321702 bsc#1022604 FATE#321747). - rdma/qedr: Parse vlan priority as sl (bsc#1019695 FATE#321703 bsc#1019699 FATE#321702 bsc#1022604 FATE#321747). - rds: ib: add error handle (bnc#1012382). - rds: rdma: Fix the composite message user notification (bnc#1012382). - README.BRANCH: Add Michal and Johannes as co-maintainers. - Remove superfluous hunk in bigmem backport (bsc#1064436). Refresh patches.arch/powerpc-bigmem-16-mm-Add-addr_limit-to-mm_context-and-use-it-t .patch. - Revert "x86/acpi: Enable MADT APIs to return disabled apicids" (bnc#1056230). - Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting" (bnc#1056230). - s390/cpcmd,vmcp: avoid GFP_DMA allocations (bnc#1060249, LTC#159112). - s390/qdio: avoid reschedule of outbound tasklet once killed (bnc#1060249, LTC#159885). - s390/topology: alternative topology for topology-less machines (bnc#1060249, LTC#159177). - s390/topology: always use s390 specific sched_domain_topology_level (bnc#1060249, LTC#159177). - s390/topology: enable / disable topology dynamically (bnc#1060249, LTC#159177). - sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs (bnc#1012382). - scsi: fixup kernel warning during rmmod() (bsc#1052360). - scsi: libfc: fix a deadlock in fc_rport_work (bsc#1063695). - scsi: lpfc: Ensure io aborts interlocked with the target (bsc#1056587). - scsi: qedi: off by one in qedi_get_cmd_from_tid() (bsc#1004527, FATE#321744). - scsi: qla2xxx: Fix uninitialized work element (bsc#1019675,FATE#321701). - scsi: scsi_transport_fc: Also check for NOTPRESENT in fc_remote_port_add() (bsc#1037890). - scsi: scsi_transport_fc: set scsi_target_id upon rescan (bsc#1058135). - scsi: sd: Do not override max_sectors_kb sysfs setting (bsc#1025461). - scsi: sd: Remove LBPRZ dependency for discards (bsc#1060985). This patch is originally part of a larger series which can't be easily backported to SLE-12. For a reasoning why we think it's safe to apply, see bsc#1060985, comment 20. - scsi: sg: close race condition in sg_remove_sfp_usercontext() (bsc#1064206). - scsi: sg: do not return bogus Sg_requests (bsc#1064206). - scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206). - sh_eth: use correct name for ECMR_MPDE bit (bnc#1012382). - staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack (bnc#1012382). - stm class: Fix a use-after-free (bnc#1012382). - supported.conf: enable dw_mmc-rockchip driver References: bsc#1064064 - team: call netdev_change_features out of team lock (bsc#1055567). - team: fix memory leaks (bnc#1012382). - ttpci: address stringop overflow warning (bnc#1012382). - tty: goldfish: Fix a parameter of a call to free_irq (bnc#1012382). - usb: chipidea: vbus event may exist before starting gadget (bnc#1012382). - usb: core: harden cdc_parse_cdc_header (bnc#1012382). - usb: devio: Do not corrupt user memory (bnc#1012382). - usb: dummy-hcd: fix connection failures (wrong speed) (bnc#1012382). - usb: dummy-hcd: Fix erroneous synchronization change (bnc#1012382). - usb: dummy-hcd: fix infinite-loop resubmission bug (bnc#1012382). - usb: fix out-of-bounds in usb_set_configuration (bnc#1012382). - usb: gadgetfs: fix copy_to_user while holding spinlock (bnc#1012382). - usb: gadgetfs: Fix crash caused by inadequate synchronization (bnc#1012382). - usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write (bnc#1012382). - usb: gadget: mass_storage: set msg_registered after msg registered (bnc#1012382). - usb: gadget: udc: atmel: set vbus irqflags explicitly (bnc#1012382). - usb: g_mass_storage: Fix deadlock when driver is unbound (bnc#1012382). - usb: Increase quirk delay for USB devices (bnc#1012382). - usb: pci-quirks.c: Corrected timeout values used in handshake (bnc#1012382). - usb: plusb: Add support for PL-27A1 (bnc#1012382). - usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe (bnc#1012382). - usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction (bnc#1012382). - usb: serial: mos7720: fix control-message error handling (bnc#1012382). - usb: serial: mos7840: fix control-message error handling (bnc#1012382). - usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives (bnc#1012382). - usb: uas: fix bug in handling of alternate settings (bnc#1012382). - uwb: ensure that endpoint is interrupt (bnc#1012382). - uwb: properly check kthread_run return value (bnc#1012382). - x86/acpi: Restore the order of CPU IDs (bnc#1056230). - x86/cpu: Remove unused and undefined __generic_processor_info() declaration (bnc#1056230). - x86 edac, sb_edac.c: Take account of channel hashing when needed (bsc#1061721). - x86/mshyperv: Remove excess #includes from mshyperv.h (fate#320485). - xfs: handle error if xfs_btree_get_bufs fails (bsc#1059863). - xfs: remove kmem_zalloc_greedy (bnc#1012382). - xhci: fix finding correct bus_state structure for USB 3.1 hosts (bnc#1012382). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1194=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): kernel-devel-4.4.92-31.1 kernel-docs-4.4.92-31.2 kernel-docs-html-4.4.92-31.2 kernel-docs-pdf-4.4.92-31.2 kernel-macros-4.4.92-31.1 kernel-source-4.4.92-31.1 kernel-source-vanilla-4.4.92-31.1 - openSUSE Leap 42.3 (x86_64): kernel-debug-4.4.92-31.1 kernel-debug-base-4.4.92-31.1 kernel-debug-base-debuginfo-4.4.92-31.1 kernel-debug-debuginfo-4.4.92-31.1 kernel-debug-debugsource-4.4.92-31.1 kernel-debug-devel-4.4.92-31.1 kernel-debug-devel-debuginfo-4.4.92-31.1 kernel-default-4.4.92-31.1 kernel-default-base-4.4.92-31.1 kernel-default-base-debuginfo-4.4.92-31.1 kernel-default-debuginfo-4.4.92-31.1 kernel-default-debugsource-4.4.92-31.1 kernel-default-devel-4.4.92-31.1 kernel-obs-build-4.4.92-31.1 kernel-obs-build-debugsource-4.4.92-31.1 kernel-obs-qa-4.4.92-31.1 kernel-syms-4.4.92-31.1 kernel-vanilla-4.4.92-31.1 kernel-vanilla-base-4.4.92-31.1 kernel-vanilla-base-debuginfo-4.4.92-31.1 kernel-vanilla-debuginfo-4.4.92-31.1 kernel-vanilla-debugsource-4.4.92-31.1 kernel-vanilla-devel-4.4.92-31.1 References: https://www.suse.com/security/cve/CVE-2017-13080.html https://www.suse.com/security/cve/CVE-2017-15265.html https://www.suse.com/security/cve/CVE-2017-15649.html https://bugzilla.suse.com/1004527 https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1015342 https://bugzilla.suse.com/1015343 https://bugzilla.suse.com/1019675 https://bugzilla.suse.com/1019680 https://bugzilla.suse.com/1019695 https://bugzilla.suse.com/1019699 https://bugzilla.suse.com/1020412 https://bugzilla.suse.com/1020989 https://bugzilla.suse.com/1022595 https://bugzilla.suse.com/1022604 https://bugzilla.suse.com/1022912 https://bugzilla.suse.com/1024346 https://bugzilla.suse.com/1024373 https://bugzilla.suse.com/1025461 https://bugzilla.suse.com/1032150 https://bugzilla.suse.com/1034075 https://bugzilla.suse.com/1037579 https://bugzilla.suse.com/1037890 https://bugzilla.suse.com/1050471 https://bugzilla.suse.com/1052360 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1056230 https://bugzilla.suse.com/1056427 https://bugzilla.suse.com/1056587 https://bugzilla.suse.com/1056596 https://bugzilla.suse.com/1058135 https://bugzilla.suse.com/1059863 https://bugzilla.suse.com/1060249 https://bugzilla.suse.com/1060400 https://bugzilla.suse.com/1060985 https://bugzilla.suse.com/1061451 https://bugzilla.suse.com/1061721 https://bugzilla.suse.com/1061775 https://bugzilla.suse.com/1062279 https://bugzilla.suse.com/1062520 https://bugzilla.suse.com/1062962 https://bugzilla.suse.com/1063102 https://bugzilla.suse.com/1063349 https://bugzilla.suse.com/1063460 https://bugzilla.suse.com/1063475 https://bugzilla.suse.com/1063501 https://bugzilla.suse.com/1063509 https://bugzilla.suse.com/1063520 https://bugzilla.suse.com/1063570 https://bugzilla.suse.com/1063667 https://bugzilla.suse.com/1063695 https://bugzilla.suse.com/1064064 https://bugzilla.suse.com/1064206 https://bugzilla.suse.com/1064388 https://bugzilla.suse.com/1064436 https://bugzilla.suse.com/963575 https://bugzilla.suse.com/964944 https://bugzilla.suse.com/966170 https://bugzilla.suse.com/966172 https://bugzilla.suse.com/966186 https://bugzilla.suse.com/966191 https://bugzilla.suse.com/966316 https://bugzilla.suse.com/966318 https://bugzilla.suse.com/969476 https://bugzilla.suse.com/969477 https://bugzilla.suse.com/971975

