November 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:3033-1: moderate: Recommended update for xfdesktop
by maintenance＠opensuse.org 17 Nov '17

17 Nov '17

openSUSE Recommended Update: Recommended update for xfdesktop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3033-1 Rating: moderate References: #1039304 #1067785 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for xfdesktop fixes the following issues: - directory browsing was broken with Gtk 2.24.31, as usedd for selecting wallpapers (boo1039304) The following further fixes are included in version 4.12.4: - Fix a division-by-0 error - Rotate wallpaper images if they contain rotation information - Fix loading of wallpaper previews - Fix setting of wallpaper if monitor name contains whitespace The package xfdesktop-branding-openSUSE was rebuilt to work with this update. (boo#1067785) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1285=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1285=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): xfdesktop-4.12.4-7.1 xfdesktop-debuginfo-4.12.4-7.1 xfdesktop-debugsource-4.12.4-7.1 - openSUSE Leap 42.3 (noarch): xfdesktop-branding-openSUSE-4.12.0-8.1 xfdesktop-branding-upstream-4.12.4-7.1 xfdesktop-lang-4.12.4-7.1 - openSUSE Leap 42.2 (noarch): xfdesktop-branding-openSUSE-4.12.0-6.2.1 xfdesktop-branding-upstream-4.12.4-4.3.1 xfdesktop-lang-4.12.4-4.3.1 - openSUSE Leap 42.2 (x86_64): xfdesktop-4.12.4-4.3.1 xfdesktop-debuginfo-4.12.4-4.3.1 xfdesktop-debugsource-4.12.4-4.3.1 References: https://bugzilla.suse.com/1039304 https://bugzilla.suse.com/1067785

1 0

openSUSE-RU-2017:3032-1: moderate: Recommended update for rp-pppoe
by maintenance＠opensuse.org 17 Nov '17

17 Nov '17

openSUSE Recommended Update: Recommended update for rp-pppoe ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3032-1 Rating: moderate References: #1060710 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rp-pppoe fixes the following issue: - missing systemd service file for the client (boo#1060710) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1284=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): rp-pppoe-3.12-3.1 rp-pppoe-debuginfo-3.12-3.1 rp-pppoe-debugsource-3.12-3.1 References: https://bugzilla.suse.com/1060710

1 0

openSUSE-RU-2017:3031-1: moderate: Recommended update for hylafax+
by maintenance＠opensuse.org 17 Nov '17

17 Nov '17

openSUSE Recommended Update: Recommended update for hylafax+ ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3031-1 Rating: moderate References: #1052195 #1067783 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for hylafax+ fixes the following issues: - localized Email notification removed german Umlauts (boo#1052195) Version update to bugfix release 5.5.9 (boo#1067783): - fix job rescheduling if the proxy connection attempt fails - increase the maximum number of triggers from 1024 to 4096 - eliminate faxq job priority "bounding" - attempt to detect premature non-ECM Phase C carrier loss - add missing recvq error message indications - fix tagtest support for multi-strip images - enhance textfmt wrapping to occur on word boundaries Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1282=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1282=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): hylafax+-5.5.9-12.1 hylafax+-client-5.5.9-12.1 hylafax+-client-debuginfo-5.5.9-12.1 hylafax+-debuginfo-5.5.9-12.1 hylafax+-debugsource-5.5.9-12.1 libfaxutil5_5_9-5.5.9-12.1 libfaxutil5_5_9-debuginfo-5.5.9-12.1 - openSUSE Leap 42.2 (i586 x86_64): hylafax+-5.5.9-9.3.1 hylafax+-client-5.5.9-9.3.1 hylafax+-client-debuginfo-5.5.9-9.3.1 hylafax+-debuginfo-5.5.9-9.3.1 hylafax+-debugsource-5.5.9-9.3.1 libfaxutil5_5_9-5.5.9-9.3.1 libfaxutil5_5_9-debuginfo-5.5.9-9.3.1 References: https://bugzilla.suse.com/1052195 https://bugzilla.suse.com/1067783

1 0

openSUSE-RU-2017:3030-1: moderate: Recommended update for xfce4-panel-plugin-weather
by maintenance＠opensuse.org 17 Nov '17

