November 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:3019-1: moderate: Recommended update for apparmor
by maintenance＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Recommended Update: Recommended update for apparmor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3019-1 Rating: moderate References: #1057900 #1061195 #1062244 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for apparmor to version 2.10.3 fixes the following issues: - issues with NIS/YP logins (boo#1062244) - downgrading/converting of 'unix' rules to 'network unix' rules was broken in apparmor_parser (boo#1061195) The following profiles were updated: - dovecot - traceroute (boo#1057900) - samba - postfix - several abstractions Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1273=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1273=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_apparmor-2.10.3-16.1 apache2-mod_apparmor-debuginfo-2.10.3-16.1 apparmor-debugsource-2.10.3-16.1 apparmor-parser-2.10.3-16.1 apparmor-parser-debuginfo-2.10.3-16.1 libapparmor-devel-2.10.3-16.1 libapparmor1-2.10.3-16.1 libapparmor1-debuginfo-2.10.3-16.1 pam_apparmor-2.10.3-16.1 pam_apparmor-debuginfo-2.10.3-16.1 perl-apparmor-2.10.3-16.1 perl-apparmor-debuginfo-2.10.3-16.1 python3-apparmor-2.10.3-16.1 python3-apparmor-debuginfo-2.10.3-16.1 ruby-apparmor-2.10.3-16.1 ruby-apparmor-debuginfo-2.10.3-16.1 - openSUSE Leap 42.3 (noarch): apparmor-abstractions-2.10.3-16.1 apparmor-docs-2.10.3-16.1 apparmor-parser-lang-2.10.3-16.1 apparmor-profiles-2.10.3-16.1 apparmor-utils-2.10.3-16.1 apparmor-utils-lang-2.10.3-16.1 - openSUSE Leap 42.3 (x86_64): libapparmor1-32bit-2.10.3-16.1 libapparmor1-debuginfo-32bit-2.10.3-16.1 pam_apparmor-32bit-2.10.3-16.1 pam_apparmor-debuginfo-32bit-2.10.3-16.1 - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_apparmor-2.10.3-12.6.1 apache2-mod_apparmor-debuginfo-2.10.3-12.6.1 apparmor-debugsource-2.10.3-12.6.1 apparmor-parser-2.10.3-12.6.1 apparmor-parser-debuginfo-2.10.3-12.6.1 libapparmor-devel-2.10.3-12.6.1 libapparmor1-2.10.3-12.6.1 libapparmor1-debuginfo-2.10.3-12.6.1 pam_apparmor-2.10.3-12.6.1 pam_apparmor-debuginfo-2.10.3-12.6.1 perl-apparmor-2.10.3-12.6.1 perl-apparmor-debuginfo-2.10.3-12.6.1 python3-apparmor-2.10.3-12.6.1 python3-apparmor-debuginfo-2.10.3-12.6.1 ruby-apparmor-2.10.3-12.6.1 ruby-apparmor-debuginfo-2.10.3-12.6.1 - openSUSE Leap 42.2 (noarch): apparmor-abstractions-2.10.3-12.6.1 apparmor-docs-2.10.3-12.6.1 apparmor-parser-lang-2.10.3-12.6.1 apparmor-profiles-2.10.3-12.6.1 apparmor-utils-2.10.3-12.6.1 apparmor-utils-lang-2.10.3-12.6.1 - openSUSE Leap 42.2 (x86_64): libapparmor1-32bit-2.10.3-12.6.1 libapparmor1-debuginfo-32bit-2.10.3-12.6.1 pam_apparmor-32bit-2.10.3-12.6.1 pam_apparmor-debuginfo-32bit-2.10.3-12.6.1 References: https://bugzilla.suse.com/1057900 https://bugzilla.suse.com/1061195 https://bugzilla.suse.com/1062244

1 0

openSUSE-SU-2017:3018-1: moderate: Security update for mongodb
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for mongodb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3018-1 Rating: moderate References: #1065956 Cross-References: CVE-2017-15535 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mongodb 3.4.10 fixes the following issues: Security issues fixed: - CVE-2017-15535: MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory. (boo#1065956) Bug fixes: - See release-notes for 3.4.4 - 3.4.10 changes. * https://docs.mongodb.com/manual/release-notes/3.4-changelog/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1275=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): mongodb-3.4.10-3.1 mongodb-debugsource-3.4.10-3.1 mongodb-mongoperf-3.4.10-3.1 mongodb-mongoperf-debuginfo-3.4.10-3.1 mongodb-mongos-3.4.10-3.1 mongodb-mongos-debuginfo-3.4.10-3.1 mongodb-server-3.4.10-3.1 mongodb-server-debuginfo-3.4.10-3.1 mongodb-shell-3.4.10-3.1 mongodb-shell-debuginfo-3.4.10-3.1 References: https://www.suse.com/security/cve/CVE-2017-15535.html https://bugzilla.suse.com/1065956

1 0

openSUSE-SU-2017:3017-1: moderate: Security update for shadowsocks-libev
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for shadowsocks-libev ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3017-1 Rating: moderate References: #1065619 Cross-References: CVE-2017-15924 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadowsocks-libev fixes the following issues: Security issue fixed: - CVE-2017-15924: In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions. (boo#1065619) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1274=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): shadowsocks-libev-2.5.6-3.1 shadowsocks-libev-debuginfo-2.5.6-3.1 shadowsocks-libev-debugsource-2.5.6-3.1 shadowsocks-libev-devel-2.5.6-3.1 - openSUSE Leap 42.3 (noarch): shadowsocks-libev-doc-2.5.6-3.1 References: https://www.suse.com/security/cve/CVE-2017-15924.html https://bugzilla.suse.com/1065619

