October 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:2821-1: important: Security update for xen
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2821-1 Rating: important References: #1027519 #1055321 #1059777 #1061076 #1061077 #1061080 #1061081 #1061082 #1061084 #1061086 #1061087 Cross-References: CVE-2017-15588 CVE-2017-15589 CVE-2017-15590 CVE-2017-15592 CVE-2017-15593 CVE-2017-15594 CVE-2017-15595 CVE-2017-5526 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues: These security issues were fixed: - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1059777) - CVE-2017-15593: Missing cleanup in the page type system allowed a malicious or buggy PV guest to cause DoS (XSA-242 bsc#1061084) - CVE-2017-15592: A problem in the shadow pagetable code allowed a malicious or buggy HVM guest to cause DoS or cause hypervisor memory corruption potentially allowing the guest to escalate its privilege (XSA-243 bsc#1061086) - CVE-2017-15594: Problematic handling of the selector fields in the Interrupt Descriptor Table (IDT) allowed a malicious or buggy x86 PV guest to escalate its privileges or cause DoS (XSA-244 bsc#1061087) - CVE-2017-15591: Missing checks in the handling of DMOPs allowed malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 to cause a DoS (XSA-238 bsc#1061077) - CVE-2017-15589: Intercepted I/O write operations with less than a full machine word's worth of data were not properly handled, which allowed a malicious unprivileged x86 HVM guest to obtain sensitive information from the host or other guests (XSA-239 bsc#1061080) - CVE-2017-15595: In certain configurations of linear page tables a stack overflow might have occured that allowed a malicious or buggy PV guest to cause DoS and potentially privilege escalation and information leaks (XSA-240 bsc#1061081) - CVE-2017-15588: Under certain conditions x86 PV guests could have caused the hypervisor to miss a necessary TLB flush for a page. This allowed a malicious x86 PV guest to access all of system memory, allowing for privilege escalation, DoS, and information leaks (XSA-241 bsc#1061082) - CVE-2017-15590: Multiple issues existed with the setup of PCI MSI interrupts that allowed a malicious or buggy guest to cause DoS and potentially privilege escalation and information leaks (XSA-237 bsc#1061076) - bsc#1055321: When dealing with the grant map space of add-to-physmap operations, ARM specific code failed to release a lock. This allowed a malicious guest administrator to cause DoS (XSA-235) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1181=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.0_14-10.1 xen-debugsource-4.9.0_14-10.1 xen-devel-4.9.0_14-10.1 xen-doc-html-4.9.0_14-10.1 xen-libs-4.9.0_14-10.1 xen-libs-debuginfo-4.9.0_14-10.1 xen-tools-4.9.0_14-10.1 xen-tools-debuginfo-4.9.0_14-10.1 xen-tools-domU-4.9.0_14-10.1 xen-tools-domU-debuginfo-4.9.0_14-10.1 References: https://www.suse.com/security/cve/CVE-2017-15588.html https://www.suse.com/security/cve/CVE-2017-15589.html https://www.suse.com/security/cve/CVE-2017-15590.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15593.html https://www.suse.com/security/cve/CVE-2017-15594.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-5526.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1055321 https://bugzilla.suse.com/1059777 https://bugzilla.suse.com/1061076 https://bugzilla.suse.com/1061077 https://bugzilla.suse.com/1061080 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061082 https://bugzilla.suse.com/1061084 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1061087

1 0

openSUSE-SU-2017:2820-1: moderate: Security update for python3-PyJWT
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for python3-PyJWT ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2820-1 Rating: moderate References: #1054106 Cross-References: CVE-2017-11424 CVE-2017-12880 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python3-PyJWT fixes the following vulnerabilty: * CVE-2017-11424: Insufficient filtering of PEM encoding public keys allowed for creation of JWTs from scratch (boo#1054106, with duplicate CVE-2017-12880) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1178=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python3-PyJWT-1.4.2-3.1 References: https://www.suse.com/security/cve/CVE-2017-11424.html https://www.suse.com/security/cve/CVE-2017-12880.html https://bugzilla.suse.com/1054106

1 0

openSUSE-SU-2017:2818-1: moderate: Security update for exiv2
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for exiv2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2818-1 Rating: moderate References: #1050257 #1051188 #1060996 #1061000 #1061003 Cross-References: CVE-2017-11591 CVE-2017-11683 CVE-2017-14859 CVE-2017-14862 CVE-2017-14865 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for exiv2 fixes the following issues: Security issues fixed: - CVE-2017-11591: There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. (boo#1050257) - CVE-2017-11683: There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. (boo#1051188) - CVE-2017-14865: There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack. (boo#1061003) - CVE-2017-14862: An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. (boo#1060996) - CVE-2017-14859: An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. (boo#1061000) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1180=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1180=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): exiv2-0.25-10.1 exiv2-debuginfo-0.25-10.1 exiv2-debugsource-0.25-10.1 libexiv2-14-0.25-10.1 libexiv2-14-debuginfo-0.25-10.1 libexiv2-devel-0.25-10.1 - openSUSE Leap 42.3 (x86_64): libexiv2-14-32bit-0.25-10.1 libexiv2-14-debuginfo-32bit-0.25-10.1 - openSUSE Leap 42.3 (noarch): exiv2-lang-0.25-10.1 - openSUSE Leap 42.2 (i586 x86_64): exiv2-0.25-7.3.1 exiv2-debuginfo-0.25-7.3.1 exiv2-debugsource-0.25-7.3.1 libexiv2-14-0.25-7.3.1 libexiv2-14-debuginfo-0.25-7.3.1 libexiv2-devel-0.25-7.3.1 - openSUSE Leap 42.2 (noarch): exiv2-lang-0.25-7.3.1 - openSUSE Leap 42.2 (x86_64): libexiv2-14-32bit-0.25-7.3.1 libexiv2-14-debuginfo-32bit-0.25-7.3.1 References: https://www.suse.com/security/cve/CVE-2017-11591.html https://www.suse.com/security/cve/CVE-2017-11683.html https://www.suse.com/security/cve/CVE-2017-14859.html https://www.suse.com/security/cve/CVE-2017-14862.html https://www.suse.com/security/cve/CVE-2017-14865.html https://bugzilla.suse.com/1050257 https://bugzilla.suse.com/1051188 https://bugzilla.suse.com/1060996 https://bugzilla.suse.com/1061000 https://bugzilla.suse.com/1061003

1 0

openSUSE-SU-2017:2810-1: moderate: Security update for bluez
by opensuse-security＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Security Update: Security update for bluez ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2810-1 Rating: moderate References: #1026652 #1057342 Cross-References: CVE-2016-7837 CVE-2017-1000250 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bluez fixes the following vulnerabilities: * CVE-2016-7837: Buffer overflow in parse_line function (bsc#1026652) * CVE-2017-1000250: information disclosure vulnerability in service_search_attr_req (bsc#1057342) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1176=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1176=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): bluez-5.41-6.1 bluez-cups-5.41-6.1 bluez-cups-debuginfo-5.41-6.1 bluez-debuginfo-5.41-6.1 bluez-debugsource-5.41-6.1 bluez-devel-5.41-6.1 bluez-test-5.41-6.1 bluez-test-debuginfo-5.41-6.1 libbluetooth3-5.41-6.1 libbluetooth3-debuginfo-5.41-6.1 - openSUSE Leap 42.3 (x86_64): bluez-devel-32bit-5.41-6.1 libbluetooth3-32bit-5.41-6.1 libbluetooth3-debuginfo-32bit-5.41-6.1 - openSUSE Leap 42.2 (i586 x86_64): bluez-5.41-2.5.1 bluez-cups-5.41-2.5.1 bluez-cups-debuginfo-5.41-2.5.1 bluez-debuginfo-5.41-2.5.1 bluez-debugsource-5.41-2.5.1 bluez-devel-5.41-2.5.1 bluez-test-5.41-2.5.1 bluez-test-debuginfo-5.41-2.5.1 libbluetooth3-5.41-2.5.1 libbluetooth3-debuginfo-5.41-2.5.1 - openSUSE Leap 42.2 (x86_64): bluez-devel-32bit-5.41-2.5.1 libbluetooth3-32bit-5.41-2.5.1 libbluetooth3-debuginfo-32bit-5.41-2.5.1 References: https://www.suse.com/security/cve/CVE-2016-7837.html https://www.suse.com/security/cve/CVE-2017-1000250.html https://bugzilla.suse.com/1026652 https://bugzilla.suse.com/1057342