1 0

openSUSE-SU-2017:2845-1: moderate: Security update for freeradius-server
by opensuse-security＠opensuse.org 25 Oct '17

25 Oct '17

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2845-1 Rating: moderate References: #1049086 Cross-References: CVE-2017-10978 CVE-2017-10983 CVE-2017-10984 CVE-2017-10985 CVE-2017-10986 CVE-2017-10987 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for freeradius-server fixes the following issues: Fix a number of security issues found via fuzzing by Guido Vranken See http://freeradius.org/security/fuzzer-2017.html for details. (boo#1049086) - CVE-2017-10987 / FR-GV-304: DHCP - Buffer over-read in fr_dhcp_decode_suboptions() - CVE-2017-10986 / FR-GV-303: DHCP - Infinite read in dhcp_attr2vp() - FR-AD-001: Use strncmp() instead of memcmp() for string data - CVE-2017-10983 / FR-GV-206: DHCP - Read overflow when decoding option 63 - CVE-2017-10985 / FR-GV-302: Infinite loop and memory exhaustion with 'concat' attributes - CVE-2017-10984 / FR-GV-301: Write overflow in data2vp_wimax() - FR-AD-002: String lifetime issues in rlm_python - FR-GV-305: Decode 'signed' attributes correctly - CVE-2017-10978 / FR-GV-201: Read / write overflow in make_secret() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1192=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): freeradius-server-3.0.12-2.9.1 freeradius-server-debuginfo-3.0.12-2.9.1 freeradius-server-debugsource-3.0.12-2.9.1 freeradius-server-devel-3.0.12-2.9.1 freeradius-server-doc-3.0.12-2.9.1 freeradius-server-krb5-3.0.12-2.9.1 freeradius-server-krb5-debuginfo-3.0.12-2.9.1 freeradius-server-ldap-3.0.12-2.9.1 freeradius-server-ldap-debuginfo-3.0.12-2.9.1 freeradius-server-libs-3.0.12-2.9.1 freeradius-server-libs-debuginfo-3.0.12-2.9.1 freeradius-server-mysql-3.0.12-2.9.1 freeradius-server-mysql-debuginfo-3.0.12-2.9.1 freeradius-server-perl-3.0.12-2.9.1 freeradius-server-perl-debuginfo-3.0.12-2.9.1 freeradius-server-postgresql-3.0.12-2.9.1 freeradius-server-postgresql-debuginfo-3.0.12-2.9.1 freeradius-server-python-3.0.12-2.9.1 freeradius-server-python-debuginfo-3.0.12-2.9.1 freeradius-server-sqlite-3.0.12-2.9.1 freeradius-server-sqlite-debuginfo-3.0.12-2.9.1 freeradius-server-utils-3.0.12-2.9.1 freeradius-server-utils-debuginfo-3.0.12-2.9.1 References: https://www.suse.com/security/cve/CVE-2017-10978.html https://www.suse.com/security/cve/CVE-2017-10983.html https://www.suse.com/security/cve/CVE-2017-10984.html https://www.suse.com/security/cve/CVE-2017-10985.html https://www.suse.com/security/cve/CVE-2017-10986.html https://www.suse.com/security/cve/CVE-2017-10987.html https://bugzilla.suse.com/1049086

1 0

openSUSE-RU-2017:2844-1: Recommended update for clamav-database
by maintenance＠opensuse.org 25 Oct '17

25 Oct '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2844-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Oct 23 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1191=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201710230006-54.94.1 References:

1 0

openSUSE-SU-2017:2835-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 23 Oct '17

23 Oct '17

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2835-1 Rating: moderate References: #1064540 Cross-References: CVE-2017-15227 CVE-2017-15228 CVE-2017-15721 CVE-2017-15722 CVE-2017-15723 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This security update for irssi to version 1.0.5 addresses the following security issues: * CVE-2017-15228: When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string. This issue could have resulted in denial of service (remote crash) when installing a malicious or broken theme file. * CVE-2017-15227: While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on. This issue could have caused denial of service (remote crash) when connecting to a malicious or broken ircd. * CVE-2017-15721: Certain incorrectly formatted DCC CTCP messages could cause NULL pointer dereference. This issue could have caused denial of service (remote crash) when connecting to a malicious or broken ircd. * CVE-2017-15723: Overlong nicks or targets may result in a NULL pointer dereference while splitting the message. This issue could have caused denial of service (remote crash) when connecting to a malicious or broken ircd. * CVE-2017-15722: In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1189=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.0.5-32.1 irssi-debuginfo-1.0.5-32.1 irssi-debugsource-1.0.5-32.1 irssi-devel-1.0.5-32.1 References: https://www.suse.com/security/cve/CVE-2017-15227.html https://www.suse.com/security/cve/CVE-2017-15228.html https://www.suse.com/security/cve/CVE-2017-15721.html https://www.suse.com/security/cve/CVE-2017-15722.html https://www.suse.com/security/cve/CVE-2017-15723.html https://bugzilla.suse.com/1064540