1 0

openSUSE-SU-2017:3016-1: important: Security update for snack
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for snack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3016-1 Rating: important References: #793860 Cross-References: CVE-2012-6303 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for snack fixes the following issues: Security issue fixed: - CVE-2012-6303: Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file. (bnc#793860) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1277=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1277=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): snack-2.2.10-220.1 snack-debuginfo-2.2.10-220.1 snack-debugsource-2.2.10-220.1 - openSUSE Leap 42.2 (i586 x86_64): snack-2.2.10-217.3.1 snack-debuginfo-2.2.10-217.3.1 snack-debugsource-2.2.10-217.3.1 References: https://www.suse.com/security/cve/CVE-2012-6303.html https://bugzilla.suse.com/793860

1 0

openSUSE-RU-2017:3015-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3015-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - November 13 2017 database refresh This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1271=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201711130006-54.103.1 References:

1 0

openSUSE-SU-2017:2999-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 12 Nov '17

12 Nov '17

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2999-1 Rating: moderate References: #1049379 #1050135 #1052249 #1052253 #1052545 #1054924 #1055219 #1055430 #1061873 Cross-References: CVE-2016-7530 CVE-2017-11446 CVE-2017-11534 CVE-2017-12428 CVE-2017-12431 CVE-2017-12433 CVE-2017-13133 CVE-2017-13139 CVE-2017-15033 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: * CVE-2017-15033: A denial of service attack (memory leak) was fixed in ReadYUVImage in coders/yuv.c [bsc#1061873] * CVE-2017-11446: An infinite loop in ReadPESImage was fixed. (bsc#1049379) * CVE-2017-12433: A memory leak in ReadPESImage in coders/pes.c was fixed. (bsc#1052545) * CVE-2017-12428: A memory leak in ReadWMFImage in coders/wmf.c was fixed. (bsc#1052249) * CVE-2017-12431: A use-after-free in ReadWMFImage was fixed. (bsc#1052253) * CVE-2017-11534: A memory leak in the lite_font_map() in coders/wmf.c was fixed. (bsc#1050135) * CVE-2017-13133: A memory exhaustion in load_level function in coders/xcf.c was fixed. (bsc#1055219) * CVE-2017-13139: A out-of-bounds read in the ReadOneMNGImage was fixed. (bsc#1055430) This update also reverts an incorrect fix for CVE-2016-7530 [bsc#1054924]. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1270=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1270=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-37.1 ImageMagick-debuginfo-6.8.8.1-37.1 ImageMagick-debugsource-6.8.8.1-37.1 ImageMagick-devel-6.8.8.1-37.1 ImageMagick-extra-6.8.8.1-37.1 ImageMagick-extra-debuginfo-6.8.8.1-37.1 libMagick++-6_Q16-3-6.8.8.1-37.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-37.1 libMagick++-devel-6.8.8.1-37.1 libMagickCore-6_Q16-1-6.8.8.1-37.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-37.1 libMagickWand-6_Q16-1-6.8.8.1-37.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-37.1 perl-PerlMagick-6.8.8.1-37.1 perl-PerlMagick-debuginfo-6.8.8.1-37.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-37.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-37.1 libMagick++-6_Q16-3-32bit-6.8.8.1-37.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-37.1 libMagick++-devel-32bit-6.8.8.1-37.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-37.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-37.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-37.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-37.1 - openSUSE Leap 42.2 (i586 x86_64): ImageMagick-6.8.8.1-30.9.1 ImageMagick-debuginfo-6.8.8.1-30.9.1 ImageMagick-debugsource-6.8.8.1-30.9.1 ImageMagick-devel-6.8.8.1-30.9.1 ImageMagick-extra-6.8.8.1-30.9.1 ImageMagick-extra-debuginfo-6.8.8.1-30.9.1 libMagick++-6_Q16-3-6.8.8.1-30.9.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-30.9.1 libMagick++-devel-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-30.9.1 perl-PerlMagick-6.8.8.1-30.9.1 perl-PerlMagick-debuginfo-6.8.8.1-30.9.1 - openSUSE Leap 42.2 (x86_64): ImageMagick-devel-32bit-6.8.8.1-30.9.1 libMagick++-6_Q16-3-32bit-6.8.8.1-30.9.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-30.9.1 libMagick++-devel-32bit-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-30.9.1 - openSUSE Leap 42.2 (noarch): ImageMagick-doc-6.8.8.1-30.9.1 References: https://www.suse.com/security/cve/CVE-2016-7530.html https://www.suse.com/security/cve/CVE-2017-11446.html https://www.suse.com/security/cve/CVE-2017-11534.html https://www.suse.com/security/cve/CVE-2017-12428.html https://www.suse.com/security/cve/CVE-2017-12431.html https://www.suse.com/security/cve/CVE-2017-12433.html https://www.suse.com/security/cve/CVE-2017-13133.html https://www.suse.com/security/cve/CVE-2017-13139.html https://www.suse.com/security/cve/CVE-2017-15033.html https://bugzilla.suse.com/1049379 https://bugzilla.suse.com/1050135 https://bugzilla.suse.com/1052249 https://bugzilla.suse.com/1052253 https://bugzilla.suse.com/1052545 https://bugzilla.suse.com/1054924 https://bugzilla.suse.com/1055219 https://bugzilla.suse.com/1055430 https://bugzilla.suse.com/1061873