1 0

openSUSE-RU-2017:2795-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 20 Oct '17

20 Oct '17

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2795-1 Rating: moderate References: #1064314 Affected Products: openSUSE Leap 42.3:NonFree openSUSE Leap 42.2:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Opera to version 48.0.2685.50 contains the following changes: * search pop up tool with currency converter * unit and time zone converters * new snapshot tool * add option to remove unwanted autocomplete suggestions in the search and address back * cleaned up menus * sharpen interface for HiDPI screens Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3:NonFree: zypper in -t patch openSUSE-2017-1175=1 - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-1175=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3:NonFree (x86_64): opera-48.0.2685.50-53.1 - openSUSE Leap 42.2:NonFree (x86_64): opera-48.0.2685.50-58.1 References: https://bugzilla.suse.com/1064314

1 0

openSUSE-OU-2017:2768-1: moderate: Optional update for python-blinker
by maintenance＠opensuse.org 19 Oct '17

19 Oct '17

openSUSE Optional Update: Optional update for python-blinker ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2768-1 Rating: moderate References: Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update contains python-blinker 1.4. The package is a dependency of cloud-init. This updates the package to the version used in SLE, and it will inherit future updates from there. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1170=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1170=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-blinker-1.4-8.1 - openSUSE Leap 42.2 (noarch): python-blinker-1.4-5.3.1 References:

1 0

openSUSE-RU-2017:2767-1: Recommended update for vm-install
by maintenance＠opensuse.org 19 Oct '17

19 Oct '17

openSUSE Recommended Update: Recommended update for vm-install ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2767-1 Rating: low References: #1056738 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for vm-install provides the following fix: - Make it possible to install guests based on pvops kernel. (bsc#1056738) - Add support for SLES15 and SLED15. (bsc#1056738) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1171=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): vm-install-0.8.68-3.1 References: https://bugzilla.suse.com/1056738

1 0

openSUSE-SU-2017:2766-1: moderate: Security update for upx
by opensuse-security＠opensuse.org 19 Oct '17

19 Oct '17

openSUSE Security Update: Security update for upx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2766-1 Rating: moderate References: #1062059 Cross-References: CVE-2017-15056 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for upx fixes the following security issue: * CVE-2017-15056: specially crafted package may have caused a denial of service (boo#1062059) In addition upx was updated to 3.94, with the following improvements: * Support for aarch64). * Support for --lzma compression on 64-bit PowerPC Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1174=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1174=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): upx-3.94-9.1 upx-debuginfo-3.94-9.1 upx-debugsource-3.94-9.1 - openSUSE Leap 42.2 (x86_64): upx-3.94-6.3.1 upx-debuginfo-3.94-6.3.1 upx-debugsource-3.94-6.3.1 References: https://www.suse.com/security/cve/CVE-2017-15056.html https://bugzilla.suse.com/1062059

1 0

openSUSE-SU-2017:2765-1: moderate: Security update for cacti and cacti-spine
by opensuse-security＠opensuse.org 19 Oct '17

19 Oct '17

openSUSE Security Update: Security update for cacti and cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2765-1 Rating: moderate References: #1062554 Cross-References: CVE-2017-15194 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti and cacti-spine fixes the following issues: Build version 1.1.26 - issue#841: --input-fields variable not working with add_graphs.php cli - issue#986: Resolve minor appearance problem on Modern theme - issue#989: Resolve issue with data input method commands loosing spaces on import - issue#1000: add_graphs.php not recognizing input fields - issue#1003: Reversing resolution to Issue#995 due to adverse impact to polling times - issue#1008: Remove developer debug warning about thumbnail validation - issue#1009: Resolving minor issue with cmd_realtime.php and a changing hostname - issue#1010: CVE-2017-15194 - Path-Based Cross-Site Scripting (XSS) (bsc#1062554) - issue#1027: Confirm that the PHP date.timezone setting is properly set during install - issue: Fixed database session handling for PHP 7.1 - issue: Fixed some missing i18n - issue: Fixed typo's - feature: Updated Dutch translations - feature: Schema changes; Examined queries without key usage and added/changed some keys - feature: Some small improvements Build version 1.1.25 - issue#966: Email still using SMTP security even though set to none - issue#995: Redirecting exec_background() to dev null breaks some functions - issue#998: Allow removal of external data template and prevent their creation - issue: Remove spikes uses wrong variance value from WebGUI - issue: Changing filters on log page does not reset to first page - issue: Allow manual creation of external data sources once again - feature: Updated Dutch translations Build version 1.1.24 - issue#932: Zoom positioning breaks when you scroll the graph page - issue#970: Remote Data Collector Cache Synchronization missing plugin sub-directories - issue#980: Resolve issue where a new tree branches refreshs before you have a chance to name it - issue#982: Data Source Profile size information not showing properly - issue: Long sysDescriptions on automation page cause columns to be hidden - issue: Resolve visual issues in Classic theme - feature: Allow Resynchronization of Poller Resource Cache Build version 1.1.23 - issue#963: SQL Errors with snmpagent and MariaDB 10.2 - issue#964: SQL Mode optimization failing in 1.1.22 Build version 1.1.22 - issue#950: Automation - New graph rule looses name on change - issue#952: CSV Export not rendering chinese characters correctly (Second attempt) - issue#955: Validation error trying to view graph debug syntax - issue: MySQL/MariaDB database sql_mode NO_AUTO_VALUE_ON_ZERO corrupts Cacti database - issue: When creating a data source, the data source profile does not default to the system default - feature: Enhance table filters to support new Cycle plugin - feature: Updated Dutch Translations Build version 1.1.21 - issue#938: Problems upgrading to 1.1.20 with one table alter statement - issue#952: CSV Export not rendering chinese characters correctly - issue: Minor alignment issue on tables Build version 1.1.20 - issue#920: Issue with scrollbars after update to 1.1.19 related to #902 - issue#921: Tree Mode no longer expands to accomodate full tree item names - issue#922: When using LDAP domains some setings are not passed correctly to the Cacti LDAP library - issue#923: Warninga in cacti.log are displayed incorrectly - issue#926: Update Utilities page to provide more information on rebuilding poller cache - issue#927: Minor schema change to support XtraDB Cluster - issue#929: Overlapping frames on certain themes - issue#931: Aggregate graphs missing from list view - issue#933: Aggregate graphs page counter off - issue#935: Support utf8 printable in data query inserts - issue#936: TimeZone query failure undefined function - issue: Taking actions on users does not use callbacks - issue: Undefined constant in lib/snmp.php on RHEL7 - issue: Human readable socket errno's not defined - issue: Audit of ping methods tcp, udp, and icmp ping. IPv6 will still not work till php 5.5.4 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1173=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1173=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): cacti-spine-1.1.26-16.1 cacti-spine-debuginfo-1.1.26-16.1 cacti-spine-debugsource-1.1.26-16.1 - openSUSE Leap 42.3 (noarch): cacti-1.1.26-25.1 cacti-doc-1.1.26-25.1 - openSUSE Leap 42.2 (i586 x86_64): cacti-spine-1.1.26-7.9.1 cacti-spine-debuginfo-1.1.26-7.9.1 cacti-spine-debugsource-1.1.26-7.9.1 - openSUSE Leap 42.2 (noarch): cacti-1.1.26-16.9.1 cacti-doc-1.1.26-16.9.1 References: https://www.suse.com/security/cve/CVE-2017-15194.html https://bugzilla.suse.com/1062554

1 0

openSUSE-RU-2017:2764-1: moderate: Recommended update for vm-install
by maintenance＠opensuse.org 19 Oct '17

