October 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:2894-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2894-1 Rating: moderate References: #1054596 #1054598 #1055042 #1055050 #1055430 #1056431 Cross-References: CVE-2017-12936 CVE-2017-12937 CVE-2017-13063 CVE-2017-13064 CVE-2017-13139 CVE-2017-13775 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: * CVE-2017-13775: Fixed a denial of service issue in ReadJNXImage() in coders/jnx.c (boo#1056431) * CVE-2017-13063: Fixed a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c (bsc#1055050) * CVE-2017-13064: Fixed a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c (bsc#1055042) * CVE-2017-12936: The ReadWMFImage function in coders/wmf.c in GraphicsMagick had a use-after-free issue for data associated with exception reporting. (bsc#1054598) * CVE-2017-13139: The ReadOneMNGImage function in coders/png.c had an out-of-bounds read with the MNG CLIP chunk. (bsc#1055430) * CVE-2017-12937: The ReadSUNImage function in coders/sun.c in GraphicsMagick had a colormap heap-based buffer over-read. (bsc#1054596) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1199=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1199=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-34.1 GraphicsMagick-debuginfo-1.3.25-34.1 GraphicsMagick-debugsource-1.3.25-34.1 GraphicsMagick-devel-1.3.25-34.1 libGraphicsMagick++-Q16-12-1.3.25-34.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-34.1 libGraphicsMagick++-devel-1.3.25-34.1 libGraphicsMagick-Q16-3-1.3.25-34.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-34.1 libGraphicsMagick3-config-1.3.25-34.1 libGraphicsMagickWand-Q16-2-1.3.25-34.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-34.1 perl-GraphicsMagick-1.3.25-34.1 perl-GraphicsMagick-debuginfo-1.3.25-34.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.34.1 GraphicsMagick-debuginfo-1.3.25-11.34.1 GraphicsMagick-debugsource-1.3.25-11.34.1 GraphicsMagick-devel-1.3.25-11.34.1 libGraphicsMagick++-Q16-12-1.3.25-11.34.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.34.1 libGraphicsMagick++-devel-1.3.25-11.34.1 libGraphicsMagick-Q16-3-1.3.25-11.34.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.34.1 libGraphicsMagick3-config-1.3.25-11.34.1 libGraphicsMagickWand-Q16-2-1.3.25-11.34.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.34.1 perl-GraphicsMagick-1.3.25-11.34.1 perl-GraphicsMagick-debuginfo-1.3.25-11.34.1 References: https://www.suse.com/security/cve/CVE-2017-12936.html https://www.suse.com/security/cve/CVE-2017-12937.html https://www.suse.com/security/cve/CVE-2017-13063.html https://www.suse.com/security/cve/CVE-2017-13064.html https://www.suse.com/security/cve/CVE-2017-13139.html https://www.suse.com/security/cve/CVE-2017-13775.html https://bugzilla.suse.com/1054596 https://bugzilla.suse.com/1054598 https://bugzilla.suse.com/1055042 https://bugzilla.suse.com/1055050 https://bugzilla.suse.com/1055430 https://bugzilla.suse.com/1056431

1 0

openSUSE-SU-2017:2893-1: moderate: Security update for SDL2
by opensuse-security＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2893-1 Rating: moderate References: #1062784 Cross-References: CVE-2017-2888 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for SDL2 fixes the following issues: - CVE-2017-2888: An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability. (bsc#1062784) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1217=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): SDL2-debugsource-2.0.5-7.1 libSDL2-2_0-0-2.0.5-7.1 libSDL2-2_0-0-debuginfo-2.0.5-7.1 libSDL2-devel-2.0.5-7.1 References: https://www.suse.com/security/cve/CVE-2017-2888.html https://bugzilla.suse.com/1062784