1 0

openSUSE-SU-2017:2998-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 12 Nov '17

12 Nov '17

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2998-1 Rating: important References: #1032647 #1052009 #1064069 #1064070 #1064071 #1064072 #1064073 #1064075 #1064077 #1064078 #1064079 #1064080 #1064081 #1064082 #1064083 #1064084 #1064085 #1064086 Cross-References: CVE-2016-10165 CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u151 (icedtea 3.6.0) Security issues fixed: - CVE-2017-10274: Handle smartcard clean up better (bsc#1064071) - CVE-2017-10281: Better queuing priorities (bsc#1064072) - CVE-2017-10285: Unreferenced references (bsc#1064073) - CVE-2017-10295: Better URL connections (bsc#1064075) - CVE-2017-10388: Correct Kerberos ticket grants (bsc#1064086) - CVE-2017-10346: Better invokespecial checks (bsc#1064078) - CVE-2017-10350: Better Base Exceptions (bsc#1064082) - CVE-2017-10347: Better timezone processing (bsc#1064079) - CVE-2017-10349: Better X processing (bsc#1064081) - CVE-2017-10345: Better keystore handling (bsc#1064077) - CVE-2017-10348: Better processing of unresolved permissions (bsc#1064080) - CVE-2017-10357: Process Proxy presentation (bsc#1064085) - CVE-2017-10355: More stable connection processing (bsc#1064083) - CVE-2017-10356: Update storage implementations (bsc#1064084) - CVE-2016-10165: Improve CMS header processing (bsc#1064069) - CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843: Upgrade compression library (bsc#1064070) Bug fixes: - Fix bsc#1032647, bsc#1052009 with btrfs subvolumes and overlayfs This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1269=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1269=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.151-18.1 java-1_8_0-openjdk-accessibility-1.8.0.151-18.1 java-1_8_0-openjdk-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-debugsource-1.8.0.151-18.1 java-1_8_0-openjdk-demo-1.8.0.151-18.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-devel-1.8.0.151-18.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-headless-1.8.0.151-18.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-src-1.8.0.151-18.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.151-18.1 - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.151-10.18.2 java-1_8_0-openjdk-accessibility-1.8.0.151-10.18.2 java-1_8_0-openjdk-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-debugsource-1.8.0.151-10.18.2 java-1_8_0-openjdk-demo-1.8.0.151-10.18.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-devel-1.8.0.151-10.18.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-headless-1.8.0.151-10.18.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-src-1.8.0.151-10.18.2 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.151-10.18.2 References: https://www.suse.com/security/cve/CVE-2016-10165.html https://www.suse.com/security/cve/CVE-2016-9840.html https://www.suse.com/security/cve/CVE-2016-9841.html https://www.suse.com/security/cve/CVE-2016-9842.html https://www.suse.com/security/cve/CVE-2016-9843.html https://www.suse.com/security/cve/CVE-2017-10274.html https://www.suse.com/security/cve/CVE-2017-10281.html https://www.suse.com/security/cve/CVE-2017-10285.html https://www.suse.com/security/cve/CVE-2017-10295.html https://www.suse.com/security/cve/CVE-2017-10345.html https://www.suse.com/security/cve/CVE-2017-10346.html https://www.suse.com/security/cve/CVE-2017-10347.html https://www.suse.com/security/cve/CVE-2017-10348.html https://www.suse.com/security/cve/CVE-2017-10349.html https://www.suse.com/security/cve/CVE-2017-10350.html https://www.suse.com/security/cve/CVE-2017-10355.html https://www.suse.com/security/cve/CVE-2017-10356.html https://www.suse.com/security/cve/CVE-2017-10357.html https://www.suse.com/security/cve/CVE-2017-10388.html https://bugzilla.suse.com/1032647 https://bugzilla.suse.com/1052009 https://bugzilla.suse.com/1064069 https://bugzilla.suse.com/1064070 https://bugzilla.suse.com/1064071 https://bugzilla.suse.com/1064072 https://bugzilla.suse.com/1064073 https://bugzilla.suse.com/1064075 https://bugzilla.suse.com/1064077 https://bugzilla.suse.com/1064078 https://bugzilla.suse.com/1064079 https://bugzilla.suse.com/1064080 https://bugzilla.suse.com/1064081 https://bugzilla.suse.com/1064082 https://bugzilla.suse.com/1064083 https://bugzilla.suse.com/1064084 https://bugzilla.suse.com/1064085 https://bugzilla.suse.com/1064086

1 0

openSUSE-SU-2017:2994-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2994-1 Rating: moderate References: #1064980 Cross-References: CVE-2016-10517 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis to version 4.0.2 fixes the following issues: - CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability (boo#1002351) The following upstream changes are included: - SLOWLOG now logs the offending client name and address - The modules native data types RDB format changed. - The AOF check utility is now able to deal with RDB preambles. - GEORADIUS_RO and GEORADIUSBYMEMBER_RO variants, not supporting the STORE option, were added in order to allow read-only scaling of such queries. - HSET is now variadic, and HMSET is considered deprecated - GEORADIUS huge radius (>= ~6000 km) corner cases fixed - HyperLogLog commands no longer crash on certain input (non HLL) strings. - Fixed SLAVEOF inside MULTI/EXEC blocks. - TCP binding bug fixed when only certain addresses were available for a given por - MIGRATE could crash the server after a socket error Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1258=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1258=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): redis-4.0.2-11.1 redis-debuginfo-4.0.2-11.1 redis-debugsource-4.0.2-11.1 - openSUSE Leap 42.2 (i586 x86_64): redis-4.0.2-8.3.1 redis-debuginfo-4.0.2-8.3.1 redis-debugsource-4.0.2-8.3.1 References: https://www.suse.com/security/cve/CVE-2016-10517.html https://bugzilla.suse.com/1064980

