November 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:2976-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2976-1 Rating: moderate References: #1008037 #1008038 #1019021 #1038785 #1065872 Cross-References: CVE-2016-8614 CVE-2016-8628 CVE-2016-9587 CVE-2017-7481 CVE-2017-7550 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ansible to version 2.4.1.0 fixes the following vulnerabilities: - CVE-2017-7481: Security issue with lookup return not tainting the jinja2 environment (bsc#1038785) - CVE-2016-9587: host to controller command execution vulnerability (bsc#1019021) - CVE-2016-8628: Command injection by compromised server via fact variables (bsc#1008037) - CVE-2016-8614: Improper verification of key fingerprints in apt_key module (bsc#1008038) - CVE-2017-7550: jenkins_plugin module may have exposed passwords in remote host logs (bsc#1065872) This update also contains a number of upstream bug fixes and improvements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1259=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1259=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): ansible-2.4.1.0-6.1 - openSUSE Leap 42.2 (noarch): ansible-2.4.1.0-2.4.1 References: https://www.suse.com/security/cve/CVE-2016-8614.html https://www.suse.com/security/cve/CVE-2016-8628.html https://www.suse.com/security/cve/CVE-2016-9587.html https://www.suse.com/security/cve/CVE-2017-7481.html https://www.suse.com/security/cve/CVE-2017-7550.html https://bugzilla.suse.com/1008037 https://bugzilla.suse.com/1008038 https://bugzilla.suse.com/1019021 https://bugzilla.suse.com/1038785 https://bugzilla.suse.com/1065872

1 0

openSUSE-SU-2017:2975-1: moderate: Security update for virtualbox
by opensuse-security＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2975-1 Rating: moderate References: #1060072 #1064200 #1066488 Cross-References: CVE-2017-10392 CVE-2017-10407 CVE-2017-10408 CVE-2017-10428 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for virtualbox fixes the following issues: - CVE-2017-10392: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10407: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10408: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and deny service - CVE-2017-10428: A local user can exploit a flaw in the Oracle VM VirtualBox Core component to partially access data, partially modify data, and partially deny service The following packaging changes are included: - Further to usage of vboxdrv if virtualbox-qt is not installed: updates to vboxdrv.sh (boo#1060072) - The virtualbox package no longer requires libX11, an library module files were moved to virtualbox-qt This update also contains all upstream improvements in the 5.1.30 release, including: - Fix for double mouse cursor when using mouse integration without Guest Additions. - Translation updates Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1267=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1267=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): python-virtualbox-5.1.30-39.1 python-virtualbox-debuginfo-5.1.30-39.1 virtualbox-5.1.30-39.1 virtualbox-debuginfo-5.1.30-39.1 virtualbox-debugsource-5.1.30-39.1 virtualbox-devel-5.1.30-39.1 virtualbox-guest-kmp-default-5.1.30_k4.4.92_31-39.1 virtualbox-guest-kmp-default-debuginfo-5.1.30_k4.4.92_31-39.1 virtualbox-guest-tools-5.1.30-39.1 virtualbox-guest-tools-debuginfo-5.1.30-39.1 virtualbox-guest-x11-5.1.30-39.1 virtualbox-guest-x11-debuginfo-5.1.30-39.1 virtualbox-host-kmp-default-5.1.30_k4.4.92_31-39.1 virtualbox-host-kmp-default-debuginfo-5.1.30_k4.4.92_31-39.1 virtualbox-qt-5.1.30-39.1 virtualbox-qt-debuginfo-5.1.30-39.1 virtualbox-vnc-5.1.30-39.1 virtualbox-websrv-5.1.30-39.1 virtualbox-websrv-debuginfo-5.1.30-39.1 - openSUSE Leap 42.3 (noarch): virtualbox-guest-desktop-icons-5.1.30-39.1 virtualbox-guest-source-5.1.30-39.1 virtualbox-host-source-5.1.30-39.1 - openSUSE Leap 42.2 (x86_64): python-virtualbox-5.1.30-19.46.1 python-virtualbox-debuginfo-5.1.30-19.46.1 virtualbox-5.1.30-19.46.1 virtualbox-debuginfo-5.1.30-19.46.1 virtualbox-debugsource-5.1.30-19.46.1 virtualbox-devel-5.1.30-19.46.1 virtualbox-guest-kmp-default-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-guest-kmp-default-debuginfo-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-guest-tools-5.1.30-19.46.1 virtualbox-guest-tools-debuginfo-5.1.30-19.46.1 virtualbox-guest-x11-5.1.30-19.46.1 virtualbox-guest-x11-debuginfo-5.1.30-19.46.1 virtualbox-host-kmp-default-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-host-kmp-default-debuginfo-5.1.30_k4.4.92_18.36-19.46.1 virtualbox-qt-5.1.30-19.46.1 virtualbox-qt-debuginfo-5.1.30-19.46.1 virtualbox-vnc-5.1.30-19.46.1 virtualbox-websrv-5.1.30-19.46.1 virtualbox-websrv-debuginfo-5.1.30-19.46.1 - openSUSE Leap 42.2 (noarch): virtualbox-guest-desktop-icons-5.1.30-19.46.1 virtualbox-guest-source-5.1.30-19.46.1 virtualbox-host-source-5.1.30-19.46.1 References: https://www.suse.com/security/cve/CVE-2017-10392.html https://www.suse.com/security/cve/CVE-2017-10407.html https://www.suse.com/security/cve/CVE-2017-10408.html https://www.suse.com/security/cve/CVE-2017-10428.html https://bugzilla.suse.com/1060072 https://bugzilla.suse.com/1064200 https://bugzilla.suse.com/1066488

