November 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:3019-1: moderate: Recommended update for apparmor
by maintenance＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Recommended Update: Recommended update for apparmor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3019-1 Rating: moderate References: #1057900 #1061195 #1062244 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for apparmor to version 2.10.3 fixes the following issues: - issues with NIS/YP logins (boo#1062244) - downgrading/converting of 'unix' rules to 'network unix' rules was broken in apparmor_parser (boo#1061195) The following profiles were updated: - dovecot - traceroute (boo#1057900) - samba - postfix - several abstractions Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1273=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1273=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): apache2-mod_apparmor-2.10.3-16.1 apache2-mod_apparmor-debuginfo-2.10.3-16.1 apparmor-debugsource-2.10.3-16.1 apparmor-parser-2.10.3-16.1 apparmor-parser-debuginfo-2.10.3-16.1 libapparmor-devel-2.10.3-16.1 libapparmor1-2.10.3-16.1 libapparmor1-debuginfo-2.10.3-16.1 pam_apparmor-2.10.3-16.1 pam_apparmor-debuginfo-2.10.3-16.1 perl-apparmor-2.10.3-16.1 perl-apparmor-debuginfo-2.10.3-16.1 python3-apparmor-2.10.3-16.1 python3-apparmor-debuginfo-2.10.3-16.1 ruby-apparmor-2.10.3-16.1 ruby-apparmor-debuginfo-2.10.3-16.1 - openSUSE Leap 42.3 (noarch): apparmor-abstractions-2.10.3-16.1 apparmor-docs-2.10.3-16.1 apparmor-parser-lang-2.10.3-16.1 apparmor-profiles-2.10.3-16.1 apparmor-utils-2.10.3-16.1 apparmor-utils-lang-2.10.3-16.1 - openSUSE Leap 42.3 (x86_64): libapparmor1-32bit-2.10.3-16.1 libapparmor1-debuginfo-32bit-2.10.3-16.1 pam_apparmor-32bit-2.10.3-16.1 pam_apparmor-debuginfo-32bit-2.10.3-16.1 - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_apparmor-2.10.3-12.6.1 apache2-mod_apparmor-debuginfo-2.10.3-12.6.1 apparmor-debugsource-2.10.3-12.6.1 apparmor-parser-2.10.3-12.6.1 apparmor-parser-debuginfo-2.10.3-12.6.1 libapparmor-devel-2.10.3-12.6.1 libapparmor1-2.10.3-12.6.1 libapparmor1-debuginfo-2.10.3-12.6.1 pam_apparmor-2.10.3-12.6.1 pam_apparmor-debuginfo-2.10.3-12.6.1 perl-apparmor-2.10.3-12.6.1 perl-apparmor-debuginfo-2.10.3-12.6.1 python3-apparmor-2.10.3-12.6.1 python3-apparmor-debuginfo-2.10.3-12.6.1 ruby-apparmor-2.10.3-12.6.1 ruby-apparmor-debuginfo-2.10.3-12.6.1 - openSUSE Leap 42.2 (noarch): apparmor-abstractions-2.10.3-12.6.1 apparmor-docs-2.10.3-12.6.1 apparmor-parser-lang-2.10.3-12.6.1 apparmor-profiles-2.10.3-12.6.1 apparmor-utils-2.10.3-12.6.1 apparmor-utils-lang-2.10.3-12.6.1 - openSUSE Leap 42.2 (x86_64): libapparmor1-32bit-2.10.3-12.6.1 libapparmor1-debuginfo-32bit-2.10.3-12.6.1 pam_apparmor-32bit-2.10.3-12.6.1 pam_apparmor-debuginfo-32bit-2.10.3-12.6.1 References: https://bugzilla.suse.com/1057900 https://bugzilla.suse.com/1061195 https://bugzilla.suse.com/1062244