1 0

openSUSE-SU-2017:2993-1: important: Security update for krb5
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2993-1 Rating: important References: #1065274 Cross-References: CVE-2017-15088 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for krb5 fixes the following securitz issueÖ - CVE-2017-15088: A buffer overflow in get_matching_data() was fixed that could under specific circumstances be used to execute code (bsc#1065274) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1266=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1266=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): krb5-1.12.5-12.1 krb5-client-1.12.5-12.1 krb5-client-debuginfo-1.12.5-12.1 krb5-debuginfo-1.12.5-12.1 krb5-debugsource-1.12.5-12.1 krb5-devel-1.12.5-12.1 krb5-doc-1.12.5-12.1 krb5-mini-1.12.5-12.1 krb5-mini-debuginfo-1.12.5-12.1 krb5-mini-debugsource-1.12.5-12.1 krb5-mini-devel-1.12.5-12.1 krb5-plugin-kdb-ldap-1.12.5-12.1 krb5-plugin-kdb-ldap-debuginfo-1.12.5-12.1 krb5-plugin-preauth-otp-1.12.5-12.1 krb5-plugin-preauth-otp-debuginfo-1.12.5-12.1 krb5-plugin-preauth-pkinit-1.12.5-12.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.5-12.1 krb5-server-1.12.5-12.1 krb5-server-debuginfo-1.12.5-12.1 - openSUSE Leap 42.3 (x86_64): krb5-32bit-1.12.5-12.1 krb5-debuginfo-32bit-1.12.5-12.1 krb5-devel-32bit-1.12.5-12.1 - openSUSE Leap 42.2 (i586 x86_64): krb5-1.12.5-6.6.1 krb5-client-1.12.5-6.6.1 krb5-client-debuginfo-1.12.5-6.6.1 krb5-debuginfo-1.12.5-6.6.1 krb5-debugsource-1.12.5-6.6.1 krb5-devel-1.12.5-6.6.1 krb5-doc-1.12.5-6.6.1 krb5-mini-1.12.5-6.6.1 krb5-mini-debuginfo-1.12.5-6.6.1 krb5-mini-debugsource-1.12.5-6.6.1 krb5-mini-devel-1.12.5-6.6.1 krb5-plugin-kdb-ldap-1.12.5-6.6.1 krb5-plugin-kdb-ldap-debuginfo-1.12.5-6.6.1 krb5-plugin-preauth-otp-1.12.5-6.6.1 krb5-plugin-preauth-otp-debuginfo-1.12.5-6.6.1 krb5-plugin-preauth-pkinit-1.12.5-6.6.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.5-6.6.1 krb5-server-1.12.5-6.6.1 krb5-server-debuginfo-1.12.5-6.6.1 - openSUSE Leap 42.2 (x86_64): krb5-32bit-1.12.5-6.6.1 krb5-debuginfo-32bit-1.12.5-6.6.1 krb5-devel-32bit-1.12.5-6.6.1 References: https://www.suse.com/security/cve/CVE-2017-15088.html https://bugzilla.suse.com/1065274

1 0

openSUSE-RU-2017:2992-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2992-1 Rating: moderate References: #1000946 #1016920 #1049975 #1051349 #978935 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1262=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.32.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.32.0-5.1 kio-core-5.32.0-5.1 kio-core-debuginfo-5.32.0-5.1 kio-debuginfo-5.32.0-5.1 kio-debugsource-5.32.0-5.1 kio-devel-5.32.0-5.1 kio-devel-debuginfo-5.32.0-5.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/978935