1 0

openSUSE-RU-2017:2974-1: moderate: Recommended update for kio
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for kio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2974-1 Rating: moderate References: #1000946 #1016920 #1030145 #1049975 #1051349 #969768 #978935 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for kio contains the following bug fixes: - The "Accept For Session" cookie setting that was not properly respected (boo#1049975, kde#386325) - The file name was overlapping with the icon in the file dialog if the generic fallback icon is used (kde#372207) - avoid high CPU load during file copies (boo#1016920, boo#1051349) - Fix modifying applications' .desktop files in the "Edit File Type" dialog if the corresponding directory doesn't exist in ~/.local/share/ (boo#1000946) - Fix for modifying advanced permissions in the Dolphin file/folder properties dialog (boo#978935, kde#365795) - Prevent /tmp getting filled up because full directories are copied to it when generating folder previews for remote locations and the trash (kde#208625, boo#969768) - Dolphin did not displaying symlinks under certain circumstances (boo#1030145, kde#369275) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1263=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): kio-lang-5.20.0-9.1 kio-lang-5.26.0-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): kio-5.20.0-9.1 kio-5.26.0-8.1 kio-core-5.20.0-9.1 kio-core-5.26.0-8.1 kio-core-debuginfo-5.26.0-8.1 kio-debuginfo-5.26.0-8.1 kio-debugsource-5.26.0-8.1 kio-devel-5.20.0-9.1 kio-devel-5.26.0-8.1 kio-devel-debuginfo-5.26.0-8.1 References: https://bugzilla.suse.com/1000946 https://bugzilla.suse.com/1016920 https://bugzilla.suse.com/1030145 https://bugzilla.suse.com/1049975 https://bugzilla.suse.com/1051349 https://bugzilla.suse.com/969768 https://bugzilla.suse.com/978935

1 0

openSUSE-RU-2017:2967-1: important: Recommended update for SuSEfirewall2
by maintenance＠opensuse.org 10 Nov '17