1 0

openSUSE-SU-2017:3018-1: moderate: Security update for mongodb
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for mongodb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3018-1 Rating: moderate References: #1065956 Cross-References: CVE-2017-15535 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mongodb 3.4.10 fixes the following issues: Security issues fixed: - CVE-2017-15535: MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory. (boo#1065956) Bug fixes: - See release-notes for 3.4.4 - 3.4.10 changes. * https://docs.mongodb.com/manual/release-notes/3.4-changelog/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1275=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): mongodb-3.4.10-3.1 mongodb-debugsource-3.4.10-3.1 mongodb-mongoperf-3.4.10-3.1 mongodb-mongoperf-debuginfo-3.4.10-3.1 mongodb-mongos-3.4.10-3.1 mongodb-mongos-debuginfo-3.4.10-3.1 mongodb-server-3.4.10-3.1 mongodb-server-debuginfo-3.4.10-3.1 mongodb-shell-3.4.10-3.1 mongodb-shell-debuginfo-3.4.10-3.1 References: https://www.suse.com/security/cve/CVE-2017-15535.html https://bugzilla.suse.com/1065956

1 0

openSUSE-SU-2017:3017-1: moderate: Security update for shadowsocks-libev
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for shadowsocks-libev ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3017-1 Rating: moderate References: #1065619 Cross-References: CVE-2017-15924 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadowsocks-libev fixes the following issues: Security issue fixed: - CVE-2017-15924: In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions. (boo#1065619) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1274=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): shadowsocks-libev-2.5.6-3.1 shadowsocks-libev-debuginfo-2.5.6-3.1 shadowsocks-libev-debugsource-2.5.6-3.1 shadowsocks-libev-devel-2.5.6-3.1 - openSUSE Leap 42.3 (noarch): shadowsocks-libev-doc-2.5.6-3.1 References: https://www.suse.com/security/cve/CVE-2017-15924.html https://bugzilla.suse.com/1065619

1 0

openSUSE-SU-2017:3016-1: important: Security update for snack
by opensuse-security＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Security Update: Security update for snack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3016-1 Rating: important References: #793860 Cross-References: CVE-2012-6303 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for snack fixes the following issues: Security issue fixed: - CVE-2012-6303: Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file. (bnc#793860) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1277=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1277=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): snack-2.2.10-220.1 snack-debuginfo-2.2.10-220.1 snack-debugsource-2.2.10-220.1 - openSUSE Leap 42.2 (i586 x86_64): snack-2.2.10-217.3.1 snack-debuginfo-2.2.10-217.3.1 snack-debugsource-2.2.10-217.3.1 References: https://www.suse.com/security/cve/CVE-2012-6303.html https://bugzilla.suse.com/793860

1 0

openSUSE-RU-2017:3015-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 15 Nov '17

15 Nov '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3015-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - November 13 2017 database refresh This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1271=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201711130006-54.103.1 References:

1 0

openSUSE-SU-2017:2999-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 12 Nov '17