1 0

openSUSE-SU-2017:2892-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2892-1 Rating: important References: #1060877 Cross-References: CVE-2017-12166 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvpn fixes the following issues: - CVE-2017-12166: Lack of bound check in read_key in old legacy key handling before using values could be used for a remote buffer overflow (bsc#1060877). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1202=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1202=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): openvpn-2.3.8-14.1 openvpn-auth-pam-plugin-2.3.8-14.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-14.1 openvpn-debuginfo-2.3.8-14.1 openvpn-debugsource-2.3.8-14.1 openvpn-devel-2.3.8-14.1 openvpn-down-root-plugin-2.3.8-14.1 openvpn-down-root-plugin-debuginfo-2.3.8-14.1 - openSUSE Leap 42.2 (i586 x86_64): openvpn-2.3.8-8.13.1 openvpn-auth-pam-plugin-2.3.8-8.13.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-8.13.1 openvpn-debuginfo-2.3.8-8.13.1 openvpn-debugsource-2.3.8-8.13.1 openvpn-devel-2.3.8-8.13.1 openvpn-down-root-plugin-2.3.8-8.13.1 openvpn-down-root-plugin-debuginfo-2.3.8-8.13.1 References: https://www.suse.com/security/cve/CVE-2017-12166.html https://bugzilla.suse.com/1060877

1 0

openSUSE-RU-2017:2891-1: Recommended update for timezone
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2891-1 Rating: low References: #1064571 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2017c) for your system, including following changes: - Northern Cyprus switches from +03 to +02/+03 on 2017-10-29 - Fiji ends DST 2018-01-14, not 2018-01-21 - Namibia switches from +01/+02 to +02 on 2018-04-01 - Sudan switches from +03 to +02 on 2017-11-01 - Tonga likely switches from +13/+14 to +13 on 2017-11-05 - Turks and Caicos switches from -04 to -05/-04 on 2018-11-04 - Corrections to past DST transitions - Move oversized Canada/East-Saskatchewan to 'backward' file - zic(8) and the reference runtime now reject multiple leap seconds within 28 days of each other, or leap seconds before the Epoch. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1214=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): timezone-2017c-42.1 timezone-debuginfo-2017c-42.1 timezone-debugsource-2017c-42.1 - openSUSE Leap 42.3 (noarch): timezone-java-2017c-0.42.1 References: https://bugzilla.suse.com/1064571

1 0

openSUSE-RU-2017:2890-1: moderate: Recommended update for ktexteditor
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for ktexteditor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2890-1 Rating: moderate References: #992035 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ktexteditor fixes the following issues: - in kwrite, the misspelled word panel would not appear correctly (boo#992035) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1216=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ktexteditor-5.26.0-3.3.1 ktexteditor-debuginfo-5.26.0-3.3.1 ktexteditor-debugsource-5.26.0-3.3.1 ktexteditor-devel-5.26.0-3.3.1 - openSUSE Leap 42.2 (x86_64): ktexteditor-32bit-5.26.0-3.3.1 ktexteditor-debuginfo-32bit-5.26.0-3.3.1 ktexteditor-devel-32bit-5.26.0-3.3.1 - openSUSE Leap 42.2 (noarch): ktexteditor-lang-5.26.0-3.3.1 References: https://bugzilla.suse.com/992035

1 0

openSUSE-RU-2017:2889-1: moderate: Recommended update for ktexteditor
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for ktexteditor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2889-1 Rating: moderate References: #992035 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ktexteditor fixes the following issues: - in kwrite, the misspelled word panel would not appear correctly (boo#992035) - editorconfig-core-c now provides libeditorconfig0-32bit Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1215=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): editorconfig-0.12.1-5.1 editorconfig-core-c-debugsource-0.12.1-5.1 editorconfig-debuginfo-0.12.1-5.1 ktexteditor-5.32.0-3.2 ktexteditor-debuginfo-5.32.0-3.2 ktexteditor-debugsource-5.32.0-3.2 ktexteditor-devel-5.32.0-3.2 libeditorconfig-devel-0.12.1-5.1 libeditorconfig0-0.12.1-5.1 libeditorconfig0-debuginfo-0.12.1-5.1 - openSUSE Leap 42.3 (x86_64): ktexteditor-32bit-5.32.0-3.2 ktexteditor-debuginfo-32bit-5.32.0-3.2 ktexteditor-devel-32bit-5.32.0-3.2 libeditorconfig-devel-32bit-0.12.1-5.1 libeditorconfig0-32bit-0.12.1-5.1 libeditorconfig0-debuginfo-32bit-0.12.1-5.1 - openSUSE Leap 42.3 (noarch): ktexteditor-lang-5.32.0-3.2 References: https://bugzilla.suse.com/992035

