November 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:2991-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2991-1 Rating: important References: #1020950 #1024749 #1045460 #1050469 Cross-References: CVE-2016-7586 CVE-2016-7589 CVE-2016-7592 CVE-2016-7599 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 CVE-2017-2496 CVE-2017-2510 CVE-2017-2538 CVE-2017-2539 CVE-2017-7018 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7039 CVE-2017-7046 CVE-2017-7048 CVE-2017-7055 CVE-2017-7056 CVE-2017-7061 CVE-2017-7064 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 40 vulnerabilities is now available. Description: This update for webkit2gtk3 to version 2.18.0 fixes the following issues: These security issues were fixed: - CVE-2017-7039: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7018: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7030: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7037: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7034: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7055: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7056: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7064: An issue was fixed that allowed remote attackers to bypass intended memory-read restrictions via a crafted app (bsc#1050469). - CVE-2017-7061: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7048: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-7046: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1050469). - CVE-2017-2538: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1045460) - CVE-2017-2496: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2539: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2510: An issue was fixed that allowed remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events. - CVE-2017-2365: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2366: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2373: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2363: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2362: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2350: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2354: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749). - CVE-2017-2355: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2356: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2017-2371: An issue was fixed that allowed remote attackers to launch popups via a crafted web site (bsc#1024749) - CVE-2017-2364: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1024749) - CVE-2017-2369: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1024749) - CVE-2016-7656: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7635: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7654: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7639: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7645: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7652: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7641: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7632: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7599: An issue was fixed that allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site that used HTTP redirects (bsc#1020950) - CVE-2016-7592: An issue was fixed that allowed remote attackers to obtain sensitive information via crafted JavaScript prompts on a web site (bsc#1020950) - CVE-2016-7589: An issue was fixed that allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1020950) - CVE-2016-7623: An issue was fixed that allowed remote attackers to obtain sensitive information via a blob URL on a web site (bsc#1020950) - CVE-2016-7586: An issue was fixed that allowed remote attackers to obtain sensitive information via a crafted web site (bsc#1020950) For other non-security fixes please check the changelog. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1268=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1268=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.0-5.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.0-5.1 libwebkit2gtk-4_0-37-2.18.0-5.1 libwebkit2gtk-4_0-37-debuginfo-2.18.0-5.1 typelib-1_0-JavaScriptCore-4_0-2.18.0-5.1 typelib-1_0-WebKit2-4_0-2.18.0-5.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.0-5.1 webkit-jsc-4-2.18.0-5.1 webkit-jsc-4-debuginfo-2.18.0-5.1 webkit2gtk-4_0-injected-bundles-2.18.0-5.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.0-5.1 webkit2gtk3-debugsource-2.18.0-5.1 webkit2gtk3-devel-2.18.0-5.1 webkit2gtk3-plugin-process-gtk2-2.18.0-5.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.0-5.1 - openSUSE Leap 42.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.0-5.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.0-5.1 libwebkit2gtk-4_0-37-32bit-2.18.0-5.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.0-5.1 - openSUSE Leap 42.3 (noarch): libwebkit2gtk3-lang-2.18.0-5.1 - openSUSE Leap 42.2 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.18.0-2.3.1 libjavascriptcoregtk-4_0-18-debuginfo-2.18.0-2.3.1 libwebkit2gtk-4_0-37-2.18.0-2.3.1 libwebkit2gtk-4_0-37-debuginfo-2.18.0-2.3.1 typelib-1_0-JavaScriptCore-4_0-2.18.0-2.3.1 typelib-1_0-WebKit2-4_0-2.18.0-2.3.1 typelib-1_0-WebKit2WebExtension-4_0-2.18.0-2.3.1 webkit-jsc-4-2.18.0-2.3.1 webkit-jsc-4-debuginfo-2.18.0-2.3.1 webkit2gtk-4_0-injected-bundles-2.18.0-2.3.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.18.0-2.3.1 webkit2gtk3-debugsource-2.18.0-2.3.1 webkit2gtk3-devel-2.18.0-2.3.1 webkit2gtk3-plugin-process-gtk2-2.18.0-2.3.1 webkit2gtk3-plugin-process-gtk2-debuginfo-2.18.0-2.3.1 - openSUSE Leap 42.2 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.18.0-2.3.1 libjavascriptcoregtk-4_0-18-debuginfo-32bit-2.18.0-2.3.1 libwebkit2gtk-4_0-37-32bit-2.18.0-2.3.1 libwebkit2gtk-4_0-37-debuginfo-32bit-2.18.0-2.3.1 - openSUSE Leap 42.2 (noarch): libwebkit2gtk3-lang-2.18.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-7586.html https://www.suse.com/security/cve/CVE-2016-7589.html https://www.suse.com/security/cve/CVE-2016-7592.html https://www.suse.com/security/cve/CVE-2016-7599.html https://www.suse.com/security/cve/CVE-2016-7623.html https://www.suse.com/security/cve/CVE-2016-7632.html https://www.suse.com/security/cve/CVE-2016-7635.html https://www.suse.com/security/cve/CVE-2016-7639.html https://www.suse.com/security/cve/CVE-2016-7641.html https://www.suse.com/security/cve/CVE-2016-7645.html https://www.suse.com/security/cve/CVE-2016-7652.html https://www.suse.com/security/cve/CVE-2016-7654.html https://www.suse.com/security/cve/CVE-2016-7656.html https://www.suse.com/security/cve/CVE-2017-2350.html https://www.suse.com/security/cve/CVE-2017-2354.html https://www.suse.com/security/cve/CVE-2017-2355.html https://www.suse.com/security/cve/CVE-2017-2356.html https://www.suse.com/security/cve/CVE-2017-2362.html https://www.suse.com/security/cve/CVE-2017-2363.html https://www.suse.com/security/cve/CVE-2017-2364.html https://www.suse.com/security/cve/CVE-2017-2365.html https://www.suse.com/security/cve/CVE-2017-2366.html https://www.suse.com/security/cve/CVE-2017-2369.html https://www.suse.com/security/cve/CVE-2017-2371.html https://www.suse.com/security/cve/CVE-2017-2373.html https://www.suse.com/security/cve/CVE-2017-2496.html https://www.suse.com/security/cve/CVE-2017-2510.html https://www.suse.com/security/cve/CVE-2017-2538.html https://www.suse.com/security/cve/CVE-2017-2539.html https://www.suse.com/security/cve/CVE-2017-7018.html https://www.suse.com/security/cve/CVE-2017-7030.html https://www.suse.com/security/cve/CVE-2017-7034.html https://www.suse.com/security/cve/CVE-2017-7037.html https://www.suse.com/security/cve/CVE-2017-7039.html https://www.suse.com/security/cve/CVE-2017-7046.html https://www.suse.com/security/cve/CVE-2017-7048.html https://www.suse.com/security/cve/CVE-2017-7055.html https://www.suse.com/security/cve/CVE-2017-7056.html https://www.suse.com/security/cve/CVE-2017-7061.html https://www.suse.com/security/cve/CVE-2017-7064.html https://bugzilla.suse.com/1020950 https://bugzilla.suse.com/1024749 https://bugzilla.suse.com/1045460 https://bugzilla.suse.com/1050469