17 Nov '17

openSUSE Recommended Update: Recommended update for xfce4-panel-plugin-weather ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3030-1 Rating: moderate References: #1046810 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xfce4-panel-plugin-weather fixes the following issues: - weather data could not be retrieved to a changed data source API (bsc#1046810) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1283=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1283=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): xfce4-panel-plugin-weather-lang-0.8.10-7.1 - openSUSE Leap 42.3 (x86_64): xfce4-panel-plugin-weather-0.8.10-7.1 xfce4-panel-plugin-weather-debuginfo-0.8.10-7.1 xfce4-panel-plugin-weather-debugsource-0.8.10-7.1 - openSUSE Leap 42.2 (noarch): xfce4-panel-plugin-weather-lang-0.8.10-4.3.1 - openSUSE Leap 42.2 (x86_64): xfce4-panel-plugin-weather-0.8.10-4.3.1 xfce4-panel-plugin-weather-debuginfo-0.8.10-4.3.1 xfce4-panel-plugin-weather-debugsource-0.8.10-4.3.1 References: https://bugzilla.suse.com/1046810

1 0

openSUSE-RU-2017:3028-1: important: Recommended update for qemu
by maintenance＠opensuse.org 17 Nov '17

17 Nov '17

openSUSE Recommended Update: Recommended update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3028-1 Rating: important References: #1043176 #1067824 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for qemu fixes the following issues: - The fix for bsc#1043176 introduced a regression for scsi disk reads. (bsc#1067824) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1280=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): qemu-2.6.2-31.12.1 qemu-arm-2.6.2-31.12.1 qemu-arm-debuginfo-2.6.2-31.12.1 qemu-block-curl-2.6.2-31.12.1 qemu-block-curl-debuginfo-2.6.2-31.12.1 qemu-block-dmg-2.6.2-31.12.1 qemu-block-dmg-debuginfo-2.6.2-31.12.1 qemu-block-iscsi-2.6.2-31.12.1 qemu-block-iscsi-debuginfo-2.6.2-31.12.1 qemu-block-ssh-2.6.2-31.12.1 qemu-block-ssh-debuginfo-2.6.2-31.12.1 qemu-debugsource-2.6.2-31.12.1 qemu-extra-2.6.2-31.12.1 qemu-extra-debuginfo-2.6.2-31.12.1 qemu-guest-agent-2.6.2-31.12.1 qemu-guest-agent-debuginfo-2.6.2-31.12.1 qemu-kvm-2.6.2-31.12.1 qemu-lang-2.6.2-31.12.1 qemu-linux-user-2.6.2-31.12.1 qemu-linux-user-debuginfo-2.6.2-31.12.1 qemu-linux-user-debugsource-2.6.2-31.12.1 qemu-ppc-2.6.2-31.12.1 qemu-ppc-debuginfo-2.6.2-31.12.1 qemu-s390-2.6.2-31.12.1 qemu-s390-debuginfo-2.6.2-31.12.1 qemu-testsuite-2.6.2-31.12.2 qemu-tools-2.6.2-31.12.1 qemu-tools-debuginfo-2.6.2-31.12.1 qemu-x86-2.6.2-31.12.1 qemu-x86-debuginfo-2.6.2-31.12.1 - openSUSE Leap 42.2 (noarch): qemu-ipxe-1.0.0-31.12.1 qemu-seabios-1.9.1-31.12.1 qemu-sgabios-8-31.12.1 qemu-vgabios-1.9.1-31.12.1 - openSUSE Leap 42.2 (x86_64): qemu-block-rbd-2.6.2-31.12.1 qemu-block-rbd-debuginfo-2.6.2-31.12.1 References: https://bugzilla.suse.com/1043176 https://bugzilla.suse.com/1067824

1 0

openSUSE-SU-2017:3027-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 16 Nov '17