1 0

openSUSE-SU-2017:2991-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2991-1 Rating: important References: #1020950 #1024749 #1045460 #1050469 Cross-References: CVE-2016-7586 CVE-2016-7589 CVE-2016-7592 CVE-2016-7599 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 CVE-2017-2496 CVE-2017-2510 CVE-2017-2538 CVE-2017-2539 CVE-2017-7018 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7039 CVE-2017-7046 CVE-2017-7048 CVE-2017-7055 CVE-2017-7056 CVE-2017-7061 CVE-2017-7064 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 40 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.18.0 fixes the following issues: These security issues were fixed: - CVE-2017-7039: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7018: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7030: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7037: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7034: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7055: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7056: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7064: An issue was fixed that allowed remote attackers to bypass intended memory-read restrictions via a crafted app (bsc#1050469). - CVE-2017-7061: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7048: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7046: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-2538: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1045460) - CVE-2017-2496: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2539: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2510: An issue was fixed that allowed remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events. - CVE-2017-2365: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2366: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2373: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2363: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2362: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2354: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749). - CVE-2017-2355: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2356: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2371: An issue was fixed that allowed remote attackers to launch popups via a crafted web site (bsc#1024749) - CVE-2017-2364: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2369: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2016-7656: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7635: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7654: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7639: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7645: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7652: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7641: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7632: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7599: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that used HTTP redirects (bsc#1020950) - CVE-2016-7592: An issue was fixed that allowed remote attackers to obtain sensitive information via crafted JavaScript prompts on a web site (bsc#1020950) - CVE-2016-7589: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7623: An issue was fixed that allowed remote attackers to obtain sensitive information via a blob URL on a web site (bsc#1020950) - CVE-2016-7586: An issue was fixed that allowed remote attackers to obtain sensitive information via a crafted web site (bsc#1020950) For other non-security fixes please check the changelog. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1268=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1268=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.0-5.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.0-5.1 libwebkit2gtk-4_0-37-2.18.0-5.1 libwebkit2gtk-4_0-37-debuginfo-2.18.0-5.1 typelib-1_0-JavaScriptCore-4_0-2.18.0-5.1 typelib-1_0-WebKit2-4_0-2.18.0-5.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.0-5.1 webkit-jsc-4-2.18.0-5.1 webkit-jsc-4-debuginfo-2.18.0-5.1 webkit2gtk-4_0-injected-bundles-2.18.0-5.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.0-5.1 webkit2gtk3-debugsource-2.18.0-5.1 webkit2gtk3-devel-2.18.0-5.1 webkit2gtk3-plugin-process-gtk2-2.18.0-5.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.0-5.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.0-5.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.0-5.1 libwebkit2gtk-4_0-37-32bit-2.18.0-5.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.0-5.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.18.0-5.1 - openSUSE Leap 42.2 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.0-2.3.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.0-2.3.1 libwebkit2gtk-4_0-37-2.18.0-2.3.1 libwebkit2gtk-4_0-37-debuginfo-2.18.0-2.3.1 typelib-1_0-JavaScriptCore-4_0-2.18.0-2.3.1 typelib-1_0-WebKit2-4_0-2.18.0-2.3.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.0-2.3.1 webkit-jsc-4-2.18.0-2.3.1 webkit-jsc-4-debuginfo-2.18.0-2.3.1 webkit2gtk-4_0-injected-bundles-2.18.0-2.3.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.0-2.3.1 webkit2gtk3-debugsource-2.18.0-2.3.1 webkit2gtk3-devel-2.18.0-2.3.1 webkit2gtk3-plugin-process-gtk2-2.18.0-2.3.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.0-2.3.1 - openSUSE Leap 42.2 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.0-2.3.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.0-2.3.1 libwebkit2gtk-4_0-37-32bit-2.18.0-2.3.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.0-2.3.1 - openSUSE Leap 42.2 (noarch): libwebkit2gtk3-lang-2.18.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-7586.html https://www.suse.com/security/cve/CVE-2016-7589.html https://www.suse.com/security/cve/CVE-2016-7592.html https://www.suse.com/security/cve/CVE-2016-7599.html https://www.suse.com/security/cve/CVE-2016-7623.html https://www.suse.com/security/cve/CVE-2016-7632.html https://www.suse.com/security/cve/CVE-2016-7635.html https://www.suse.com/security/cve/CVE-2016-7639.html https://www.suse.com/security/cve/CVE-2016-7641.html https://www.suse.com/security/cve/CVE-2016-7645.html https://www.suse.com/security/cve/CVE-2016-7652.html https://www.suse.com/security/cve/CVE-2016-7654.html https://www.suse.com/security/cve/CVE-2016-7656.html https://www.suse.com/security/cve/CVE-2017-2350.html https://www.suse.com/security/cve/CVE-2017-2354.html https://www.suse.com/security/cve/CVE-2017-2355.html https://www.suse.com/security/cve/CVE-2017-2356.html https://www.suse.com/security/cve/CVE-2017-2362.html https://www.suse.com/security/cve/CVE-2017-2363.html https://www.suse.com/security/cve/CVE-2017-2364.html https://www.suse.com/security/cve/CVE-2017-2365.html https://www.suse.com/security/cve/CVE-2017-2366.html https://www.suse.com/security/cve/CVE-2017-2369.html https://www.suse.com/security/cve/CVE-2017-2371.html https://www.suse.com/security/cve/CVE-2017-2373.html https://www.suse.com/security/cve/CVE-2017-2496.html https://www.suse.com/security/cve/CVE-2017-2510.html https://www.suse.com/security/cve/CVE-2017-2538.html https://www.suse.com/security/cve/CVE-2017-2539.html https://www.suse.com/security/cve/CVE-2017-7018.html https://www.suse.com/security/cve/CVE-2017-7030.html https://www.suse.com/security/cve/CVE-2017-7034.html https://www.suse.com/security/cve/CVE-2017-7037.html https://www.suse.com/security/cve/CVE-2017-7039.html https://www.suse.com/security/cve/CVE-2017-7046.html https://www.suse.com/security/cve/CVE-2017-7048.html https://www.suse.com/security/cve/CVE-2017-7055.html https://www.suse.com/security/cve/CVE-2017-7056.html https://www.suse.com/security/cve/CVE-2017-7061.html https://www.suse.com/security/cve/CVE-2017-7064.html https://bugzilla.suse.com/1020950 https://bugzilla.suse.com/1024749 https://bugzilla.suse.com/1045460 https://bugzilla.suse.com/1050469