1 0

openSUSE-SU-2017:2834-1: Security update for jq
by opensuse-security＠opensuse.org 23 Oct '17

23 Oct '17

openSUSE Security Update: Security update for jq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2834-1 Rating: low References: #1014176 #1017157 Cross-References: CVE-2016-4074 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for jq fixes the following minor security issue: * CVE-2016-4074: stack exhaustion could affect availability when parsing untrusted imput (bsc#1014176) The following tracked packaging changes are included: * Update tests dependencies to increase test coverage (bsc#1017157) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1190=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): jq-1.5-5.1 jq-debuginfo-1.5-5.1 jq-debugsource-1.5-5.1 libjq-devel-1.5-5.1 libjq1-1.5-5.1 libjq1-debuginfo-1.5-5.1 References: https://www.suse.com/security/cve/CVE-2016-4074.html https://bugzilla.suse.com/1014176 https://bugzilla.suse.com/1017157

1 0

openSUSE-SU-2017:2833-1: Security update for jq
by opensuse-security＠opensuse.org 23 Oct '17

23 Oct '17

openSUSE Security Update: Security update for jq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2833-1 Rating: low References: #1014176 #1017157 Cross-References: CVE-2016-4074 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for jq fixes the following minor security issue: * CVE-2016-4074: stack exhaustion could affect availability when parsing untrusted imput (bsc#1014176) The following tracked packaging changes are included: * Update tests dependencies to increase test coverage (bsc#1017157) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1190=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): jq-1.5-8.3.1 jq-debuginfo-1.5-8.3.1 jq-debugsource-1.5-8.3.1 libjq-devel-1.5-8.3.1 libjq1-1.5-8.3.1 libjq1-debuginfo-1.5-8.3.1 References: https://www.suse.com/security/cve/CVE-2016-4074.html https://bugzilla.suse.com/1014176 https://bugzilla.suse.com/1017157

1 0

openSUSE-SU-2017:2832-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 23 Oct '17

23 Oct '17

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2832-1 Rating: moderate References: #1064540 Cross-References: CVE-2017-15227 CVE-2017-15228 CVE-2017-15721 CVE-2017-15722 CVE-2017-15723 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This security update for irssi to version 1.0.5 addresses the following security issues: * CVE-2017-15228: When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string. This issue could have resulted in denial of service (remote crash) when installing a malicious or broken theme file. * CVE-2017-15227: While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on. This issue could have caused denial of service (remote crash) when connecting to a malicious or broken ircd. * CVE-2017-15721: Certain incorrectly formatted DCC CTCP messages could cause NULL pointer dereference. This issue could have caused denial of service (remote crash) when connecting to a malicious or broken ircd. * CVE-2017-15723: Overlong nicks or targets may result in a NULL pointer dereference while splitting the message. This issue could have caused denial of service (remote crash) when connecting to a malicious or broken ircd. * CVE-2017-15722: In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1189=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1189=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.0.5-17.1 irssi-debuginfo-1.0.5-17.1 irssi-debugsource-1.0.5-17.1 irssi-devel-1.0.5-17.1 - openSUSE Leap 42.2 (i586 x86_64): irssi-1.0.5-14.14.1 irssi-debuginfo-1.0.5-14.14.1 irssi-debugsource-1.0.5-14.14.1 irssi-devel-1.0.5-14.14.1 References: https://www.suse.com/security/cve/CVE-2017-15227.html https://www.suse.com/security/cve/CVE-2017-15228.html https://www.suse.com/security/cve/CVE-2017-15721.html https://www.suse.com/security/cve/CVE-2017-15722.html https://www.suse.com/security/cve/CVE-2017-15723.html https://bugzilla.suse.com/1064540

1 0

openSUSE-OU-2017:2830-1: moderate: Optional update adding docker-compose to the SUSE PackageHub
by maintenance＠opensuse.org 22 Oct '17

22 Oct '17

openSUSE Optional Update: Optional update adding docker-compose to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2830-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds docker-compose to the SUSE PackageHub. docker-compose is a utility to define and run complex applications using Docker. This version is adapted to work with the run-time dependencies available on SLE 12. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1188=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): docker-compose-1.2.0-2.1 References:

1 0

openSUSE-RU-2017:2829-1: moderate: Recommended update for gnuhealth
by maintenance＠opensuse.org 22 Oct '17

22 Oct '17

openSUSE Recommended Update: Recommended update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2829-1 Rating: moderate References: #1026334 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth fixes the following issues: - Fix issue that would cause files not to be found in backup (bsc#1026334) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1187=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): gnuhealth-3.2.5-32.1 References: https://bugzilla.suse.com/1026334

1 0

openSUSE-RU-2017:2828-1: moderate: Recommended update for resource-agents
by maintenance＠opensuse.org 22 Oct '17

22 Oct '17

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2828-1 Rating: moderate References: #1047991 #1048288 #1051913 #1053621 #1055017 #1056635 #1059314 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for resource-agents provides the following fixes: - galera: Honor "safe_to_bootstrap" flag in grastate.dat to make sure galera clusters are boostrapped correctly. (bsc#1055017) - galera: Fix instance name in master_exists() so that operations (like start, stop, etc) work correctly on a galera/mysql instance. (bsc#1056635) - aws-vpc-route53: Add agent for AWS Route 53. (fate#322781, bsc#1059314) - sg_persist: Read empty values when there are no attributes yet. (bsc#1048288) - Raid1: Add support for named md devices by handling the case of mddev being a symlink. (bsc#1047991) - ocf-shellfuncs: Avoid printing empty INFO messages. (bsc#1053621) - SAPInstance: Mention monitor support in documentation. (bsc#1051913) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1186=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ldirectord-4.0.1+git.1495055229.643177f1-6.1 resource-agents-4.0.1+git.1495055229.643177f1-6.1 resource-agents-debuginfo-4.0.1+git.1495055229.643177f1-6.1 resource-agents-debugsource-4.0.1+git.1495055229.643177f1-6.1 - openSUSE Leap 42.3 (noarch): monitoring-plugins-metadata-4.0.1+git.1495055229.643177f1-6.1 References: https://bugzilla.suse.com/1047991 https://bugzilla.suse.com/1048288 https://bugzilla.suse.com/1051913 https://bugzilla.suse.com/1053621 https://bugzilla.suse.com/1055017 https://bugzilla.suse.com/1056635 https://bugzilla.suse.com/1059314

1 0

openSUSE-RU-2017:2827-1: moderate: Recommended update for yast2 and yast2-network
by maintenance＠opensuse.org 22 Oct '17

22 Oct '17

openSUSE Recommended Update: Recommended update for yast2 and yast2-network ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2827-1 Rating: moderate References: #1026027 #1036440 #1037214 #1037727 #1038717 #1050986 #932331 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for yast2 and yast2-network provides the following fixes: - Fix udev rules export when more than one device is configured. (bsc#1050986) - Avoid creating duplicate udev rules in AutoYaST installation. (bsc#1038717) - Fix device name recognition during AutoYaST installation. (bsc#1037727) - Change dhclient configuration warning messages to not block AutoYaST. (bsc#1037727) - Improve the logic to report if SuSEfirewall2 is selected or installed when installing OES using integrated media to make sure it gets properly activated. The problem would happen once the product is registered and manual network configuration is selected. (bnc#1037214) - Fix a problem that was causing warning messages to open a UI dialog in command-line mode and wait for user input. (bsc#1036440). - Remove the usage and the dependency on insserv as it is not really necessary. (bsc#1026027) - Fix some tests to work with the latest yast2-core package. (bsc#932331) - Add a CWM::ReplacePoint widget. - Add a generic CWM widget for keyboard layout. (FATE#321754) - Fix error popup when replacing widget with CWM::ReplacePoint. (FATE#322328) - When skipping storing of widget values, skip also its validation. (FATE#322328) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1184=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-3.1.217-5.6.1 yast2-network-3.1.181-5.9.1 References: https://bugzilla.suse.com/1026027 https://bugzilla.suse.com/1036440 https://bugzilla.suse.com/1037214 https://bugzilla.suse.com/1037727 https://bugzilla.suse.com/1038717 https://bugzilla.suse.com/1050986 https://bugzilla.suse.com/932331

1 0

openSUSE-RU-2017:2826-1: moderate: Recommended update for resource-agents
by maintenance＠opensuse.org 22 Oct '17