1 0

openSUSE-RU-2017:2990-1: moderate: Recommended update for drbd
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for drbd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2990-1 Rating: moderate References: #1005578 #1006176 #1025089 #1025585 #1037109 #983633 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update provides DRBD 9.0.6, which brings the following fixes: - Fix resync finished with bits set (bsc#1025089) - Fix drbdmeta propagation of full bitmaps (bsc#1037109) - Fixed error handling in del_path - Fix multiple issues with concurrent two-phase-commits - Reorganize data structures of receiver for efficiency - Allow multiple updates per AL-transaction on a secondary - No longer allocate bitmap-slots on diskfull nodes for diskless node - Fix bugs in the try_become_up_to_date() logic - Fix two phase-commits when the nodes form a circular structure - Fix the resync after online grow - Fix two-phase-commits when the nodes build a loop - A number of fixes to speed up establishing of connections - Create a new current UUID when the peer's disk breaks - Restored the new-current-uuid --clear-bitmap functionality - Empty flush requests no longer trigger a bogus "IO ERROR" log entry. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): drbd-9.0.6+git.08cda19-2.3.1 drbd-debugsource-9.0.6+git.08cda19-2.3.1 drbd-kmp-default-9.0.6+git.08cda19_k4.4.92_18.36-2.3.1 drbd-kmp-default-debuginfo-9.0.6+git.08cda19_k4.4.92_18.36-2.3.1 References: https://bugzilla.suse.com/1005578 https://bugzilla.suse.com/1006176 https://bugzilla.suse.com/1025089 https://bugzilla.suse.com/1025585 https://bugzilla.suse.com/1037109 https://bugzilla.suse.com/983633