1 0

openSUSE-RU-2017:2888-1: moderate: Recommended update for ktexteditor
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for ktexteditor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2888-1 Rating: moderate References: #992035 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ktexteditor fixes the following issues: - in kwrite, the misspelled word panel would not appear correctly (boo#992035) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1216=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): ktexteditor-5.20.0-6.1 ktexteditor-5.26.0-5.1 ktexteditor-5.32.0-5.1 ktexteditor-debuginfo-5.26.0-5.1 ktexteditor-debuginfo-5.32.0-5.1 ktexteditor-debugsource-5.26.0-5.1 ktexteditor-debugsource-5.32.0-5.1 ktexteditor-devel-5.20.0-6.1 ktexteditor-devel-5.26.0-5.1 ktexteditor-devel-5.32.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): ktexteditor-lang-5.20.0-6.1 ktexteditor-lang-5.26.0-5.1 ktexteditor-lang-5.32.0-5.1 References: https://bugzilla.suse.com/992035

1 0

openSUSE-RU-2017:2887-1: Recommended update for logrotate
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for logrotate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2887-1 Rating: low References: #1057801 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for logrotate provides the following fix: - Make sure log files continue to rotate properly when a stale status file is found. (bsc#1057801) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1207=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): logrotate-3.11.0-12.1 logrotate-debuginfo-3.11.0-12.1 logrotate-debugsource-3.11.0-12.1 References: https://bugzilla.suse.com/1057801

1 0

openSUSE-RU-2017:2886-1: Recommended update for yast2-kdump
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for yast2-kdump ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2886-1 Rating: low References: #1047809 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-kdump provides the following fix: - Change the X-SuSE-YaST-AutoInst flag to "all" so that yast2-kdump options are saved to the system when calling AutoYast "Apply profile to this System". (bsc#1047809) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1209=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-kdump-3.1.44-2.6.1 References: https://bugzilla.suse.com/1047809

1 0

openSUSE-RU-2017:2885-1: moderate: Recommended update for gdb
by maintenance＠opensuse.org 27 Oct '17

27 Oct '17

openSUSE Recommended Update: Recommended update for gdb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2885-1 Rating: moderate References: #1062315 #1062318 #985550 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: The GNU Debugger GDB was updated to the 8.0.1 release, bringing the following improvements and bug fixes: - Link gdb against a bundled libipt (processor trace library) on x86_64 and i686 for improved tracing support on Intel CPUs. [bsc#985550] - Rebase to 8.0.1 release (fixing PR21886, PR22046) - Updated libstdc++ pretty printers to gdb-libstdc++-v3-python-7.1.1-20170526.tar.bz2 . - Add support for zSeries z14 specific features [fate#321514, bsc#1062315, fate#322272, bsc#1062318] - Disable guile extensions for new distros, the gdb support is incompatible with guile 2.2. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1211=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gdb-8.0.1-3.1 gdb-debuginfo-8.0.1-3.1 gdb-debugsource-8.0.1-3.1 gdb-testresults-8.0.1-3.1 gdbserver-8.0.1-3.1 gdbserver-debuginfo-8.0.1-3.1 References: https://bugzilla.suse.com/1062315 https://bugzilla.suse.com/1062318 https://bugzilla.suse.com/985550

1 0