16 Nov '17

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3027-1 Rating: important References: #1061207 #1068101 Cross-References: CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: MozillaFirefox was updated to 52.5.0esr (boo#1068101) MFSA 2017-25 * CVE-2017-7828: Fixed a use-after-free of PressShell while restyling layout * CVE-2017-7830: Cross-origin URL information leak through Resource Timing API * CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5 Also fixed: - Correct plugin directory for aarch64 (boo#1061207). The wrapper script was not detecting aarch64 as a 64 bit architecture, thus used /usr/lib/browser-plugins/. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1279=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1279=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): MozillaFirefox-52.5.0-66.1 MozillaFirefox-branding-upstream-52.5.0-66.1 MozillaFirefox-buildsymbols-52.5.0-66.1 MozillaFirefox-debuginfo-52.5.0-66.1 MozillaFirefox-debugsource-52.5.0-66.1 MozillaFirefox-devel-52.5.0-66.1 MozillaFirefox-translations-common-52.5.0-66.1 MozillaFirefox-translations-other-52.5.0-66.1 - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-52.5.0-57.21.1 MozillaFirefox-branding-upstream-52.5.0-57.21.1 MozillaFirefox-buildsymbols-52.5.0-57.21.1 MozillaFirefox-debuginfo-52.5.0-57.21.1 MozillaFirefox-debugsource-52.5.0-57.21.1 MozillaFirefox-devel-52.5.0-57.21.1 MozillaFirefox-translations-common-52.5.0-57.21.1 MozillaFirefox-translations-other-52.5.0-57.21.1 References: https://www.suse.com/security/cve/CVE-2017-7826.html https://www.suse.com/security/cve/CVE-2017-7828.html https://www.suse.com/security/cve/CVE-2017-7830.html https://bugzilla.suse.com/1061207 https://bugzilla.suse.com/1068101

1 0

openSUSE-RU-2017:3023-1: Recommended update for python-kiwi
by maintenance＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3023-1 Rating: low References: #1050665 #1055542 #1065028 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update provides python-kiwi 8.33.3, which brings fixes and enhancements: - Do not require cracklib-dict-full in boot images (bsc#1065028) - Cleanup SLE12 boot image descriptions - Update documentation - Added vhdx image format support - Move to dracut for vmx and iso types - Update btrfs features required for CaaS Platform - Cleanup use of obs:// repos - Better integrate with the Open Build Service for building container images (fate#324024) - Fix vmdk descriptor file (bsc#1050665) - Include the disturl label in container images (bsc#1055542) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1278=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1278=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): dracut-kiwi-live-8.33.3-11.1 dracut-kiwi-overlay-8.33.3-11.1 kiwi-boot-requires-8.33.3-11.1 kiwi-man-pages-8.33.3-11.1 kiwi-pxeboot-8.33.3-11.1 kiwi-tools-8.33.3-11.1 kiwi-tools-debuginfo-8.33.3-11.1 python-kiwi-debugsource-8.33.3-11.1 python2-kiwi-8.33.3-11.1 python3-kiwi-8.33.3-11.1 - openSUSE Leap 42.2 (i586 x86_64): dracut-kiwi-live-8.33.3-11.1 dracut-kiwi-overlay-8.33.3-11.1 kiwi-boot-requires-8.33.3-11.1 kiwi-man-pages-8.33.3-11.1 kiwi-pxeboot-8.33.3-11.1 kiwi-tools-8.33.3-11.1 kiwi-tools-debuginfo-8.33.3-11.1 python-kiwi-debugsource-8.33.3-11.1 python2-kiwi-8.33.3-11.1 python3-kiwi-8.33.3-11.1 References: https://bugzilla.suse.com/1050665 https://bugzilla.suse.com/1055542 https://bugzilla.suse.com/1065028

1 0

openSUSE-SU-2017:3022-1: moderate: Security update for mongodb
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for mongodb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3022-1 Rating: moderate References: #1065956 Cross-References: CVE-2017-15535 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mongodb 3.4.10 fixes the following issues: Security issues fixed: - CVE-2017-15535: MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory. (boo#1065956) Bug fixes: - See release-notes for 3.4.4 - 3.4.10 changes. * https://docs.mongodb.com/manual/release-notes/3.4-changelog/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1275=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): mongodb-3.4.10-5.1 mongodb-mongoperf-3.4.10-5.1 mongodb-mongos-3.4.10-5.1 mongodb-server-3.4.10-5.1 mongodb-shell-3.4.10-5.1 References: https://www.suse.com/security/cve/CVE-2017-15535.html https://bugzilla.suse.com/1065956