1 0

openSUSE-RU-2017:2988-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2988-1 Rating: moderate References: #1000946 #1016920 #1049975 #1051349 #978935 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1262=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): kio-5.32.0-5.1 kio-core-5.32.0-5.1 kio-core-debuginfo-5.32.0-5.1 kio-debuginfo-5.32.0-5.1 kio-debugsource-5.32.0-5.1 kio-devel-5.32.0-5.1 kio-devel-debuginfo-5.32.0-5.1 - openSUSE Leap 42.3 (noarch): kio-lang-5.32.0-5.1 - openSUSE Leap 42.3 (x86_64): kio-32bit-5.32.0-5.1 kio-core-32bit-5.32.0-5.1 kio-core-debuginfo-32bit-5.32.0-5.1 kio-debuginfo-32bit-5.32.0-5.1 kio-devel-32bit-5.32.0-5.1 kio-devel-debuginfo-32bit-5.32.0-5.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/978935

1 0

openSUSE-FU-2017:2986-1: moderate: Update to add ClusterShell
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Feature Update: Update to add ClusterShell ______________________________________________________________________________ Announcement ID: openSUSE-FU-2017:2986-1 Rating: moderate References: #1066278 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one feature fix can now be installed. Description: This update makes available ClusterShell 1.8. Clustershell is a set of tools for cluster and server farm system administation. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1260=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): clustershell-1.8-2.1 python2-clustershell-1.8-2.1 python3-clustershell-1.8-2.1 References: https://bugzilla.suse.com/1066278

1 0

openSUSE-SU-2017:2984-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2984-1 Rating: moderate References: #1064980 Cross-References: CVE-2016-10517 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis to version 4.0.2 fixes the following issues: - CVE-2016-8339: CONFIG SET client-output-buffer-limit Code Execution Vulnerability (boo#1002351) The following upstream changes are included: - SLOWLOG now logs the offending client name and address - The modules native data types RDB format changed. - The AOF check utility is now able to deal with RDB preambles. - GEORADIUS_RO and GEORADIUSBYMEMBER_RO variants, not supporting the STORE option, were added in order to allow read-only scaling of such queries. - HSET is now variadic, and HMSET is considered deprecated - GEORADIUS huge radius (>= ~6000 km) corner cases fixed - HyperLogLog commands no longer crash on certain input (non HLL) strings. - Fixed SLAVEOF inside MULTI/EXEC blocks. - TCP binding bug fixed when only certain addresses were available for a given por - MIGRATE could crash the server after a socket error Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1258=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): redis-4.0.2-9.1 redis-debuginfo-4.0.2-9.1 redis-debugsource-4.0.2-9.1 References: https://www.suse.com/security/cve/CVE-2016-10517.html https://bugzilla.suse.com/1064980

1 0

openSUSE-FU-2017:2982-1: moderate: Update to add ClusterShell
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Feature Update: Update to add ClusterShell ______________________________________________________________________________ Announcement ID: openSUSE-FU-2017:2982-1 Rating: moderate References: #1066278 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one feature fix can now be installed. Description: This update makes available ClusterShell 1.8. Clustershell is a set of tools for cluster and server farm system administation. Patch Instructions: To install this openSUSE Feature Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1260=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1260=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): clustershell-1.8-2.1 python2-clustershell-1.8-2.1 python3-clustershell-1.8-2.1 - openSUSE Leap 42.2 (noarch): clustershell-1.8-2.1 python2-clustershell-1.8-2.1 python3-clustershell-1.8-2.1 References: https://bugzilla.suse.com/1066278