19 Oct '17

openSUSE Recommended Update: Recommended update for vm-install ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2764-1 Rating: moderate References: #1004324 #1020616 #1020751 #1024437 #1027106 #1033845 #1035779 #1039333 #1056738 #978526 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for vm-install fixes the following issues: - Make it possible to install guests based on pvops kernel. (bsc#1056738) - Add support for openSUSE15, SLES15 and SLED15. (bsc#1056738, bsc#1035779) - Fix a problem that was causing vm-install to interpret disk size incorrectly when used as a command line option. (bsc#1024437) - Fix an invalid syntax error. (bsc#1039333) - Fix parsing the os-release file so that the default OS selection is returned correctly. (bsc#1033845) - Fix a problem that was making ISO based installations of Xen PV guests not automatically find the installation sources. (bsc#1027106) - Fix initializing the host installation source location. - Make it possible to specify the install source on text mode installation. (bsc#978526) - Insert the correct kernel flag for changing the screen resolution of PV guests (the flag changed with the pvops kernel). (bsc#1020616) - Fix an exception thrown without explanation when doing VM upgrade if the 'Configuration File' option is selected but no value given. (bsc#1020751) - Fix a problem when installing SLES12 from SLES11 hypervisor. (bsc#1004324) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1172=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): vm-install-0.8.68-2.3.1 References: https://bugzilla.suse.com/1004324 https://bugzilla.suse.com/1020616 https://bugzilla.suse.com/1020751 https://bugzilla.suse.com/1024437 https://bugzilla.suse.com/1027106 https://bugzilla.suse.com/1033845 https://bugzilla.suse.com/1035779 https://bugzilla.suse.com/1039333 https://bugzilla.suse.com/1056738 https://bugzilla.suse.com/978526

1 0

openSUSE-RU-2017:2763-1: Recommended update for audit
by maintenance＠opensuse.org 19 Oct '17

19 Oct '17

openSUSE Recommended Update: Recommended update for audit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2763-1 Rating: low References: #1042781 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for audit provides the following fix: - Make auditd start by forking the systemd service to fix some initialization failures. (bsc#1042781) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1169=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1169=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): audit-2.3.6-8.1 audit-audispd-plugins-2.3.6-8.1 audit-audispd-plugins-debuginfo-2.3.6-8.1 audit-debuginfo-2.3.6-8.1 audit-debugsource-2.3.6-8.1 audit-devel-2.3.6-8.1 audit-libs-python-2.3.6-8.1 audit-libs-python-debuginfo-2.3.6-8.1 audit-secondary-debugsource-2.3.6-8.1 libaudit1-2.3.6-8.1 libaudit1-debuginfo-2.3.6-8.1 libauparse0-2.3.6-8.1 libauparse0-debuginfo-2.3.6-8.1 - openSUSE Leap 42.3 (x86_64): audit-devel-32bit-2.3.6-8.1 libaudit1-32bit-2.3.6-8.1 libaudit1-debuginfo-32bit-2.3.6-8.1 libauparse0-32bit-2.3.6-8.1 libauparse0-debuginfo-32bit-2.3.6-8.1 - openSUSE Leap 42.2 (i586 x86_64): audit-2.3.6-5.3.1 audit-audispd-plugins-2.3.6-5.3.1 audit-audispd-plugins-debuginfo-2.3.6-5.3.1 audit-debuginfo-2.3.6-5.3.1 audit-debugsource-2.3.6-5.3.1 audit-devel-2.3.6-5.3.1 audit-libs-python-2.3.6-5.3.1 audit-libs-python-debuginfo-2.3.6-5.3.1 audit-secondary-debugsource-2.3.6-5.3.1 libaudit1-2.3.6-5.3.1 libaudit1-debuginfo-2.3.6-5.3.1 libauparse0-2.3.6-5.3.1 libauparse0-debuginfo-2.3.6-5.3.1 - openSUSE Leap 42.2 (x86_64): audit-devel-32bit-2.3.6-5.3.1 libaudit1-32bit-2.3.6-5.3.1 libaudit1-debuginfo-32bit-2.3.6-5.3.1 libauparse0-32bit-2.3.6-5.3.1 libauparse0-debuginfo-32bit-2.3.6-5.3.1 References: https://bugzilla.suse.com/1042781

1 0

openSUSE-RU-2017:2762-1: Recommended update for netcat-openbsd
by maintenance＠opensuse.org 19 Oct '17

19 Oct '17

openSUSE Recommended Update: Recommended update for netcat-openbsd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2762-1 Rating: low References: #1061165 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for netcat-openbsd provides the following fix: - Fix a logic error that would prevent netcat from sending out UDP packets. (bsc#1061165) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1168=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1168=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): netcat-openbsd-1.89-99.1 netcat-openbsd-debuginfo-1.89-99.1 netcat-openbsd-debugsource-1.89-99.1 - openSUSE Leap 42.2 (i586 x86_64): netcat-openbsd-1.89-96.3.1 netcat-openbsd-debuginfo-1.89-96.3.1 netcat-openbsd-debugsource-1.89-96.3.1 References: https://bugzilla.suse.com/1061165

1 0

openSUSE-OU-2017:2761-1: moderate: Optional update to add libtxc_dxtn to the distribution
by maintenance＠opensuse.org 18 Oct '17

18 Oct '17

openSUSE Optional Update: Optional update to add libtxc_dxtn to the distribution ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2761-1 Rating: moderate References: #1063424 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds libtxc_dxtn to the distribution. libtxc_dxtn is an S3TC implementation for mesa with full S3TC compression and decompression support. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1165=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1165=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libtxc_dxtn-1.0.1-3.1 libtxc_dxtn-debuginfo-1.0.1-3.1 libtxc_dxtn-debugsource-1.0.1-3.1 libtxc_dxtn-devel-1.0.1-3.1 - openSUSE Leap 42.3 (x86_64): libtxc_dxtn-32bit-1.0.1-3.1 libtxc_dxtn-debuginfo-32bit-1.0.1-3.1 - openSUSE Leap 42.2 (i586 x86_64): libtxc_dxtn-1.0.1-2.1 libtxc_dxtn-debuginfo-1.0.1-2.1 libtxc_dxtn-debugsource-1.0.1-2.1 libtxc_dxtn-devel-1.0.1-2.1 - openSUSE Leap 42.2 (x86_64): libtxc_dxtn-32bit-1.0.1-2.1 libtxc_dxtn-debuginfo-32bit-1.0.1-2.1 References: https://bugzilla.suse.com/1063424

1 0

openSUSE-RU-2017:2760-1: Recommended update for yast2-packager
by maintenance＠opensuse.org 18 Oct '17

18 Oct '17

openSUSE Recommended Update: Recommended update for yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2760-1 Rating: low References: #1032523 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-packager provides the following fix: - Fix configuring the EULA acceptance in AutoYaST of add-on products present in the media of the base product. (bsc#1032523) This update was imported from the SUSE:SLE-12-SP2:Update and SUSE:SLE-12-SP2:Update update projects. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1166=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1166=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): yast2-packager-3.2.25-3.1 - openSUSE Leap 42.2 (i586 x86_64): yast2-packager-3.1.123-5.6.1 References: https://bugzilla.suse.com/1032523

1 0

openSUSE-RU-2017:2759-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 18 Oct '17

18 Oct '17

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2759-1 Rating: moderate References: #1008844 #1026999 #974513 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for plasma5-workspace fixes the following issues: - provide an option to display application names instead of the generic names in the desktop containment's application launcher mouse action (kde#358423, boo#974513) - fix clicking on systemtray icons of certain applications, mainly GTK3 and Java (boo#1026999) - make logout dialog respect the "Offer shutdown options" setting and hide "Reboot" and "Shutdown" if disabled (boo#1008844) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1164=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): drkonqi5-5.8.6-10.3.1 drkonqi5-debuginfo-5.8.6-10.3.1 plasma5-workspace-5.8.6-10.3.1 plasma5-workspace-debuginfo-5.8.6-10.3.1 plasma5-workspace-debugsource-5.8.6-10.3.1 plasma5-workspace-devel-5.8.6-10.3.1 plasma5-workspace-libs-5.8.6-10.3.1 plasma5-workspace-libs-debuginfo-5.8.6-10.3.1 - openSUSE Leap 42.2 (noarch): plasma5-defaults-openSUSE-42.1.1-14.3.1 plasma5-openSUSE-42.1.1-14.3.1 plasma5-theme-openSUSE-42.1.1-14.3.1 plasma5-workspace-branding-openSUSE-42.1.1-14.3.1 plasma5-workspace-lang-5.8.6-10.3.1 sddm-theme-openSUSE-42.1.1-14.3.1 - openSUSE Leap 42.2 (x86_64): plasma5-workspace-libs-32bit-5.8.6-10.3.1 plasma5-workspace-libs-debuginfo-32bit-5.8.6-10.3.1 References: https://bugzilla.suse.com/1008844 https://bugzilla.suse.com/1026999 https://bugzilla.suse.com/974513