1 0

openSUSE-RU-2017:2990-1: moderate: Recommended update for drbd
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for drbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2990-1 Rating: moderate References: #1005578 #1006176 #1025089 #1025585 #1037109 #983633 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update provides DRBD 9.0.6, which brings the following fixes: - Fix resync finished with bits set (bsc#1025089) - Fix drbdmeta propagation of full bitmaps (bsc#1037109) - Fixed error handling in del_path - Fix multiple issues with concurrent two-phase-commits - Reorganize data structures of receiver for efficiency - Allow multiple updates per AL-transaction on a secondary - No longer allocate bitmap-slots on diskfull nodes for diskless node - Fix bugs in the try_become_up_to_date() logic - Fix two phase-commits when the nodes form a circular structure - Fix the resync after online grow - Fix two-phase-commits when the nodes build a loop - A number of fixes to speed up establishing of connections - Create a new current UUID when the peer's disk breaks - Restored the new-current-uuid --clear-bitmap functionality - Empty flush requests no longer trigger a bogus "IO ERROR" log entry. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): drbd-9.0.6+git.08cda19-2.3.1 drbd-debugsource-9.0.6+git.08cda19-2.3.1 drbd-kmp-default-9.0.6+git.08cda19_k4.4.92_18.36-2.3.1 drbd-kmp-default-debuginfo-9.0.6+git.08cda19_k4.4.92_18.36-2.3.1 References: https://bugzilla.suse.com/1005578 https://bugzilla.suse.com/1006176 https://bugzilla.suse.com/1025089 https://bugzilla.suse.com/1025585 https://bugzilla.suse.com/1037109 https://bugzilla.suse.com/983633

1 0

openSUSE-RU-2017:2988-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2988-1 Rating: moderate References: #1000946 #1016920 #1049975 #1051349 #978935 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1262=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): kio-5.32.0-5.1 kio-core-5.32.0-5.1 kio-core-debuginfo-5.32.0-5.1 kio-debuginfo-5.32.0-5.1 kio-debugsource-5.32.0-5.1 kio-devel-5.32.0-5.1 kio-devel-debuginfo-5.32.0-5.1 - openSUSE Leap 42.3 (noarch): kio-lang-5.32.0-5.1 - openSUSE Leap 42.3 (x86_64): kio-32bit-5.32.0-5.1 kio-core-32bit-5.32.0-5.1 kio-core-debuginfo-32bit-5.32.0-5.1 kio-debuginfo-32bit-5.32.0-5.1 kio-devel-32bit-5.32.0-5.1 kio-devel-debuginfo-32bit-5.32.0-5.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/978935

1 0

openSUSE-FU-2017:2986-1: moderate: Update to add ClusterShell
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Feature Update: Update to add ClusterShell ______________________________________________________________________________ Announcement ID: openSUSE-FU-2017:2986-1 Rating: moderate References: #1066278 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one feature fix can now be installed. Description: This update makes available ClusterShell 1.8. Clustershell is a set of tools for cluster and server farm system administation. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1260=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): clustershell-1.8-2.1 python2-clustershell-1.8-2.1 python3-clustershell-1.8-2.1 References: https://bugzilla.suse.com/1066278

1 0

openSUSE-SU-2017:2984-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2984-1 Rating: moderate References: #1064980 Cross-References: CVE-2016-10517 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis to version 4.0.2 fixes the following issues: - CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability (boo#1002351) The following upstream changes are included: - SLOWLOG now logs the offending client name and address - The modules native data types RDB format changed. - The AOF check utility is now able to deal with RDB preambles. - GEORADIUS_RO and GEORADIUSBYMEMBER_RO variants, not supporting the STORE option, were added in order to allow read-only scaling of such queries. - HSET is now variadic, and HMSET is considered deprecated - GEORADIUS huge radius (>= ~6000 km) corner cases fixed - HyperLogLog commands no longer crash on certain input (non HLL) strings. - Fixed SLAVEOF inside MULTI/EXEC blocks. - TCP binding bug fixed when only certain addresses were available for a given por - MIGRATE could crash the server after a socket error Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1258=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): redis-4.0.2-9.1 redis-debuginfo-4.0.2-9.1 redis-debugsource-4.0.2-9.1 References: https://www.suse.com/security/cve/CVE-2016-10517.html https://bugzilla.suse.com/1064980

1 0

openSUSE-FU-2017:2982-1: moderate: Update to add ClusterShell
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Feature Update: Update to add ClusterShell ______________________________________________________________________________ Announcement ID: openSUSE-FU-2017:2982-1 Rating: moderate References: #1066278 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one feature fix can now be installed. Description: This update makes available ClusterShell 1.8. Clustershell is a set of tools for cluster and server farm system administation. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1260=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1260=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): clustershell-1.8-2.1 python2-clustershell-1.8-2.1 python3-clustershell-1.8-2.1 - openSUSE Leap 42.2 (noarch): clustershell-1.8-2.1 python2-clustershell-1.8-2.1 python3-clustershell-1.8-2.1 References: https://bugzilla.suse.com/1066278

1 0

openSUSE-RU-2017:2980-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2980-1 Rating: moderate References: #1000946 #1016920 #1030145 #1049975 #1051349 #969768 #978935 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) - Prevent /tmp getting filled up because full directories are copied to it when generating folder previews for remote locations and the trash (kde#208625, boo#969768) - Dolphin did not displaying symlinks under certain circumstances (boo#1030145, kde#369275) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1263=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kio-5.26.0-8.3.1 kio-core-5.26.0-8.3.1 kio-core-debuginfo-5.26.0-8.3.1 kio-debuginfo-5.26.0-8.3.1 kio-debugsource-5.26.0-8.3.1 kio-devel-5.26.0-8.3.1 kio-devel-debuginfo-5.26.0-8.3.1 - openSUSE Leap 42.2 (noarch): kio-lang-5.26.0-8.3.1 - openSUSE Leap 42.2 (x86_64): kio-32bit-5.26.0-8.3.1 kio-core-32bit-5.26.0-8.3.1 kio-core-debuginfo-32bit-5.26.0-8.3.1 kio-debuginfo-32bit-5.26.0-8.3.1 kio-devel-32bit-5.26.0-8.3.1 kio-devel-debuginfo-32bit-5.26.0-8.3.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1030145 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/969768 https://bugzilla.suse.com/978935