1 0

openSUSE-RU-2017:2980-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2980-1 Rating: moderate References: #1000946 #1016920 #1030145 #1049975 #1051349 #969768 #978935 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) - Prevent /tmp getting filled up because full directories are copied to it when generating folder previews for remote locations and the trash (kde#208625, boo#969768) - Dolphin did not displaying symlinks under certain circumstances (boo#1030145, kde#369275) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1263=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kio-5.26.0-8.3.1 kio-core-5.26.0-8.3.1 kio-core-debuginfo-5.26.0-8.3.1 kio-debuginfo-5.26.0-8.3.1 kio-debugsource-5.26.0-8.3.1 kio-devel-5.26.0-8.3.1 kio-devel-debuginfo-5.26.0-8.3.1 - openSUSE Leap 42.2 (noarch): kio-lang-5.26.0-8.3.1 - openSUSE Leap 42.2 (x86_64): kio-32bit-5.26.0-8.3.1 kio-core-32bit-5.26.0-8.3.1 kio-core-debuginfo-32bit-5.26.0-8.3.1 kio-debuginfo-32bit-5.26.0-8.3.1 kio-devel-32bit-5.26.0-8.3.1 kio-devel-debuginfo-32bit-5.26.0-8.3.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1030145 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/969768 https://bugzilla.suse.com/978935

1 0

openSUSE-SU-2017:2979-1: moderate: Security update for shadow
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2979-1 Rating: moderate References: #1023895 #1052261 #980486 Cross-References: CVE-2017-12424 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for shadow fixes several issues. This security issue was fixed: - CVE-2017-12424: The newusers tool could have been forced to manipulate internal data structures in ways unintended by the authors. Malformed input may have lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors (bsc#1052261). These non-security issues were fixed: - bsc#1023895: Fixed man page to not contain invalid options and also prevent warnings when using these options in certain settings - bsc#980486: Reset user in /var/log/tallylog because of the usage of pam_tally2 This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1265=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1265=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): shadow-4.2.1-10.1 shadow-debuginfo-4.2.1-10.1 shadow-debugsource-4.2.1-10.1 - openSUSE Leap 42.2 (i586 x86_64): shadow-4.2.1-6.6.1 shadow-debuginfo-4.2.1-6.6.1 shadow-debugsource-4.2.1-6.6.1 References: https://www.suse.com/security/cve/CVE-2017-12424.html https://bugzilla.suse.com/1023895 https://bugzilla.suse.com/1052261 https://bugzilla.suse.com/980486

1 0

openSUSE-SU-2017:2978-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2978-1 Rating: moderate References: #1008037 #1008038 #1019021 #1038785 #1065872 Cross-References: CVE-2016-8614 CVE-2016-8628 CVE-2016-9587 CVE-2017-7481 CVE-2017-7550 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ansible to version 2.4.1.0 fixes the following vulnerabilities: - CVE-2017-7481: Security issue with lookup return not tainting the jinja2 environment (bsc#1038785) - CVE-2016-9587: host to controller command execution vulnerability (bsc#1019021) - CVE-2016-8628: Command injection by compromised server via fact variables (bsc#1008037) - CVE-2016-8614: Improper verification of key fingerprints in apt_key module (bsc#1008038) - CVE-2017-7550: jenkins_plugin module may have exposed passwords in remote host logs (bsc#1065872) This update also contains a number of upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1259=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): ansible-2.4.1.0-6.1 References: https://www.suse.com/security/cve/CVE-2016-8614.html https://www.suse.com/security/cve/CVE-2016-8628.html https://www.suse.com/security/cve/CVE-2016-9587.html https://www.suse.com/security/cve/CVE-2017-7481.html https://www.suse.com/security/cve/CVE-2017-7550.html https://bugzilla.suse.com/1008037 https://bugzilla.suse.com/1008038 https://bugzilla.suse.com/1019021 https://bugzilla.suse.com/1038785 https://bugzilla.suse.com/1065872

1 0

openSUSE-RU-2017:2977-1: moderate: Recommended update for rpmlint
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2977-1 Rating: moderate References: #846337 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rpmlint fixes the following issues: - Whitelist NetworkManager-l2tp usage as DBUS service (boo#846337) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1261=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): rpmlint-mini-1.8-6.2 rpmlint-mini-debuginfo-1.8-6.2 rpmlint-mini-debugsource-1.8-6.2 rpmlint-tests-debugsource-84.87+git20170418.092177d-16.1 - openSUSE Leap 42.3 (noarch): rpmlint-1.8-16.1 References: https://bugzilla.suse.com/846337

1 0