1 0

openSUSE-RU-2017:2758-1: moderate: Recommended update for plasma5-workspace
by maintenance＠opensuse.org 18 Oct '17

18 Oct '17

openSUSE Recommended Update: Recommended update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2758-1 Rating: moderate References: #1008844 #1026999 #974513 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for plasma5-workspace fixes the following issues: - provide an option to display application names instead of the generic names in the desktop containment's application launcher mouse action (kde#358423, boo#974513) - fix clicking on systemtray icons of certain applications, mainly GTK3 and Java (boo#1026999) - make logout dialog respect the "Offer shutdown options" setting and hide "Reboot" and "Shutdown" if disabled (boo#1008844) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1164=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): drkonqi5-5.8.6-8.1 drkonqi5-debuginfo-5.8.6-8.1 plasma5-workspace-5.8.6-8.1 plasma5-workspace-debuginfo-5.8.6-8.1 plasma5-workspace-debugsource-5.8.6-8.1 plasma5-workspace-devel-5.8.6-8.1 plasma5-workspace-libs-5.8.6-8.1 plasma5-workspace-libs-debuginfo-5.8.6-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-SLE-42.1.1-11.1 plasma5-defaults-SLE-42.1.1-11.1 plasma5-theme-SLE-42.1.1-11.1 plasma5-workspace-branding-SLE-42.1.1-11.1 plasma5-workspace-lang-5.8.6-8.1 sddm-theme-SLE-42.1.1-11.1 References: https://bugzilla.suse.com/1008844 https://bugzilla.suse.com/1026999 https://bugzilla.suse.com/974513

1 0

openSUSE-SU-2017:2757-1: important: Security update for git
by opensuse-security＠opensuse.org 18 Oct '17

18 Oct '17

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2757-1 Rating: important References: #1061041 Cross-References: CVE-2017-14867 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issues: This security issue was fixed: - CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name (bsc#1061041). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1167=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): git-doc-2.12.3-5.14.1 - openSUSE Leap 42.2 (x86_64): git-2.12.3-5.14.1 git-arch-2.12.3-5.14.1 git-core-2.12.3-5.14.1 git-core-debuginfo-2.12.3-5.14.1 git-credential-gnome-keyring-2.12.3-5.14.1 git-credential-gnome-keyring-debuginfo-2.12.3-5.14.1 git-cvs-2.12.3-5.14.1 git-daemon-2.12.3-5.14.1 git-daemon-debuginfo-2.12.3-5.14.1 git-debugsource-2.12.3-5.14.1 git-email-2.12.3-5.14.1 git-gui-2.12.3-5.14.1 git-svn-2.12.3-5.14.1 git-svn-debuginfo-2.12.3-5.14.1 git-web-2.12.3-5.14.1 gitk-2.12.3-5.14.1 References: https://www.suse.com/security/cve/CVE-2017-14867.html https://bugzilla.suse.com/1061041

1 0

openSUSE-SU-2017:2755-1: important: Security update for wpa_supplicant
by opensuse-security＠opensuse.org 18 Oct '17

18 Oct '17

openSUSE Security Update: Security update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2755-1 Rating: important References: #1056061 Cross-References: CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13087 CVE-2017-13088 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for wpa_supplicant fixes the security issues: - Several vulnerabilities in standard conforming implementations of the WPA2 protocol have been discovered and published under the code name KRACK. This update remedies those issues in a backwards compatible manner, i.e. the updated wpa_supplicant can interface properly with both vulnerable and patched implementations of WPA2, but an attacker won't be able to exploit the KRACK weaknesses in those connections anymore even if the other party is still vulnerable. [bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1163=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1163=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): wpa_supplicant-2.2-13.1 wpa_supplicant-debuginfo-2.2-13.1 wpa_supplicant-debugsource-2.2-13.1 wpa_supplicant-gui-2.2-13.1 wpa_supplicant-gui-debuginfo-2.2-13.1 - openSUSE Leap 42.2 (i586 x86_64): wpa_supplicant-2.2-9.3.1 wpa_supplicant-debuginfo-2.2-9.3.1 wpa_supplicant-debugsource-2.2-9.3.1 wpa_supplicant-gui-2.2-9.3.1 wpa_supplicant-gui-debuginfo-2.2-9.3.1 References: https://www.suse.com/security/cve/CVE-2017-13078.html https://www.suse.com/security/cve/CVE-2017-13079.html https://www.suse.com/security/cve/CVE-2017-13080.html https://www.suse.com/security/cve/CVE-2017-13081.html https://www.suse.com/security/cve/CVE-2017-13087.html https://www.suse.com/security/cve/CVE-2017-13088.html https://bugzilla.suse.com/1056061

1 0

openSUSE-RU-2017:2754-1: Recommended update for clamav-database
by maintenance＠opensuse.org 17 Oct '17

17 Oct '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2754-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh October 16th 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1161=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201710160008-54.91.1 References:

1 0

openSUSE-RU-2017:2753-1: Recommended update for libqt5-qtwebengine
by maintenance＠opensuse.org 17 Oct '17

17 Oct '17

openSUSE Recommended Update: Recommended update for libqt5-qtwebengine ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2753-1 Rating: low References: #1043338 #1043375 #1061344 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for libqt5-qtwebengine provides the following fixes: - Enable the use of proprietary codecs when configuring webengine so it uses the system ffmpeg binary thus allowing to reproduce html5 videos. (bsc#1043375) - Fix a compatibility issue in font rendering when using newer versions of FreeType. (bsc#1061344) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1162=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libqt5-qtwebengine-5.6.2-6.2 libqt5-qtwebengine-debuginfo-5.6.2-6.2 libqt5-qtwebengine-debugsource-5.6.2-6.2 libqt5-qtwebengine-devel-5.6.2-6.2 libqt5-qtwebengine-examples-5.6.2-6.2 libqt5-qtwebengine-examples-debuginfo-5.6.2-6.2 - openSUSE Leap 42.3 (x86_64): libqt5-qtwebengine-32bit-5.6.2-6.2 libqt5-qtwebengine-debuginfo-32bit-5.6.2-6.2 libqt5-qtwebengine-devel-32bit-5.6.2-6.2 - openSUSE Leap 42.3 (noarch): libqt5-qtwebengine-private-headers-devel-5.6.2-6.2 References: https://bugzilla.suse.com/1043338 https://bugzilla.suse.com/1043375 https://bugzilla.suse.com/1061344

1 0

openSUSE-SU-2017:2741-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 17 Oct '17