1 0

openSUSE-SU-2017:2979-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2979-1 Rating: moderate References: #1023895 #1052261 #980486 Cross-References: CVE-2017-12424 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for shadow fixes several issues. This security issue was fixed: - CVE-2017-12424: The newusers tool could have been forced to manipulate internal data structures in ways unintended by the authors. Malformed input may have lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors (bsc#1052261). These non-security issues were fixed: - bsc#1023895: Fixed man page to not contain invalid options and also prevent warnings when using these options in certain settings - bsc#980486: Reset user in /var/log/tallylog because of the usage of pam_tally2 This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1265=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1265=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): shadow-4.2.1-10.1 shadow-debuginfo-4.2.1-10.1 shadow-debugsource-4.2.1-10.1 - openSUSE Leap 42.2 (i586 x86_64): shadow-4.2.1-6.6.1 shadow-debuginfo-4.2.1-6.6.1 shadow-debugsource-4.2.1-6.6.1 References: https://www.suse.com/security/cve/CVE-2017-12424.html https://bugzilla.suse.com/1023895 https://bugzilla.suse.com/1052261 https://bugzilla.suse.com/980486

1 0

openSUSE-SU-2017:2978-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2978-1 Rating: moderate References: #1008037 #1008038 #1019021 #1038785 #1065872 Cross-References: CVE-2016-8614 CVE-2016-8628 CVE-2016-9587 CVE-2017-7481 CVE-2017-7550 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ansible to version 2.4.1.0 fixes the following vulnerabilities: - CVE-2017-7481: Security issue with lookup return not tainting the jinja2 environment (bsc#1038785) - CVE-2016-9587: host to controller command execution vulnerability (bsc#1019021) - CVE-2016-8628: Command injection by compromised server via fact variables (bsc#1008037) - CVE-2016-8614: Improper verification of key fingerprints in apt_key module (bsc#1008038) - CVE-2017-7550: jenkins_plugin module may have exposed passwords in remote host logs (bsc#1065872) This update also contains a number of upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1259=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): ansible-2.4.1.0-6.1 References: https://www.suse.com/security/cve/CVE-2016-8614.html https://www.suse.com/security/cve/CVE-2016-8628.html https://www.suse.com/security/cve/CVE-2016-9587.html https://www.suse.com/security/cve/CVE-2017-7481.html https://www.suse.com/security/cve/CVE-2017-7550.html https://bugzilla.suse.com/1008037 https://bugzilla.suse.com/1008038 https://bugzilla.suse.com/1019021 https://bugzilla.suse.com/1038785 https://bugzilla.suse.com/1065872

1 0

openSUSE-RU-2017:2977-1: moderate: Recommended update for rpmlint
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2977-1 Rating: moderate References: #846337 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rpmlint fixes the following issues: - Whitelist NetworkManager-l2tp usage as DBUS service (boo#846337) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1261=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): rpmlint-mini-1.8-6.2 rpmlint-mini-debuginfo-1.8-6.2 rpmlint-mini-debugsource-1.8-6.2 rpmlint-tests-debugsource-84.87+git20170418.092177d-16.1 - openSUSE Leap 42.3 (noarch): rpmlint-1.8-16.1 References: https://bugzilla.suse.com/846337

1 0

openSUSE-SU-2017:2976-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2976-1 Rating: moderate References: #1008037 #1008038 #1019021 #1038785 #1065872 Cross-References: CVE-2016-8614 CVE-2016-8628 CVE-2016-9587 CVE-2017-7481 CVE-2017-7550 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ansible to version 2.4.1.0 fixes the following vulnerabilities: - CVE-2017-7481: Security issue with lookup return not tainting the jinja2 environment (bsc#1038785) - CVE-2016-9587: host to controller command execution vulnerability (bsc#1019021) - CVE-2016-8628: Command injection by compromised server via fact variables (bsc#1008037) - CVE-2016-8614: Improper verification of key fingerprints in apt_key module (bsc#1008038) - CVE-2017-7550: jenkins_plugin module may have exposed passwords in remote host logs (bsc#1065872) This update also contains a number of upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1259=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1259=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): ansible-2.4.1.0-6.1 - openSUSE Leap 42.2 (noarch): ansible-2.4.1.0-2.4.1 References: https://www.suse.com/security/cve/CVE-2016-8614.html https://www.suse.com/security/cve/CVE-2016-8628.html https://www.suse.com/security/cve/CVE-2016-9587.html https://www.suse.com/security/cve/CVE-2017-7481.html https://www.suse.com/security/cve/CVE-2017-7550.html https://bugzilla.suse.com/1008037 https://bugzilla.suse.com/1008038 https://bugzilla.suse.com/1019021 https://bugzilla.suse.com/1038785 https://bugzilla.suse.com/1065872