22 Oct '17

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2826-1 Rating: moderate References: #1035470 #1047991 #1048170 #1048288 #1051913 #1053207 #1055017 #1056635 #1059314 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update for resource-agents provides the following fixes: - galera: Honor "safe_to_bootstrap" flag in grastate.dat to make sure galera clusters are boostrapped correctly. (bsc#1055017) - galera: Fix instance name in master_exists() so that operations (like start, stop, etc) work correctly on a galera/mysql instance. (bsc#1056635) - aws-vpc-route53: Add agent for AWS Route 53. (fate#322781, bsc#1059314) - sg_persist: Read empty values when there are no attributes yet. (bsc#1048288) - sg_persist: Fix matching of hexadecimal node IDs, making sure only the actual ID numbers are matched and not other numbers from the same input line. (bsc#1048170) - DB2: Fix HADR support for DB2 V98+ (bsc#1035470) - Raid1: Fix using named md devices by handling the case of mddev being a symlink. (bsc#1047991) - SAPInstance: Mention monitor support in documentation. (bsc#1051913) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1185=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ldirectord-3.9.7+git.1461938976.cb7c36a-6.7.1 monitoring-plugins-metadata-3.9.7+git.1461938976.cb7c36a-6.7.1 resource-agents-3.9.7+git.1461938976.cb7c36a-6.7.1 resource-agents-debuginfo-3.9.7+git.1461938976.cb7c36a-6.7.1 resource-agents-debugsource-3.9.7+git.1461938976.cb7c36a-6.7.1 References: https://bugzilla.suse.com/1035470 https://bugzilla.suse.com/1047991 https://bugzilla.suse.com/1048170 https://bugzilla.suse.com/1048288 https://bugzilla.suse.com/1051913 https://bugzilla.suse.com/1053207 https://bugzilla.suse.com/1055017 https://bugzilla.suse.com/1056635 https://bugzilla.suse.com/1059314

1 0

openSUSE-SU-2017:2825-1: moderate: Security update for xerces-j2
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for xerces-j2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2825-1 Rating: moderate References: #1047536 #814241 #879138 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: xerces-j2 was updated to fix several issues. This security issue was fixed: - bsc#814241: Prevent possible DoS through very long attribute names This non-security issue was fixed: - Prevent StackOverflowError when applying a pattern restriction on long strings while trying to validate an XML file against a schema (bsc#1047536, bsc#879138) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1179=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1179=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): xerces-j2-2.8.1-9.1 xerces-j2-demo-2.8.1-9.1 xerces-j2-scripts-2.8.1-9.1 xerces-j2-xml-apis-2.8.1-9.1 xerces-j2-xml-resolver-2.8.1-9.1 - openSUSE Leap 42.2 (noarch): xerces-j2-2.8.1-6.3.1 xerces-j2-demo-2.8.1-6.3.1 xerces-j2-scripts-2.8.1-6.3.1 xerces-j2-xml-apis-2.8.1-6.3.1 xerces-j2-xml-resolver-2.8.1-6.3.1 References: https://bugzilla.suse.com/1047536 https://bugzilla.suse.com/814241 https://bugzilla.suse.com/879138

1 0

openSUSE-SU-2017:2824-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2824-1 Rating: moderate References: #1042749 #1052264 #1059758 #1061407 #1062462 #1062464 #985112 Cross-References: CVE-2017-14695 CVE-2017-14696 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 5 fixes is now available. Description: Salt was updated to 2017.7.2 and also to fix various bugs and security issues. See https://docs.saltstack.com/en/develop/topics/releases/2017.7.2.html for full changelog. Security issues fixed: - CVE-2017-14695: A directory traversal during minion id validation was fixed. (boo#1062462) - CVE-2017-14696: A remote denial of service attack with a specially crafted authentication request was fixed. (boo#1062464) Non security issues fixed: - Add possibility to generate _version.py at the build time for raw builds: https://github.com/saltstack/salt/pull/43955 - Fix salt target-type field returns "String" for existing jids but an empty "Array" for non existing jids. (issue #1711) - Fixed minion resource exhaustion when many functions are being executed in parallel (boo#1059758) - Remove 'TasksTask' attribute from salt-master.service in older versions of systemd (boo#985112) - Provide custom SUSE salt-master.service file. - Fix wrong version reported by Salt (boo#1061407) - list_pkgs: add parameter for returned attribute selection (boo#1052264) - Adding the leftover for zypper and yum list_pkgs functionality. - Use $HOME to get the user home directory instead using '~' char (boo#1042749) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1182=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): salt-bash-completion-2017.7.2-14.1 salt-fish-completion-2017.7.2-14.1 salt-zsh-completion-2017.7.2-14.1 - openSUSE Leap 42.3 (x86_64): salt-2017.7.2-14.1 salt-api-2017.7.2-14.1 salt-cloud-2017.7.2-14.1 salt-doc-2017.7.2-14.1 salt-master-2017.7.2-14.1 salt-minion-2017.7.2-14.1 salt-proxy-2017.7.2-14.1 salt-ssh-2017.7.2-14.1 salt-syndic-2017.7.2-14.1 References: https://www.suse.com/security/cve/CVE-2017-14695.html https://www.suse.com/security/cve/CVE-2017-14696.html https://bugzilla.suse.com/1042749 https://bugzilla.suse.com/1052264 https://bugzilla.suse.com/1059758 https://bugzilla.suse.com/1061407 https://bugzilla.suse.com/1062462 https://bugzilla.suse.com/1062464 https://bugzilla.suse.com/985112