12 Nov '17

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2999-1 Rating: moderate References: #1049379 #1050135 #1052249 #1052253 #1052545 #1054924 #1055219 #1055430 #1061873 Cross-References: CVE-2016-7530 CVE-2017-11446 CVE-2017-11534 CVE-2017-12428 CVE-2017-12431 CVE-2017-12433 CVE-2017-13133 CVE-2017-13139 CVE-2017-15033 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: Security issues fixed: * CVE-2017-15033: A denial of service attack (memory leak) was fixed in ReadYUVImage in coders/yuv.c [bsc#1061873] * CVE-2017-11446: An infinite loop in ReadPESImage was fixed. (bsc#1049379) * CVE-2017-12433: A memory leak in ReadPESImage in coders/pes.c was fixed. (bsc#1052545) * CVE-2017-12428: A memory leak in ReadWMFImage in coders/wmf.c was fixed. (bsc#1052249) * CVE-2017-12431: A use-after-free in ReadWMFImage was fixed. (bsc#1052253) * CVE-2017-11534: A memory leak in the lite_font_map() in coders/wmf.c was fixed. (bsc#1050135) * CVE-2017-13133: A memory exhaustion in load_level function in coders/xcf.c was fixed. (bsc#1055219) * CVE-2017-13139: A out-of-bounds read in the ReadOneMNGImage was fixed. (bsc#1055430) This update also reverts an incorrect fix for CVE-2016-7530 [bsc#1054924]. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1270=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1270=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ImageMagick-6.8.8.1-37.1 ImageMagick-debuginfo-6.8.8.1-37.1 ImageMagick-debugsource-6.8.8.1-37.1 ImageMagick-devel-6.8.8.1-37.1 ImageMagick-extra-6.8.8.1-37.1 ImageMagick-extra-debuginfo-6.8.8.1-37.1 libMagick++-6_Q16-3-6.8.8.1-37.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-37.1 libMagick++-devel-6.8.8.1-37.1 libMagickCore-6_Q16-1-6.8.8.1-37.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-37.1 libMagickWand-6_Q16-1-6.8.8.1-37.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-37.1 perl-PerlMagick-6.8.8.1-37.1 perl-PerlMagick-debuginfo-6.8.8.1-37.1 - openSUSE Leap 42.3 (noarch): ImageMagick-doc-6.8.8.1-37.1 - openSUSE Leap 42.3 (x86_64): ImageMagick-devel-32bit-6.8.8.1-37.1 libMagick++-6_Q16-3-32bit-6.8.8.1-37.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-37.1 libMagick++-devel-32bit-6.8.8.1-37.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-37.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-37.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-37.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-37.1 - openSUSE Leap 42.2 (i586 x86_64): ImageMagick-6.8.8.1-30.9.1 ImageMagick-debuginfo-6.8.8.1-30.9.1 ImageMagick-debugsource-6.8.8.1-30.9.1 ImageMagick-devel-6.8.8.1-30.9.1 ImageMagick-extra-6.8.8.1-30.9.1 ImageMagick-extra-debuginfo-6.8.8.1-30.9.1 libMagick++-6_Q16-3-6.8.8.1-30.9.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-30.9.1 libMagick++-devel-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-30.9.1 perl-PerlMagick-6.8.8.1-30.9.1 perl-PerlMagick-debuginfo-6.8.8.1-30.9.1 - openSUSE Leap 42.2 (x86_64): ImageMagick-devel-32bit-6.8.8.1-30.9.1 libMagick++-6_Q16-3-32bit-6.8.8.1-30.9.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-30.9.1 libMagick++-devel-32bit-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-30.9.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-30.9.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-30.9.1 - openSUSE Leap 42.2 (noarch): ImageMagick-doc-6.8.8.1-30.9.1 References: https://www.suse.com/security/cve/CVE-2016-7530.html https://www.suse.com/security/cve/CVE-2017-11446.html https://www.suse.com/security/cve/CVE-2017-11534.html https://www.suse.com/security/cve/CVE-2017-12428.html https://www.suse.com/security/cve/CVE-2017-12431.html https://www.suse.com/security/cve/CVE-2017-12433.html https://www.suse.com/security/cve/CVE-2017-13133.html https://www.suse.com/security/cve/CVE-2017-13139.html https://www.suse.com/security/cve/CVE-2017-15033.html https://bugzilla.suse.com/1049379 https://bugzilla.suse.com/1050135 https://bugzilla.suse.com/1052249 https://bugzilla.suse.com/1052253 https://bugzilla.suse.com/1052545 https://bugzilla.suse.com/1054924 https://bugzilla.suse.com/1055219 https://bugzilla.suse.com/1055430 https://bugzilla.suse.com/1061873

1 0

openSUSE-SU-2017:2998-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 12 Nov '17