17 Oct '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2741-1 Rating: important References: #1005778 #1005780 #1005781 #1012382 #1022967 #1036215 #1036737 #1037579 #1037890 #1043598 #1044503 #1047238 #1051987 #1052593 #1053043 #1055493 #1055755 #1056686 #1057383 #1057498 #1058038 #1058410 #1058507 #1058512 #1058550 #1059051 #1059465 #1059500 #1060197 #1060229 #1061017 #1061046 #1061064 #1061067 #1061172 #1061831 #1061872 Cross-References: CVE-2017-1000252 CVE-2017-12153 CVE-2017-12154 CVE-2017-14489 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has 33 fixes is now available. Description: The openSUSE Leap 42.3 kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c (bnc#1058038). - CVE-2017-14489: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel allowed local users to cause a denial of service (panic) by leveraging incorrect length validation (bnc#1059051). - CVE-2017-12153: A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel This function did not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash (bnc#1058410). - CVE-2017-12154: The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel did not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allowed KVM L2 guest OS users to obtain read and write access to the hardware CR8 register (bnc#1058507). The following non-security bugs were fixed: - arc: Re-enable MMU upon Machine Check exception (bnc#1012382). - arm64: fault: Route pte translation faults via do_translation_fault (bnc#1012382). - arm64: Make sure SPsel is always set (bnc#1012382). - arm: pxa: add the number of DMA requestor lines (bnc#1012382). - arm: pxa: fix the number of DMA requestor lines (bnc#1012382). - bcache: correct cache_dirty_target in __update_writeback_rate() (bnc#1012382). - bcache: Correct return value for sysfs attach errors (bnc#1012382). - bcache: do not subtract sectors_to_gc for bypassed IO (bnc#1012382). - bcache: fix bch_hprint crash and improve output (bnc#1012382). - bcache: fix for gc and write-back race (bnc#1012382). - bcache: Fix leak of bdev reference (bnc#1012382). - bcache: initialize dirty stripes in flash_dev_run() (bnc#1012382). - block: Relax a check in blk_start_queue() (bnc#1012382). - bsg-lib: do not free job in bsg_prepare_job (bnc#1012382). - btrfs: change how we decide to commit transactions during flushing (bsc#1060197). - btrfs: fix NULL pointer dereference from free_reloc_roots() (bnc#1012382). - btrfs: prevent to set invalid default subvolid (bnc#1012382). - btrfs: propagate error to btrfs_cmp_data_prepare caller (bnc#1012382). - btrfs: qgroup: move noisy underflow warning to debugging build (bsc#1055755). - cifs: Fix SMB3.1.1 guest authentication to Samba (bnc#1012382). - cifs: release auth_key.response for reconnect (bnc#1012382). - crypto: AF_ALG - remove SGL terminator indicator when chaining (bnc#1012382). - crypto: talitos - Do not provide setkey for non hmac hashing algs (bnc#1012382). - crypto: talitos - fix sha224 (bnc#1012382). - cxl: Fix driver use count (bnc#1012382). - dmaengine: mmp-pdma: add number of requestors (bnc#1012382). - drivers: net: phy: xgene: Fix mdio write (bsc#1057383). - drm: Add driver-private objects to atomic state (bsc#1055493). - drm/dp: Introduce MST topology state to track available link bandwidth (bsc#1055493). - efi/fb: Avoid reconfiguration of BAR that covers the framebuffer (bsc#1051987). - efi/fb: Correct PCI_STD_RESOURCE_END usage (bsc#1051987). - ext4: fix incorrect quotaoff if the quota feature is enabled (bnc#1012382). - ext4: fix quota inconsistency during orphan cleanup for read-only mounts (bnc#1012382). - f2fs: check hot_data for roll-forward recovery (bnc#1012382). - fix xen_swiotlb_dma_mmap prototype (bnc#1012382). - ftrace: Fix memleak when unregistering dynamic ops when tracing disabled (bnc#1012382). - ftrace: Fix selftest goto location on error (bnc#1012382). - genirq: Fix for_each_action_of_desc() macro (bsc#1061064). - getcwd: Close race with d_move called by lustre (bsc#1052593). - gfs2: Fix debugfs glocks dump (bnc#1012382). - gianfar: Fix Tx flow control deactivation (bnc#1012382). - hid: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch (bnc#1022967). - input: i8042 - add Gigabyte P57 to the keyboard reset table (bnc#1012382). - iommu/vt-d: Avoid calling virt_to_phys() on null pointer (bsc#1061067). - ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (bnc#1012382). - ipv6: add rcu grace period before freeing fib6_node (bnc#1012382). - ipv6: fix memory leak with multiple tables during netns destruction (bnc#1012382). - ipv6: fix sparse warning on rt6i_node (bnc#1012382). - ipv6: fix typo in fib6_net_exit() (bnc#1012382). - iw_cxgb4: put ep reference in pass_accept_req() (fate#321658 bsc#1005778 fate#321660 bsc#1005780 fate#321661 bsc#1005781). - KABI fix drivers/nvme/target/nvmet.h (bsc#1058550). - kabi/severities: ignore nfs_pgio_data_destroy - kABI: Workaround kABI breakage of AMD-AVIC fixes (bsc#1044503). - keys: fix writing past end of user-supplied buffer in keyring_read() (bnc#1012382). - keys: prevent creating a different user's keyrings (bnc#1012382). - keys: prevent KEYCTL_READ on negative key (bnc#1012382). - kvm: Add struct kvm_vcpu pointer parameter to get_enable_apicv() (bsc#1044503). - kvm: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously (bsc#1061017). - kvm: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce() (bnc#1012382). - kvm: SVM: Add a missing 'break' statement (bsc#1061017). - kvm: SVM: Add irqchip_split() checks before enabling AVIC (bsc#1044503). - kvm: SVM: delete avic_vm_id_bitmap (2 megabyte static array) (bsc#1059500). - kvm: SVM: Refactor AVIC vcpu initialization into avic_init_vcpu() (bsc#1044503). - kvm: VMX: do not change SN bit in vmx_update_pi_irte() (bsc#1061017). - kvm: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt (bsc#1061017). - kvm: VMX: use cmpxchg64 (bnc#1012382). - mac80211: flush hw_roc_start work before cancelling the ROC (bnc#1012382). - md/bitmap: disable bitmap_resize for file-backed bitmaps (bsc#1061172). - md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list (bnc#1012382). - md/raid5: release/flush io in raid5_do_work() (bnc#1012382). - media: uvcvideo: Prevent heap overflow when accessing mapped controls (bnc#1012382). - media: v4l2-compat-ioctl32: Fix timespec conversion (bnc#1012382). - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of both infinite inputs (bnc#1012382). - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input values with opposite signs (bnc#1012382). - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix cases of both inputs zero (bnc#1012382). - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix quiet NaN propagation (bnc#1012382). - mips: math-emu: <MAX|MIN>.<D|S>: Fix cases of both inputs negative (bnc#1012382). - mips: math-emu: MINA.