1 0

openSUSE-SU-2017:2823-1: moderate: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2823-1 Rating: moderate References: #1063034 #1063035 #1063037 #1063038 #1063039 #1063040 #1063041 Cross-References: CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12179 CVE-2017-12180 CVE-2017-12181 CVE-2017-12182 CVE-2017-12183 CVE-2017-12184 CVE-2017-12185 CVE-2017-12186 CVE-2017-12187 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for xorg-x11-server fixes the following vulnerabilities: * CVE-2017-12176: Unvalidated extra length in ProcEstablishConnection (bsc#1063041) * CVE-2017-12177: dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo (bsc#1063040) * CVE-2017-12178: Xi: fix wrong extra length check in ProcXIChangeHierarchy (bsc#1063039) * CVE-2017-12179: Xi: integer overflow and unvalidated length in (S)ProcXIBarrierReleasePointer (bsc#1063038) * CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Unvalidated lengths in XFree86-VidMode/XFree86-DGA/XFree86-DRI extension (bsc#1063037) * CVE-2017-12183: Unvalidated lengths in XFIXES extension (bsc#1063035) * CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Unvalidated lengths in multiple extensions (bsc#1063034) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1177=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1177=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): xorg-x11-server-7.6_1.18.3-28.1 xorg-x11-server-debuginfo-7.6_1.18.3-28.1 xorg-x11-server-debugsource-7.6_1.18.3-28.1 xorg-x11-server-extra-7.6_1.18.3-28.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-28.1 xorg-x11-server-sdk-7.6_1.18.3-28.1 xorg-x11-server-source-7.6_1.18.3-28.1 - openSUSE Leap 42.2 (i586 x86_64): xorg-x11-server-7.6_1.18.3-12.26.1 xorg-x11-server-debuginfo-7.6_1.18.3-12.26.1 xorg-x11-server-debugsource-7.6_1.18.3-12.26.1 xorg-x11-server-extra-7.6_1.18.3-12.26.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-12.26.1 xorg-x11-server-sdk-7.6_1.18.3-12.26.1 xorg-x11-server-source-7.6_1.18.3-12.26.1 References: https://www.suse.com/security/cve/CVE-2017-12176.html https://www.suse.com/security/cve/CVE-2017-12177.html https://www.suse.com/security/cve/CVE-2017-12178.html https://www.suse.com/security/cve/CVE-2017-12179.html https://www.suse.com/security/cve/CVE-2017-12180.html https://www.suse.com/security/cve/CVE-2017-12181.html https://www.suse.com/security/cve/CVE-2017-12182.html https://www.suse.com/security/cve/CVE-2017-12183.html https://www.suse.com/security/cve/CVE-2017-12184.html https://www.suse.com/security/cve/CVE-2017-12185.html https://www.suse.com/security/cve/CVE-2017-12186.html https://www.suse.com/security/cve/CVE-2017-12187.html https://bugzilla.suse.com/1063034 https://bugzilla.suse.com/1063035 https://bugzilla.suse.com/1063037 https://bugzilla.suse.com/1063038 https://bugzilla.suse.com/1063039 https://bugzilla.suse.com/1063040 https://bugzilla.suse.com/1063041