1 0

openSUSE-SU-2017:2975-1: moderate: Security update for virtualbox
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2975-1 Rating: moderate References: #1060072 #1064200 #1066488 Cross-References: CVE-2017-10392 CVE-2017-10407 CVE-2017-10408 CVE-2017-10428 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for virtualbox fixes the following issues: - CVE-2017-10392: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10407: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10408: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10428: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and partially deny service The following packaging changes are included: - Further to usage of vboxdrv if virtualbox-qt is not installed: updates to vboxdrv.sh (boo#1060072) - The virtualbox package no longer requires libX11, an library module files were moved to virtualbox-qt This update also contains all upstream improvements in the 5.1.30 release, including: - Fix for double mouse cursor when using mouse integration without Guest Additions. - Translation updates Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1267=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1267=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): python-virtualbox-5.1.30-39.1 python-virtualbox-debuginfo-5.1.30-39.1 virtualbox-5.1.30-39.1 virtualbox-debuginfo-5.1.30-39.1 virtualbox-debugsource-5.1.30-39.1 virtualbox-devel-5.1.30-39.1 virtualbox-guest-kmp-default-5.1.30_k4.4.92_31-39.1 virtualbox-guest-kmp-default-debuginfo-5.1.30_k4.4.92_31-39.1 virtualbox-guest-tools-5.1.30-39.1 virtualbox-guest-tools-debuginfo-5.1.30-39.1 virtualbox-guest-x11-5.1.30-39.1 virtualbox-guest-x11-debuginfo-5.1.30-39.1 virtualbox-host-kmp-default-5.1.30_k4.4.92_31-39.1 virtualbox-host-kmp-default-debuginfo-5.1.30_k4.4.92_31-39.1 virtualbox-qt-5.1.30-39.1 virtualbox-qt-debuginfo-5.1.30-39.1 virtualbox-vnc-5.1.30-39.1 virtualbox-websrv-5.1.30-39.1 virtualbox-websrv-debuginfo-5.1.30-39.1 - openSUSE Leap 42.3 (noarch): virtualbox-guest-desktop-icons-5.1.30-39.1 virtualbox-guest-source-5.1.30-39.1 virtualbox-host-source-5.1.30-39.1 - openSUSE Leap 42.2 (x86_64): python-virtualbox-5.1.30-19.46.1 python-virtualbox-debuginfo-5.1.30-19.46.1 virtualbox-5.1.30-19.46.1 virtualbox-debuginfo-5.1.30-19.46.1 virtualbox-debugsource-5.1.30-19.46.1 virtualbox-devel-5.1.30-19.46.1 virtualbox-guest-kmp-default-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-guest-kmp-default-debuginfo-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-guest-tools-5.1.30-19.46.1 virtualbox-guest-tools-debuginfo-5.1.30-19.46.1 virtualbox-guest-x11-5.1.30-19.46.1 virtualbox-guest-x11-debuginfo-5.1.30-19.46.1 virtualbox-host-kmp-default-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-host-kmp-default-debuginfo-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-qt-5.1.30-19.46.1 virtualbox-qt-debuginfo-5.1.30-19.46.1 virtualbox-vnc-5.1.30-19.46.1 virtualbox-websrv-5.1.30-19.46.1 virtualbox-websrv-debuginfo-5.1.30-19.46.1 - openSUSE Leap 42.2 (noarch): virtualbox-guest-desktop-icons-5.1.30-19.46.1 virtualbox-guest-source-5.1.30-19.46.1 virtualbox-host-source-5.1.30-19.46.1 References: https://www.suse.com/security/cve/CVE-2017-10392.html https://www.suse.com/security/cve/CVE-2017-10407.html https://www.suse.com/security/cve/CVE-2017-10408.html https://www.suse.com/security/cve/CVE-2017-10428.html https://bugzilla.suse.com/1060072 https://bugzilla.suse.com/1064200 https://bugzilla.suse.com/1066488

1 0

openSUSE-RU-2017:2974-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2974-1 Rating: moderate References: #1000946 #1016920 #1030145 #1049975 #1051349 #969768 #978935 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) - Prevent /tmp getting filled up because full directories are copied to it when generating folder previews for remote locations and the trash (kde#208625, boo#969768) - Dolphin did not displaying symlinks under certain circumstances (boo#1030145, kde#369275) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1263=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.20.0-9.1 kio-lang-5.26.0-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.20.0-9.1 kio-5.26.0-8.1 kio-core-5.20.0-9.1 kio-core-5.26.0-8.1 kio-core-debuginfo-5.26.0-8.1 kio-debuginfo-5.26.0-8.1 kio-debugsource-5.26.0-8.1 kio-devel-5.20.0-9.1 kio-devel-5.26.0-8.1 kio-devel-debuginfo-5.26.0-8.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1030145 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/969768 https://bugzilla.suse.com/978935

1 0

openSUSE-RU-2017:2967-1: important: Recommended update for SuSEfirewall2
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for SuSEfirewall2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2967-1 Rating: important References: #1067057 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for SuSEfirewall2 fixes the following issues: - Fixed a regression that was introduced by the previous security update. The regression caused some rpcinfo related configurations of SuSEfirewall2 to fail. For example the setting FW_CONFIGURATIONS_EXT="nfs-kernel-server" no longer correctly opened up the necessary ports for the nfs server, consequently making NFS unavailable (bsc#1067057). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1257=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): SuSEfirewall2-3.6.312-5.12.1 References: https://bugzilla.suse.com/1067057

1 0

openSUSE-RU-2017:2961-1: Recommended update for tmux
by maintenance＠opensuse.org 09 Nov '17

09 Nov '17

openSUSE Recommended Update: Recommended update for tmux ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2961-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides the latest version 2.6 for tmux. tmux is a terminal multiplexer. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1255=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tmux-2.6-15.1 References:

1 0