10 Nov '17

openSUSE Recommended Update: Recommended update for SuSEfirewall2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2967-1 Rating: important References: #1067057 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for SuSEfirewall2 fixes the following issues: - Fixed a regression that was introduced by the previous security update. The regression caused some rpcinfo related configurations of SuSEfirewall2 to fail. For example the setting FW_CONFIGURATIONS_EXT="nfs-kernel-server" no longer correctly opened up the necessary ports for the nfs server, consequently making NFS unavailable (bsc#1067057). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1257=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): SuSEfirewall2-3.6.312-5.12.1 References: https://bugzilla.suse.com/1067057

1 0

openSUSE-RU-2017:2961-1: Recommended update for tmux
by maintenance＠opensuse.org 09 Nov '17

09 Nov '17

openSUSE Recommended Update: Recommended update for tmux ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2961-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides the latest version 2.6 for tmux. tmux is a terminal multiplexer. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1255=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): tmux-2.6-15.1 References:

1 0

openSUSE-RU-2017:2960-1: Recommended update for iperf
by maintenance＠opensuse.org 09 Nov '17

09 Nov '17

openSUSE Recommended Update: Recommended update for iperf ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2960-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for iperf to version 3.2 fixes the following issues: - Authentication mechanism added - New --dscp option allows specifying the DSCP value - various bug fixes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1256=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): iperf-3.2-9.1 iperf-devel-3.2-9.1 libiperf0-3.2-9.1 References:

1 0

openSUSE-OU-2017:2959-1: moderate: Optional update adding go1.8 to the SUSE PackageHub
by maintenance＠opensuse.org 09 Nov '17

09 Nov '17

openSUSE Optional Update: Optional update adding go1.8 to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2959-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds go1.8 to the SUSE PackageHub. Go is a compiled, garbage-collected, concurrent programming language. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1254=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): go1.8-1.8.5-2.1 go1.8-debuginfo-1.8.5-2.1 go1.8-debugsource-1.8.5-2.1 go1.8-doc-1.8.5-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go1.8-race-1.8.5-2.1 References:

1 0

openSUSE-RU-2017:2955-1: moderate: Recommended update for singularity
by maintenance＠opensuse.org 08 Nov '17

08 Nov '17

openSUSE Recommended Update: Recommended update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2955-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for singularity fixes the following issues: - Restrict permissions file version to a version which has the required singularity entries to ensure a smooth install experience. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1253=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libsingularity1-2.3.2-8.1 libsingularity1-debuginfo-2.3.2-8.1 singularity-2.3.2-8.1 singularity-debuginfo-2.3.2-8.1 singularity-debugsource-2.3.2-8.1 singularity-devel-2.3.2-8.1 References:

1 0

openSUSE-SU-2017:2953-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Nov '17

08 Nov '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2953-1 Rating: important References: #1066851 Cross-References: CVE-2017-15398 CVE-2017-15399 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Chromium to version 62.0.3202.89 fixes the following vulnerabilities (boo#1066851): - CVE-2017-15398: Stack buffer overflow in QUIC - CVE-2017-15399: Use after free in V8 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1252=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1252=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-62.0.3202.89-124.1 chromedriver-debuginfo-62.0.3202.89-124.1 chromium-62.0.3202.89-124.1 chromium-debuginfo-62.0.3202.89-124.1 chromium-debugsource-62.0.3202.89-124.1 - openSUSE Leap 42.2 (x86_64): chromedriver-62.0.3202.89-104.38.1 chromedriver-debuginfo-62.0.3202.89-104.38.1 chromium-62.0.3202.89-104.38.1 chromium-debuginfo-62.0.3202.89-104.38.1 chromium-debugsource-62.0.3202.89-104.38.1 References: https://www.suse.com/security/cve/CVE-2017-15398.html https://www.suse.com/security/cve/CVE-2017-15399.html https://bugzilla.suse.com/1066851

1 0

openSUSE-RU-2017:2944-1: Recommended update for clamav-database
by maintenance＠opensuse.org 07 Nov '17

07 Nov '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2944-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Nov 6th 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1245=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201711060008-54.100.1 References:

1 0