12 Nov '17

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2998-1 Rating: important References: #1032647 #1052009 #1064069 #1064070 #1064071 #1064072 #1064073 #1064075 #1064077 #1064078 #1064079 #1064080 #1064081 #1064082 #1064083 #1064084 #1064085 #1064086 Cross-References: CVE-2016-10165 CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: - Update to version jdk8u151 (icedtea 3.6.0) Security issues fixed: - CVE-2017-10274: Handle smartcard clean up better (bsc#1064071) - CVE-2017-10281: Better queuing priorities (bsc#1064072) - CVE-2017-10285: Unreferenced references (bsc#1064073) - CVE-2017-10295: Better URL connections (bsc#1064075) - CVE-2017-10388: Correct Kerberos ticket grants (bsc#1064086) - CVE-2017-10346: Better invokespecial checks (bsc#1064078) - CVE-2017-10350: Better Base Exceptions (bsc#1064082) - CVE-2017-10347: Better timezone processing (bsc#1064079) - CVE-2017-10349: Better X processing (bsc#1064081) - CVE-2017-10345: Better keystore handling (bsc#1064077) - CVE-2017-10348: Better processing of unresolved permissions (bsc#1064080) - CVE-2017-10357: Process Proxy presentation (bsc#1064085) - CVE-2017-10355: More stable connection processing (bsc#1064083) - CVE-2017-10356: Update storage implementations (bsc#1064084) - CVE-2016-10165: Improve CMS header processing (bsc#1064069) - CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843: Upgrade compression library (bsc#1064070) Bug fixes: - Fix bsc#1032647, bsc#1052009 with btrfs subvolumes and overlayfs This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1269=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1269=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_8_0-openjdk-1.8.0.151-18.1 java-1_8_0-openjdk-accessibility-1.8.0.151-18.1 java-1_8_0-openjdk-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-debugsource-1.8.0.151-18.1 java-1_8_0-openjdk-demo-1.8.0.151-18.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-devel-1.8.0.151-18.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-headless-1.8.0.151-18.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.151-18.1 java-1_8_0-openjdk-src-1.8.0.151-18.1 - openSUSE Leap 42.3 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.151-18.1 - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.151-10.18.2 java-1_8_0-openjdk-accessibility-1.8.0.151-10.18.2 java-1_8_0-openjdk-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-debugsource-1.8.0.151-10.18.2 java-1_8_0-openjdk-demo-1.8.0.151-10.18.2 java-1_8_0-openjdk-demo-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-devel-1.8.0.151-10.18.2 java-1_8_0-openjdk-devel-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-headless-1.8.0.151-10.18.2 java-1_8_0-openjdk-headless-debuginfo-1.8.0.151-10.18.2 java-1_8_0-openjdk-src-1.8.0.151-10.18.2 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.151-10.18.2 References: https://www.suse.com/security/cve/CVE-2016-10165.html https://www.suse.com/security/cve/CVE-2016-9840.html https://www.suse.com/security/cve/CVE-2016-9841.html https://www.suse.com/security/cve/CVE-2016-9842.html https://www.suse.com/security/cve/CVE-2016-9843.html https://www.suse.com/security/cve/CVE-2017-10274.html https://www.suse.com/security/cve/CVE-2017-10281.html https://www.suse.com/security/cve/CVE-2017-10285.html https://www.suse.com/security/cve/CVE-2017-10295.html https://www.suse.com/security/cve/CVE-2017-10345.html https://www.suse.com/security/cve/CVE-2017-10346.html https://www.suse.com/security/cve/CVE-2017-10347.html https://www.suse.com/security/cve/CVE-2017-10348.html https://www.suse.com/security/cve/CVE-2017-10349.html https://www.suse.com/security/cve/CVE-2017-10350.html https://www.suse.com/security/cve/CVE-2017-10355.html https://www.suse.com/security/cve/CVE-2017-10356.html https://www.suse.com/security/cve/CVE-2017-10357.html https://www.suse.com/security/cve/CVE-2017-10388.html https://bugzilla.suse.com/1032647 https://bugzilla.suse.com/1052009 https://bugzilla.suse.com/1064069 https://bugzilla.suse.com/1064070 https://bugzilla.suse.com/1064071 https://bugzilla.suse.com/1064072 https://bugzilla.suse.com/1064073 https://bugzilla.suse.com/1064075 https://bugzilla.suse.com/1064077 https://bugzilla.suse.com/1064078 https://bugzilla.suse.com/1064079 https://bugzilla.suse.com/1064080 https://bugzilla.suse.com/1064081 https://bugzilla.suse.com/1064082 https://bugzilla.suse.com/1064083 https://bugzilla.suse.com/1064084 https://bugzilla.suse.com/1064085 https://bugzilla.suse.com/1064086

1 0

openSUSE-SU-2017:2994-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2994-1 Rating: moderate References: #1064980 Cross-References: CVE-2016-10517 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis to version 4.0.2 fixes the following issues: - CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability (boo#1002351) The following upstream changes are included: - SLOWLOG now logs the offending client name and address - The modules native data types RDB format changed. - The AOF check utility is now able to deal with RDB preambles. - GEORADIUS_RO and GEORADIUSBYMEMBER_RO variants, not supporting the STORE option, were added in order to allow read-only scaling of such queries. - HSET is now variadic, and HMSET is considered deprecated - GEORADIUS huge radius (>= ~6000 km) corner cases fixed - HyperLogLog commands no longer crash on certain input (non HLL) strings. - Fixed SLAVEOF inside MULTI/EXEC blocks. - TCP binding bug fixed when only certain addresses were available for a given por - MIGRATE could crash the server after a socket error Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1258=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1258=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): redis-4.0.2-11.1 redis-debuginfo-4.0.2-11.1 redis-debugsource-4.0.2-11.1 - openSUSE Leap 42.2 (i586 x86_64): redis-4.0.2-8.3.1 redis-debuginfo-4.0.2-8.3.1 redis-debugsource-4.0.2-8.3.1 References: https://www.suse.com/security/cve/CVE-2016-10517.html https://bugzilla.suse.com/1064980