1 0

openSUSE-OU-2017:3021-1: Optional update for pam
by maintenance＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Optional Update: Optional update for pam ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:3021-1 Rating: low References: #1012494 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for pam fixes the following issues: - boo#1012494: Removed root's limits from limits.conf as they are superfluous Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1272=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1272=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): pam-1.3.0-10.1 pam-debuginfo-1.3.0-10.1 pam-debugsource-1.3.0-10.1 pam-devel-1.3.0-10.1 - openSUSE Leap 42.3 (noarch): pam-doc-1.3.0-10.1 - openSUSE Leap 42.3 (x86_64): pam-32bit-1.3.0-10.1 pam-debuginfo-32bit-1.3.0-10.1 pam-devel-32bit-1.3.0-10.1 - openSUSE Leap 42.2 (i586 x86_64): pam-1.3.0-2.9.1 pam-debuginfo-1.3.0-2.9.1 pam-debugsource-1.3.0-2.9.1 pam-devel-1.3.0-2.9.1 - openSUSE Leap 42.2 (noarch): pam-doc-1.3.0-2.9.1 - openSUSE Leap 42.2 (x86_64): pam-32bit-1.3.0-2.9.1 pam-debuginfo-32bit-1.3.0-2.9.1 pam-devel-32bit-1.3.0-2.9.1 References: https://bugzilla.suse.com/1012494

1 0

openSUSE-SU-2017:3020-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3020-1 Rating: moderate References: #1054757 #1055214 #1056426 #1056429 #1057508 #1066003 Cross-References: CVE-2017-12983 CVE-2017-13134 CVE-2017-13776 CVE-2017-13777 CVE-2017-14165 CVE-2017-15930 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following security issues: - CVE-2017-13776: denial of service issue in ReadXBMImage() in a coders/xbm.c (bsc#1056429) - CVE-2017-13777: denial of service issue in ReadXBMImage() in a coders/xbm.c (bsc#1056426) - CVE-2017-13134: heap-based buffer over-read allowing DoS via crafted sfw files (bsc#1055214) - CVE-2017-15930: Specially crafted JPEG files could lead to a Null Pointer dereference and DoS (bsc#1066003) - CVE-2017-14165: Memory allocation issue may allow DoS through specially crafted files (bsc#1057508) - CVE-2017-12983: Heap-based buffer overflow could have triggered an application crash or possibly have unspecified other impact via a crafted file. (bnc#1054757) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1276=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1276=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-39.1 GraphicsMagick-debuginfo-1.3.25-39.1 GraphicsMagick-debugsource-1.3.25-39.1 GraphicsMagick-devel-1.3.25-39.1 libGraphicsMagick++-Q16-12-1.3.25-39.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-39.1 libGraphicsMagick++-devel-1.3.25-39.1 libGraphicsMagick-Q16-3-1.3.25-39.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-39.1 libGraphicsMagick3-config-1.3.25-39.1 libGraphicsMagickWand-Q16-2-1.3.25-39.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-39.1 perl-GraphicsMagick-1.3.25-39.1 perl-GraphicsMagick-debuginfo-1.3.25-39.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.39.1 GraphicsMagick-debuginfo-1.3.25-11.39.1 GraphicsMagick-debugsource-1.3.25-11.39.1 GraphicsMagick-devel-1.3.25-11.39.1 libGraphicsMagick++-Q16-12-1.3.25-11.39.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.39.1 libGraphicsMagick++-devel-1.3.25-11.39.1 libGraphicsMagick-Q16-3-1.3.25-11.39.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.39.1 libGraphicsMagick3-config-1.3.25-11.39.1 libGraphicsMagickWand-Q16-2-1.3.25-11.39.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.39.1 perl-GraphicsMagick-1.3.25-11.39.1 perl-GraphicsMagick-debuginfo-1.3.25-11.39.1 References: https://www.suse.com/security/cve/CVE-2017-12983.html https://www.suse.com/security/cve/CVE-2017-13134.html https://www.suse.com/security/cve/CVE-2017-13776.html https://www.suse.com/security/cve/CVE-2017-13777.html https://www.suse.com/security/cve/CVE-2017-14165.html https://www.suse.com/security/cve/CVE-2017-15930.html https://bugzilla.suse.com/1054757 https://bugzilla.suse.com/1055214 https://bugzilla.suse.com/1056426 https://bugzilla.suse.com/1056429 https://bugzilla.suse.com/1057508 https://bugzilla.suse.com/1066003

1 0