December 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:3442-1: moderate: Security update for global
by opensuse-security＠opensuse.org 27 Dec '17

27 Dec '17

openSUSE Security Update: Security update for global ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3442-1 Rating: moderate References: #1073197 Cross-References: CVE-2017-17531 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for global fixes the following issue: - CVE-2017-17531: Argument-injection vulnerability allowed execution of arbitrary code via crafted URLs (boo#1073197) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1420=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1420=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): global-6.5.1-6.1 global-debuginfo-6.5.1-6.1 global-debugsource-6.5.1-6.1 - openSUSE Leap 42.2 (i586 x86_64): global-6.5.1-3.3.1 global-debuginfo-6.5.1-3.3.1 global-debugsource-6.5.1-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-17531.html https://bugzilla.suse.com/1073197

1 0

openSUSE-SU-2017:3434-1: important: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 25 Dec '17

25 Dec '17

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3434-1 Rating: important References: #1074043 #1074044 #1074045 #1074046 Cross-References: CVE-2017-7829 CVE-2017-7846 CVE-2017-7847 CVE-2017-7848 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 52.5.2 fixes the following vulnerabilities: - CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin (bsc#1074043) - CVE-2017-7847: Local path string can be leaked from RSS feed (bsc#1074044) - CVE-2017-7848: RSS Feed vulnerable to new line Injection (bsc#1074045) - CVE-2017-7829: From address with encoded null character is cut off in message header display (bsc#1074046) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1419=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1419=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): MozillaThunderbird-52.5.2-53.1 MozillaThunderbird-buildsymbols-52.5.2-53.1 MozillaThunderbird-debuginfo-52.5.2-53.1 MozillaThunderbird-debugsource-52.5.2-53.1 MozillaThunderbird-devel-52.5.2-53.1 MozillaThunderbird-translations-common-52.5.2-53.1 MozillaThunderbird-translations-other-52.5.2-53.1 - openSUSE Leap 42.2 (i586 x86_64): MozillaThunderbird-52.5.2-41.24.1 MozillaThunderbird-buildsymbols-52.5.2-41.24.1 MozillaThunderbird-debuginfo-52.5.2-41.24.1 MozillaThunderbird-debugsource-52.5.2-41.24.1 MozillaThunderbird-devel-52.5.2-41.24.1 MozillaThunderbird-translations-common-52.5.2-41.24.1 MozillaThunderbird-translations-other-52.5.2-41.24.1 References: https://www.suse.com/security/cve/CVE-2017-7829.html https://www.suse.com/security/cve/CVE-2017-7846.html https://www.suse.com/security/cve/CVE-2017-7847.html https://www.suse.com/security/cve/CVE-2017-7848.html https://bugzilla.suse.com/1074043 https://bugzilla.suse.com/1074044 https://bugzilla.suse.com/1074045 https://bugzilla.suse.com/1074046

1 0

openSUSE-SU-2017:3433-1: important: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 25 Dec '17

25 Dec '17

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3433-1 Rating: important References: #1074043 #1074044 #1074045 #1074046 Cross-References: CVE-2017-7829 CVE-2017-7846 CVE-2017-7847 CVE-2017-7848 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for Mozilla Thunderbird to version 52.5.2 fixes the following vulnerabilities: - CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin (bsc#1074043) - CVE-2017-7847: Local path string can be leaked from RSS feed (bsc#1074044) - CVE-2017-7848: RSS Feed vulnerable to new line Injection (bsc#1074045) - CVE-2017-7829: From address with encoded null character is cut off in message header display (bsc#1074046) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1419=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.5.2-51.1 MozillaThunderbird-buildsymbols-52.5.2-51.1 MozillaThunderbird-debuginfo-52.5.2-51.1 MozillaThunderbird-debugsource-52.5.2-51.1 MozillaThunderbird-devel-52.5.2-51.1 MozillaThunderbird-translations-common-52.5.2-51.1 MozillaThunderbird-translations-other-52.5.2-51.1 References: https://www.suse.com/security/cve/CVE-2017-7829.html https://www.suse.com/security/cve/CVE-2017-7846.html https://www.suse.com/security/cve/CVE-2017-7847.html https://www.suse.com/security/cve/CVE-2017-7848.html https://bugzilla.suse.com/1074043 https://bugzilla.suse.com/1074044 https://bugzilla.suse.com/1074045 https://bugzilla.suse.com/1074046

1 0

openSUSE-RU-2017:3432-1: Recommended update for tk and tcl
by maintenance＠opensuse.org 24 Dec '17