1 0

openSUSE-SU-2017:2993-1: important: Security update for krb5
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2993-1 Rating: important References: #1065274 Cross-References: CVE-2017-15088 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for krb5 fixes the following securitz issueÖ - CVE-2017-15088: A buffer overflow in get_matching_data() was fixed that could under specific circumstances be used to execute code (bsc#1065274) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1266=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1266=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): krb5-1.12.5-12.1 krb5-client-1.12.5-12.1 krb5-client-debuginfo-1.12.5-12.1 krb5-debuginfo-1.12.5-12.1 krb5-debugsource-1.12.5-12.1 krb5-devel-1.12.5-12.1 krb5-doc-1.12.5-12.1 krb5-mini-1.12.5-12.1 krb5-mini-debuginfo-1.12.5-12.1 krb5-mini-debugsource-1.12.5-12.1 krb5-mini-devel-1.12.5-12.1 krb5-plugin-kdb-ldap-1.12.5-12.1 krb5-plugin-kdb-ldap-debuginfo-1.12.5-12.1 krb5-plugin-preauth-otp-1.12.5-12.1 krb5-plugin-preauth-otp-debuginfo-1.12.5-12.1 krb5-plugin-preauth-pkinit-1.12.5-12.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.5-12.1 krb5-server-1.12.5-12.1 krb5-server-debuginfo-1.12.5-12.1 - openSUSE Leap 42.3 (x86_64): krb5-32bit-1.12.5-12.1 krb5-debuginfo-32bit-1.12.5-12.1 krb5-devel-32bit-1.12.5-12.1 - openSUSE Leap 42.2 (i586 x86_64): krb5-1.12.5-6.6.1 krb5-client-1.12.5-6.6.1 krb5-client-debuginfo-1.12.5-6.6.1 krb5-debuginfo-1.12.5-6.6.1 krb5-debugsource-1.12.5-6.6.1 krb5-devel-1.12.5-6.6.1 krb5-doc-1.12.5-6.6.1 krb5-mini-1.12.5-6.6.1 krb5-mini-debuginfo-1.12.5-6.6.1 krb5-mini-debugsource-1.12.5-6.6.1 krb5-mini-devel-1.12.5-6.6.1 krb5-plugin-kdb-ldap-1.12.5-6.6.1 krb5-plugin-kdb-ldap-debuginfo-1.12.5-6.6.1 krb5-plugin-preauth-otp-1.12.5-6.6.1 krb5-plugin-preauth-otp-debuginfo-1.12.5-6.6.1 krb5-plugin-preauth-pkinit-1.12.5-6.6.1 krb5-plugin-preauth-pkinit-debuginfo-1.12.5-6.6.1 krb5-server-1.12.5-6.6.1 krb5-server-debuginfo-1.12.5-6.6.1 - openSUSE Leap 42.2 (x86_64): krb5-32bit-1.12.5-6.6.1 krb5-debuginfo-32bit-1.12.5-6.6.1 krb5-devel-32bit-1.12.5-6.6.1 References: https://www.suse.com/security/cve/CVE-2017-15088.html https://bugzilla.suse.com/1065274

1 0

openSUSE-RU-2017:2992-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2992-1 Rating: moderate References: #1000946 #1016920 #1049975 #1051349 #978935 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1262=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.32.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.32.0-5.1 kio-core-5.32.0-5.1 kio-core-debuginfo-5.32.0-5.1 kio-debuginfo-5.32.0-5.1 kio-debugsource-5.32.0-5.1 kio-devel-5.32.0-5.1 kio-devel-debuginfo-5.32.0-5.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/978935

1 0