<D|S>: Fix some cases of infinity and zero inputs (bnc#1012382). - mm: prevent double decrease of nr_reserved_highatomic (bnc#1012382). - nfsd: Fix general protection fault in release_lock_stateid() (bnc#1012382). - nvme-fabrics: generate spec-compliant UUID NQNs (bsc#1057498). - nvmet: Move serial number from controller to subsystem (bsc#1058550). - nvmet: preserve controller serial number between reboots (bsc#1058550). - pci: Allow PCI express root ports to find themselves (bsc#1061046). - pci: fix oops when try to find Root Port for a PCI device (bsc#1061046). - pci: Fix race condition with driver_override (bnc#1012382). - pci: Mark AMD Stoney GPU ATS as broken (bsc#1061046). - pci: shpchp: Enable bridge bus mastering if MSI is enabled (bnc#1012382). - perf/x86: Fix RDPMC vs. mm_struct tracking (bsc#1061831). - perf/x86: kABI Workaround for 'perf/x86: Fix RDPMC vs. mm_struct tracking' (bsc#1061831). - perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver (bsc#1036737). - perf: xgene: Include module.h (bsc#1036737). - perf: xgene: Move PMU leaf functions into function pointer structure (bsc#1036737). - perf: xgene: Parse PMU subnode from the match table (bsc#1036737). - powerpc: Fix DAR reporting when alignment handler faults (bnc#1012382). - powerpc/perf: Cleanup of PM_BR_CMPL vs. PM_BRU_CMPL in Power9 event list (bsc#1056686, fate#321438, bsc#1047238, git-fixes 34922527a2bc). - powerpc/perf: Factor out PPMU_ONLY_COUNT_RUN check code from power8 (fate#321438, bsc#1053043, git-fixes efe881afdd999). - powerpc/pseries: Fix parent_dn reference leak in add_dt_node() (bnc#1012382). - qlge: avoid memcpy buffer overflow (bnc#1012382). - rdma/bnxt_re: Allocate multiple notification queues (bsc#1037579). - rdma/bnxt_re: Implement the alloc/get_hw_stats callback (bsc#1037579). - Revert "net: fix percpu memory leaks" (bnc#1012382). - Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()" (bnc#1012382). - Revert "net: use lib/percpu_counter API for fragmentation mem accounting" (bnc#1012382). - Revert "Update patches.fixes/xfs-refactor-log-record-unpack-and-data-processing.patch (bsc#1043598, bsc#1036215)." - Revert "xfs: detect and handle invalid iclog size set by mkfs (bsc#1043598)." - Revert "xfs: detect and trim torn writes during log recovery (bsc#1036215)." - Revert "xfs: refactor and open code log record crc check (bsc#1036215)." - Revert "xfs: refactor log record start detection into a new helper (bsc#1036215)." - Revert "xfs: return start block of first bad log record during recovery (bsc#1036215)." - Revert "xfs: support a crc verification only log record pass (bsc#1036215)." - scsi: ILLEGAL REQUEST + ASC==27 => target failure (bsc#1059465). - scsi: megaraid_sas: Check valid aen class range to avoid kernel panic (bnc#1012382). - scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead (bnc#1012382). - scsi: sg: factor out sg_fill_request_table() (bnc#1012382). - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (bnc#1012382). - scsi: sg: off by one in sg_ioctl() (bnc#1012382). - scsi: sg: remove 'save_scat_len' (bnc#1012382). - scsi: sg: use standard lists for sg_requests (bnc#1012382). - scsi: storvsc: fix memory leak on ring buffer busy (bnc#1012382). - scsi_transport_fc: Also check for NOTPRESENT in fc_remote_port_add() (bsc#1037890). - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path (bnc#1012382). - scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records (bnc#1012382). - scsi: zfcp: fix missing trace records for early returns in TMF eh handlers (bnc#1012382). - scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA (bnc#1012382). - scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records (bnc#1012382). - scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled (bnc#1012382). - scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response (bnc#1012382). - scsi: zfcp: trace high part of "new" 64 bit SCSI LUN (bnc#1012382). - seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() (bnc#1012382). - skd: Avoid that module unloading triggers a use-after-free (bnc#1012382). - skd: Submit requests to firmware before triggering the doorbell (bnc#1012382). - smb3: Do not ignore O_SYNC/O_DSYNC and O_DIRECT flags (bnc#1012382). - smb: Validate negotiate (to protect against downgrade) even if signing off (bnc#1012382). - swiotlb-xen: implement xen_swiotlb_dma_mmap callback (bnc#1012382). - timer/sysclt: Restrict timer migration sysctl values to 0 and 1 (bnc#1012382). - tracing: Apply trace_clock changes to instance max buffer (bnc#1012382). - tracing: Erase irqsoff trace with empty write (bnc#1012382). - tracing: Fix trace_pipe behavior for instance traces (bnc#1012382). - tty: fix __tty_insert_flip_char regression (bnc#1012382). - tty: improve tty_insert_flip_char() fast path (bnc#1012382). - tty: improve tty_insert_flip_char() slow path (bnc#1012382). - Update patches.drivers/0029-perf-xgene-Remove-bogus-IS_ERR-check.patch (bsc#1036737). - vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets (bnc#1012382). - video: fbdev: aty: do not leak uninitialized padding in clk to userspace (bnc#1012382). - Workaround for kABI compatibility with DP-MST patches (bsc#1055493). - x86/cpu/amd: Hide unused legacy_fixup_core_id() function (bsc#1060229). - x86/cpu/amd: Limit cpu_core_id fixup to families older than F17h (bsc#1060229). - x86/fpu: Do not let userspace set bogus xcomp_bv (bnc#1012382). - x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps (bnc#1012382). - x86/ldt: Fix off by one in get_segment_base() (bsc#1061872). - x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() (bsc#1058512). - x86/mm: Fix fault error path using unsafe vma pointer (fate#321300). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1160=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): kernel-devel-4.4.90-28.1 kernel-docs-4.4.90-28.2 kernel-docs-html-4.4.90-28.2 kernel-docs-pdf-4.4.90-28.2 kernel-macros-4.4.90-28.1 kernel-source-4.4.90-28.1 kernel-source-vanilla-4.4.90-28.1 - openSUSE Leap 42.3 (x86_64): kernel-debug-4.4.90-28.1 kernel-debug-base-4.4.90-28.1 kernel-debug-base-debuginfo-4.4.90-28.1 kernel-debug-debuginfo-4.4.90-28.1 kernel-debug-debugsource-4.4.90-28.1 kernel-debug-devel-4.4.90-28.1 kernel-debug-devel-debuginfo-4.4.90-28.1 kernel-default-4.4.90-28.1 kernel-default-base-4.4.90-28.1 kernel-default-base-debuginfo-4.4.90-28.1 kernel-default-debuginfo-4.4.90-28.1 kernel-default-debugsource-4.4.90-28.1 kernel-default-devel-4.4.90-28.1 kernel-obs-build-4.4.90-28.1 kernel-obs-build-debugsource-4.4.90-28.1 kernel-obs-qa-4.4.90-28.1 kernel-syms-4.4.90-28.1 kernel-vanilla-4.4.90-28.1 kernel-vanilla-base-4.4.90-28.1 kernel-vanilla-base-debuginfo-4.4.90-28.1 kernel-vanilla-debuginfo-4.4.90-28.1 kernel-vanilla-debugsource-4.4.90-28.1 kernel-vanilla-devel-4.4.90-28.1 References: https://www.suse.com/security/cve/CVE-2017-1000252.html https://www.suse.com/security/cve/CVE-2017-12153.html https://www.suse.com/security/cve/CVE-2017-12154.html https://www.suse.com/security/cve/CVE-2017-14489.html https://bugzilla.suse.com/1005778 https://bugzilla.suse.com/1005780 https://bugzilla.suse.com/1005781 https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1022967 https://bugzilla.suse.com/1036215 https://bugzilla.suse.com/1036737 https://bugzilla.suse.com/1037579 https://bugzilla.suse.com/1037890 https://bugzilla.suse.com/1043598 https://bugzilla.suse.com/1044503 https://bugzilla.suse.com/1047238 https://bugzilla.suse.com/1051987 https://bugzilla.suse.com/1052593 https://bugzilla.suse.com/1053043 https://bugzilla.suse.com/1055493 https://bugzilla.suse.com/1055755 https://bugzilla.suse.com/1056686 https://bugzilla.suse.com/1057383 https://bugzilla.suse.com/1057498 https://bugzilla.suse.com/1058038 https://bugzilla.suse.com/1058410 https://bugzilla.suse.com/1058507 https://bugzilla.suse.com/1058512 https://bugzilla.suse.com/1058550 https://bugzilla.suse.com/1059051 https://bugzilla.suse.com/1059465 https://bugzilla.suse.com/1059500 https://bugzilla.suse.com/1060197 https://bugzilla.suse.com/1060229 https://bugzilla.suse.com/1061017 https://bugzilla.suse.com/1061046 https://bugzilla.suse.com/1061064 https://bugzilla.suse.com/1061067 https://bugzilla.suse.com/1061172 https://bugzilla.suse.com/1061831 https://bugzilla.suse.com/1061872