1 0

openSUSE-SU-2017:2822-1: moderate: Security update for salt
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2822-1 Rating: moderate References: #1020831 #1022562 #1022841 #1023535 #1027722 #1030009 #1030073 #1032213 #1032452 #1032931 #1035914 #1036125 #1038855 #1040886 #1042749 #1043111 #1052264 #1053955 #1059758 #1061407 #1062462 #1062464 #985112 Cross-References: CVE-2017-12791 CVE-2017-14695 CVE-2017-14696 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 20 fixes is now available. Description: Salt was updated to 2017.7.2 and also to fix various bugs and security issues. See the following resources for the full changelog: https://docs.saltstack.com/en/develop/topics/releases/2017.7.2.html https://docs.saltstack.com/en/develop/topics/releases/2017.7.1.html https://docs.saltstack.com/en/develop/topics/releases/2017.7.0.html Security issues fixed: - CVE-2017-14695: A directory traversal during minion id validation was fixed. (boo#1062462) - CVE-2017-14696: A remote denial of service attack with a specially crafted authentication request was fixed. (boo#1062464) - CVE-2017-12791: crafted minion ID could lead directory traversal on the Salt-master (boo#1053955) Non security issues fixed: - Add possibility to generate _version.py at the build time for raw builds: https://github.com/saltstack/salt/pull/43955 - Fix salt target-type field returns "String" for existing jids but an empty "Array" for non existing jids. (issue #1711) - Fixed minion resource exhaustion when many functions are being executed in parallel (boo#1059758) - Remove 'TasksTask' attribute from salt-master.service in older versions of systemd (boo#985112) - Provide custom SUSE salt-master.service file. - Fix wrong version reported by Salt (boo#1061407) - list_pkgs: add parameter for returned attribute selection (boo#1052264) - Adding the leftover for zypper and yum list_pkgs functionality. - Use $HOME to get the user home directory instead using '~' char (boo#1042749) - fix ownership for whole master cache directory (boo#1035914) - fix setting the language on SUSE systems (boo#1038855) - wrong os_family grains on SUSE - fix unittests (boo#1038855) - speed-up cherrypy by removing sleep call - Disable 3rd party runtime packages to be explicitly recommended. (boo#1040886) - fix format error (boo#1043111) - Add a salt-minion watchdog for RHEL6 and SLES11 systems (sysV) to restart salt-minion in case of crashes during upgrade. - Add procps as dependency. - Bugfix: jobs scheduled to run at a future time stay pending for Salt minions (boo#1036125) - Wrong os_family grains on SUSE - fix unittests. (boo#1038855) - Fix setting the language on SUSE systems. (boo#1038855) - Bugfix: unable to use hostname for minion ID as '127'. (upstream) - Bugfix: remove sleep call in CheppryPy API handler. (upstream) - Fix core grains constants for timezone. (boo#1032931) - Prevents zero length error on Python 2.6. - Fixes zypper test error after backporting. - Refactoring on Zypper and Yum execution and state modules to allow installation of patches/errata. - Allows to set 'timeout' and 'gather_job_timeout' via kwargs. - Add missing bootstrap script for Salt Cloud. (boo#1032452) - raet protocol is no longer supported. (boo#1020831) - Fix: add missing /var/cache/salt/cloud directory. (boo#1032213) - Cleanup salt user environment preparation. (boo#1027722) - Fix: race condition on cache directory creation. - Fix: /var/log/salt/minion fails logrotate. (boo#1030009) - Fix: Result of master_tops extension is mutually overwritten. (boo#1030073) - Allows to set custom timeouts for 'manage.up' and 'manage.status'. - Keep fix for migrating salt home directory. (boo#1022562) - Fix salt-minion update on RHEL. (boo#1022841) - Prevents 'OSError' exception in case certain job cache path doesn't exist. (boo#1023535) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1183=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): salt-2017.7.2-5.3.1 salt-api-2017.7.2-5.3.1 salt-cloud-2017.7.2-5.3.1 salt-doc-2017.7.2-5.3.1 salt-master-2017.7.2-5.3.1 salt-minion-2017.7.2-5.3.1 salt-proxy-2017.7.2-5.3.1 salt-ssh-2017.7.2-5.3.1 salt-syndic-2017.7.2-5.3.1 - openSUSE Leap 42.2 (noarch): salt-bash-completion-2017.7.2-5.3.1 salt-fish-completion-2017.7.2-5.3.1 salt-zsh-completion-2017.7.2-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-12791.html https://www.suse.com/security/cve/CVE-2017-14695.html https://www.suse.com/security/cve/CVE-2017-14696.html https://bugzilla.suse.com/1020831 https://bugzilla.suse.com/1022562 https://bugzilla.suse.com/1022841 https://bugzilla.suse.com/1023535 https://bugzilla.suse.com/1027722 https://bugzilla.suse.com/1030009 https://bugzilla.suse.com/1030073 https://bugzilla.suse.com/1032213 https://bugzilla.suse.com/1032452 https://bugzilla.suse.com/1032931 https://bugzilla.suse.com/1035914 https://bugzilla.suse.com/1036125 https://bugzilla.suse.com/1038855 https://bugzilla.suse.com/1040886 https://bugzilla.suse.com/1042749 https://bugzilla.suse.com/1043111 https://bugzilla.suse.com/1052264 https://bugzilla.suse.com/1053955 https://bugzilla.suse.com/1059758 https://bugzilla.suse.com/1061407 https://bugzilla.suse.com/1062462 https://bugzilla.suse.com/1062464 https://bugzilla.suse.com/985112

1 0