1 0

openSUSE-SU-2017:2739-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 17 Oct '17

17 Oct '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2739-1 Rating: important References: #1012382 #1022967 #1052593 #1055493 #1055755 #1055896 #1058038 #1058410 #1058507 #1059051 #1059465 #1060197 #1061017 #1061046 #1061064 #1061067 #1061172 #1061831 #1061872 Cross-References: CVE-2017-1000252 CVE-2017-12153 CVE-2017-12154 CVE-2017-14489 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 15 fixes is now available. Description: The openSUSE Leap 42.2 Kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c (bnc#1058038). - CVE-2017-14489: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel allowed local users to cause a denial of service (panic) by leveraging incorrect length validation (bnc#1059051). - CVE-2017-12153: A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel This function did not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash (bnc#1058410). - CVE-2017-12154: The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel did not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allowed KVM L2 guest OS users to obtain read and write access to the hardware CR8 register (bnc#1058507). The following non-security bugs were fixed: - arc: Re-enable MMU upon Machine Check exception (bnc#1012382). - arm64: fault: Route pte translation faults via do_translation_fault (bnc#1012382). - arm64: Make sure SPsel is always set (bnc#1012382). - arm: pxa: add the number of DMA requestor lines (bnc#1012382). - arm: pxa: fix the number of DMA requestor lines (bnc#1012382). - bcache: correct cache_dirty_target in __update_writeback_rate() (bnc#1012382). - bcache: Correct return value for sysfs attach errors (bnc#1012382). - bcache: do not subtract sectors_to_gc for bypassed IO (bnc#1012382). - bcache: fix bch_hprint crash and improve output (bnc#1012382). - bcache: fix for gc and write-back race (bnc#1012382). - bcache: Fix leak of bdev reference (bnc#1012382). - bcache: initialize dirty stripes in flash_dev_run() (bnc#1012382). - blacklist.conf: Add commit b5accbb0dfae - blacklist.conf: add one more - block: Relax a check in blk_start_queue() (bnc#1012382). - bsg-lib: do not free job in bsg_prepare_job (bnc#1012382). - btrfs: change how we decide to commit transactions during flushing (bsc#1060197). - btrfs: fix NULL pointer dereference from free_reloc_roots() (bnc#1012382). - btrfs: prevent to set invalid default subvolid (bnc#1012382). - btrfs: propagate error to btrfs_cmp_data_prepare caller (bnc#1012382). - btrfs: qgroup: move noisy underflow warning to debugging build (bsc#1055755). - cifs: Fix SMB3.1.1 guest authentication to Samba (bnc#1012382). - cifs: release auth_key.response for reconnect (bnc#1012382). - crypto: AF_ALG - remove SGL terminator indicator when chaining (bnc#1012382). - crypto: talitos - Do not provide setkey for non hmac hashing algs (bnc#1012382). - crypto: talitos - fix sha224 (bnc#1012382). - cxl: Fix driver use count (bnc#1012382). - dmaengine: mmp-pdma: add number of requestors (bnc#1012382). - drm: Add driver-private objects to atomic state (bsc#1055493). - drm/dp: Introduce MST topology state to track available link bandwidth (bsc#1055493). - ext4: fix incorrect quotaoff if the quota feature is enabled (bnc#1012382). - ext4: fix quota inconsistency during orphan cleanup for read-only mounts (bnc#1012382). - f2fs: check hot_data for roll-forward recovery (bnc#1012382). - fix xen_swiotlb_dma_mmap prototype (bnc#1012382). - ftrace: Fix memleak when unregistering dynamic ops when tracing disabled (bnc#1012382). - ftrace: Fix selftest goto location on error (bnc#1012382). - genirq: Fix for_each_action_of_desc() macro (bsc#1061064). - getcwd: Close race with d_move called by lustre (bsc#1052593). - gfs2: Fix debugfs glocks dump (bnc#1012382). - gianfar: Fix Tx flow control deactivation (bnc#1012382). - hid: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch (bnc#1022967). - input: i8042 - add Gigabyte P57 to the keyboard reset table (bnc#1012382). - iommu/vt-d: Avoid calling virt_to_phys() on null pointer (bsc#1061067). - ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (bnc#1012382). - ipv6: add rcu grace period before freeing fib6_node (bnc#1012382). - ipv6: fix memory leak with multiple tables during netns destruction (bnc#1012382). - ipv6: fix sparse warning on rt6i_node (bnc#1012382). - ipv6: fix typo in fib6_net_exit() (bnc#1012382). - kabi/severities: ignore nfs_pgio_data_destroy - keys: fix writing past end of user-supplied buffer in keyring_read() (bnc#1012382). - keys: prevent creating a different user's keyrings (bnc#1012382). - keys: prevent KEYCTL_READ on negative key (bnc#1012382). - kvm: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously (bsc#1061017). - kvm: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce() (bnc#1012382). - kvm: SVM: Add a missing 'break' statement (bsc#1061017). - kvm: VMX: do not change SN bit in vmx_update_pi_irte() (bsc#1061017). - kvm: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt (bsc#1061017). - kvm: VMX: use cmpxchg64 (bnc#1012382). - mac80211: flush hw_roc_start work before cancelling the ROC (bnc#1012382). - md/bitmap: disable bitmap_resize for file-backed bitmaps (bsc#1061172). - md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list (bnc#1012382). - md/raid5: release/flush io in raid5_do_work() (bnc#1012382). - media: uvcvideo: Prevent heap overflow when accessing mapped controls (bnc#1012382). - media: v4l2-compat-ioctl32: Fix timespec conversion (bnc#1012382). - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of both infinite inputs (bnc#1012382). - mips: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input values with opposite signs (bnc#1012382). - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix cases of both inputs zero (bnc#1012382). - mips: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix quiet NaN propagation (bnc#1012382). - mips: math-emu: <MAX|MIN>.<D|S>: Fix cases of both inputs negative (bnc#1012382). - mips: math-emu: MINA.<D|S>: Fix some cases of infinity and zero inputs (bnc#1012382). - mm: prevent double decrease of nr_reserved_highatomic (bnc#1012382). - nfsd: Fix general protection fault in release_lock_stateid() (bnc#1012382). - pci: Allow PCI express root ports to find themselves (bsc#1061046). - pci: fix oops when try to find Root Port for a PCI device (bsc#1061046). - pci: Fix race condition with driver_override (bnc#1012382). - pci: shpchp: Enable bridge bus mastering if MSI is enabled (bnc#1012382). - perf/x86: Fix RDPMC vs. mm_struct tracking (bsc#1061831). - perf/x86: kABI Workaround for 'perf/x86: Fix RDPMC vs. mm_struct tracking' (bsc#1061831). - powerpc: Fix DAR reporting when alignment handler faults (bnc#1012382). - powerpc/pseries: Fix parent_dn reference leak in add_dt_node() (bnc#1012382). - qlge: avoid memcpy buffer overflow (bnc#1012382). - Revert "net: fix percpu memory leaks" (bnc#1012382). - Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()" (bnc#1012382). - Revert "net: use lib/percpu_counter API for fragmentation mem accounting" (bnc#1012382). - scsi: ILLEGAL REQUEST + ASC==27 => target failure (bsc#1059465). - scsi: megaraid_sas: Check valid aen class range to avoid kernel panic (bnc#1012382). - scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead (bnc#1012382). - scsi: sg: factor out sg_fill_request_table() (bnc#1012382). - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (bnc#1012382). - scsi: sg: off by one in sg_ioctl() (bnc#1012382). - scsi: sg: remove 'save_scat_len' (bnc#1012382). - scsi: sg: use standard lists for sg_requests (bnc#1012382). - scsi: storvsc: fix memory leak on ring buffer busy (bnc#1012382). - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path (bnc#1012382). - scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records (bnc#1012382). - scsi: zfcp: fix missing trace records for early returns in TMF eh handlers (bnc#1012382). - scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA (bnc#1012382). - scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records (bnc#1012382). - scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled (bnc#1012382). - scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response (bnc#1012382). - scsi: zfcp: trace high part of "new" 64 bit SCSI LUN (bnc#1012382). - seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() (bnc#1012382). - skd: Avoid that module unloading triggers a use-after-free (bnc#1012382). - skd: Submit requests to firmware before triggering the doorbell (bnc#1012382). - smb3: Do not ignore O_SYNC/O_DSYNC and O_DIRECT flags (bnc#1012382). - smb: Validate negotiate (to protect against downgrade) even if signing off (bnc#1012382). - swiotlb-xen: implement xen_swiotlb_dma_mmap callback (bnc#1012382). - timer/sysclt: Restrict timer migration sysctl values to 0 and 1 (bnc#1012382). - tracing: Apply trace_clock changes to instance max buffer (bnc#1012382). - tracing: Erase irqsoff trace with empty write (bnc#1012382). - tracing: Fix trace_pipe behavior for instance traces (bnc#1012382). - tty: fix __tty_insert_flip_char regression (bnc#1012382). - tty: improve tty_insert_flip_char() fast path (bnc#1012382). - tty: improve tty_insert_flip_char() slow path (bnc#1012382). - vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets (bnc#1012382). - video: fbdev: aty: do not leak uninitialized padding in clk to userspace (bnc#1012382). - Workaround for kABI compatibility with DP-MST patches (bsc#1055493). - x86/fpu: Do not let userspace set bogus xcomp_bv (bnc#1012382). - x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps (bnc#1012382). - x86/ldt: Fix off by one in get_segment_base() (bsc#1061872). - xfs/dmapi: fix incorrect file->f_path.dentry->d_inode usage (bsc#1055896). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1159=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): kernel-debug-4.4.90-18.32.1 kernel-debug-base-4.4.90-18.32.1 kernel-debug-base-debuginfo-4.4.90-18.32.1 kernel-debug-debuginfo-4.4.90-18.32.1 kernel-debug-debugsource-4.4.90-18.32.1 kernel-debug-devel-4.4.90-18.32.1 kernel-debug-devel-debuginfo-4.4.90-18.32.1 kernel-default-4.4.90-18.32.1 kernel-default-base-4.4.90-18.32.1 kernel-default-base-debuginfo-4.4.90-18.32.1 kernel-default-debuginfo-4.4.90-18.32.1 kernel-default-debugsource-4.4.90-18.32.1 kernel-default-devel-4.4.90-18.32.1 kernel-obs-build-4.4.90-18.32.1 kernel-obs-build-debugsource-4.4.90-18.32.1 kernel-obs-qa-4.4.90-18.32.1 kernel-syms-4.4.90-18.32.1 kernel-vanilla-4.4.90-18.32.1 kernel-vanilla-base-4.4.90-18.32.1 kernel-vanilla-base-debuginfo-4.4.90-18.32.1 kernel-vanilla-debuginfo-4.4.90-18.32.1 kernel-vanilla-debugsource-4.4.90-18.32.1 kernel-vanilla-devel-4.4.90-18.32.1 - openSUSE Leap 42.2 (noarch): kernel-devel-4.4.90-18.32.1 kernel-docs-4.4.90-18.32.2 kernel-docs-html-4.4.90-18.32.2 kernel-docs-pdf-4.4.90-18.32.2 kernel-macros-4.4.90-18.32.1 kernel-source-4.4.90-18.32.1 kernel-source-vanilla-4.4.90-18.32.1 References: https://www.suse.com/security/cve/CVE-2017-1000252.html https://www.suse.com/security/cve/CVE-2017-12153.html https://www.suse.com/security/cve/CVE-2017-12154.html https://www.suse.com/security/cve/CVE-2017-14489.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1022967 https://bugzilla.suse.com/1052593 https://bugzilla.suse.com/1055493 https://bugzilla.suse.com/1055755 https://bugzilla.suse.com/1055896 https://bugzilla.suse.com/1058038 https://bugzilla.suse.com/1058410 https://bugzilla.suse.com/1058507 https://bugzilla.suse.com/1059051 https://bugzilla.suse.com/1059465 https://bugzilla.suse.com/1060197 https://bugzilla.suse.com/1061017 https://bugzilla.suse.com/1061046 https://bugzilla.suse.com/1061064 https://bugzilla.suse.com/1061067 https://bugzilla.suse.com/1061172 https://bugzilla.suse.com/1061831 https://bugzilla.suse.com/1061872

1 0

openSUSE-SU-2017:2736-1: moderate: Security update for mbedtls
by opensuse-security＠opensuse.org 16 Oct '17

16 Oct '17

openSUSE Security Update: Security update for mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2736-1 Rating: moderate References: #1056544 Cross-References: CVE-2017-14032 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mbedtls fixes the following issues: - CVE-2017-14032: Possible authentication bypass of peer based authentication when auth mode is configured as 'optional' (boo#1056544). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1156=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1156=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmbedtls9-1.3.19-18.1 libmbedtls9-debuginfo-1.3.19-18.1 mbedtls-debugsource-1.3.19-18.1 mbedtls-devel-1.3.19-18.1 - openSUSE Leap 42.3 (x86_64): libmbedtls9-32bit-1.3.19-18.1 libmbedtls9-debuginfo-32bit-1.3.19-18.1 - openSUSE Leap 42.2 (i586 x86_64): libmbedtls9-1.3.19-16.1 libmbedtls9-debuginfo-1.3.19-16.1 mbedtls-debugsource-1.3.19-16.1 mbedtls-devel-1.3.19-16.1 - openSUSE Leap 42.2 (x86_64): libmbedtls9-32bit-1.3.19-16.1 libmbedtls9-debuginfo-32bit-1.3.19-16.1 References: https://www.suse.com/security/cve/CVE-2017-14032.html https://bugzilla.suse.com/1056544

1 0

openSUSE-SU-2017:2735-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 16 Oct '17

16 Oct '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2735-1 Rating: moderate References: #1059663 #1061873 Cross-References: CVE-2017-14532 CVE-2017-15033 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following security issues: - CVE-2017-14532: NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c allowing for DoS (bsc#1059663) - CVE-2017-15033: Memory leak in ReadYUVImage could have allowed DoS (boo#1061873) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1155=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1155=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-27.1 GraphicsMagick-debuginfo-1.3.25-27.1 GraphicsMagick-debugsource-1.3.25-27.1 GraphicsMagick-devel-1.3.25-27.1 libGraphicsMagick++-Q16-12-1.3.25-27.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-27.1 libGraphicsMagick++-devel-1.3.25-27.1 libGraphicsMagick-Q16-3-1.3.25-27.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-27.1 libGraphicsMagick3-config-1.3.25-27.1 libGraphicsMagickWand-Q16-2-1.3.25-27.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-27.1 perl-GraphicsMagick-1.3.25-27.1 perl-GraphicsMagick-debuginfo-1.3.25-27.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.27.1 GraphicsMagick-debuginfo-1.3.25-11.27.1 GraphicsMagick-debugsource-1.3.25-11.27.1 GraphicsMagick-devel-1.3.25-11.27.1 libGraphicsMagick++-Q16-12-1.3.25-11.27.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.27.1 libGraphicsMagick++-devel-1.3.25-11.27.1 libGraphicsMagick-Q16-3-1.3.25-11.27.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.27.1 libGraphicsMagick3-config-1.3.25-11.27.1 libGraphicsMagickWand-Q16-2-1.3.25-11.27.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.27.1 perl-GraphicsMagick-1.3.25-11.27.1 perl-GraphicsMagick-debuginfo-1.3.25-11.27.1 References: https://www.suse.com/security/cve/CVE-2017-14532.html https://www.suse.com/security/cve/CVE-2017-15033.html https://bugzilla.suse.com/1059663 https://bugzilla.suse.com/1061873

1 0

openSUSE-RU-2017:2734-1: Recommended update for gnome-documents
by maintenance＠opensuse.org 16 Oct '17

16 Oct '17

openSUSE Recommended Update: Recommended update for gnome-documents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2734-1 Rating: low References: #1028817 #1047718 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gnome-documents provides the following fixes: - Use libreoffice rather than unoconv to convert pre-OpenXML MS Office files. (bsc#1047718) - Fix some DBus related problems when registering and unregistering instances. (bsc#1028817) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1157=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1157=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): gnome-documents-lang-3.20.1-5.1 - openSUSE Leap 42.3 (x86_64): gnome-books-3.20.1-5.1 gnome-documents-3.20.1-5.1 gnome-documents-debugsource-3.20.1-5.1 gnome-documents_books-common-3.20.1-5.1 gnome-documents_books-common-debuginfo-3.20.1-5.1 gnome-shell-search-provider-documents-3.20.1-5.1 - openSUSE Leap 42.2 (noarch): gnome-documents-lang-3.20.1-2.3.1 - openSUSE Leap 42.2 (x86_64): gnome-books-3.20.1-2.3.1 gnome-documents-3.20.1-2.3.1 gnome-documents-debugsource-3.20.1-2.3.1 gnome-documents_books-common-3.20.1-2.3.1 gnome-documents_books-common-debuginfo-3.20.1-2.3.1 gnome-shell-search-provider-documents-3.20.1-2.3.1 References: https://bugzilla.suse.com/1028817 https://bugzilla.suse.com/1047718

1 0