24 Dec '17

openSUSE Recommended Update: Recommended update for tk and tcl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3432-1 Rating: low References: #903017 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update of tk and tcl to version 8.6.7 brings many improvements and fixes including, but not limited to, the following highlights: - Fix a bug in Itcl that was causing the floor tool to print lots of errors and abort. (bsc#903017) - Fix a crash in asynchronous connection to hosts when no address is given. - Fix possible crashes when closing multithreaded applications. - Fix a memory leak in [history] destruction. - Fix a crash in Tcl_ListObjReplace(). - Invalidate VFS mounts on sytem encoding change. - Repair drifts in timer clock when calling Tcl_GetTime from tcl-clock module. - Fix a crash when requesting too much character data in binary scan. - Fix a memory leak when calling geturl from the http package. - Fix an integer overflow in [lsort] on very long lists. - Fix a memory leak when calling TclJoinPath. - Fix a memory leak due to a reference cycle in foreach loops. - Fix a crash caused by an optimization in the compilation of [string replace]. - Fix a memory corruption in assembler exceptions. - Fix a crash due to [vwait] trace undo fail. - Fix a crash when invoking [glob -path a]. - Fix a crash in [dict update] after using lassign in an item. - Fix a crash in [chan configure -dictionary]. - Make it possible to specify different values for the -accept option when running multiple asynchronous http: requests without incurring in race conditions. - Fix a crash when calling the [expr] command while the application is being traced. - Avoid leaking memory in Tcl_ZlibInflate when running into error conditions. - Fix some writes beyond buffer bounds. - Fix a memory leak in array when unsetting keys from a proc. - Fix a lock in forking a process under heavy multithreading. - Fix a crash caused by an allocation overflow when parsing a very large expression. - Many fixes and improvements to regexp engine from Postgres. - Fix a segmentation fault due to an integer overflow in TranslateInputEOL(). - Fix multiple crashes in OO teardown. - Stop crashes when extension var resolvers misbehave. - Fix using [read] to read past the EOF so that it works on serial devices. - Fix a regression causing a crash in [oo::class destroy]. - Fix a segmentation fault in mangled bytecode. - Fix a hang in some [read]s of limited size in UTF-8 channels. - Fix a segmentation fault in [array set] of traced array. The following fixes might show some potential incompatibilities with existing software: - Allow an empty command to be the target of an alias. - Reconcile libtommath updates, purging some unused files. - Handle invalid UTF-8 characters correctly in Tcl_UtfToUniChar() to prevent the injection of unexpected characters. - Update Unicode data to 10.0 - Fix some problems in the compilation of [lreplace]. - Fix using parameters with spaces in error messages. - Make it possible to use [namespace upvar] when the target variable is also a variable of the class. - Change the default transfer encoding to gzip in the http package to be more compatible. - Limit $... and bareword parsing to ASCII characters only. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1418=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1418=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): tcl-8.6.7-8.1 tcl-debuginfo-8.6.7-8.1 tcl-debugsource-8.6.7-8.1 tcl-devel-8.6.7-8.1 tk-8.6.7-8.1 tk-debuginfo-8.6.7-8.1 tk-debugsource-8.6.7-8.1 tk-devel-8.6.7-8.1 - openSUSE Leap 42.3 (x86_64): tcl-32bit-8.6.7-8.1 tcl-debuginfo-32bit-8.6.7-8.1 tk-32bit-8.6.7-8.1 tk-debuginfo-32bit-8.6.7-8.1 - openSUSE Leap 42.2 (i586 x86_64): tcl-8.6.7-5.3.1 tcl-debuginfo-8.6.7-5.3.1 tcl-debugsource-8.6.7-5.3.1 tcl-devel-8.6.7-5.3.1 tk-8.6.7-5.3.2 tk-debuginfo-8.6.7-5.3.2 tk-debugsource-8.6.7-5.3.2 tk-devel-8.6.7-5.3.2 - openSUSE Leap 42.2 (x86_64): tcl-32bit-8.6.7-5.3.1 tcl-debuginfo-32bit-8.6.7-5.3.1 tk-32bit-8.6.7-5.3.2 tk-debuginfo-32bit-8.6.7-5.3.2 References: https://bugzilla.suse.com/903017

1 0

openSUSE-SU-2017:3431-1: important: Security update for evince
by opensuse-security＠opensuse.org 23 Dec '17

23 Dec '17

openSUSE Security Update: Security update for evince ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3431-1 Rating: important References: #1046856 Cross-References: CVE-2017-1000083 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for evince fixes the following issues: Security issue fixed: - CVE-2017-1000083: Remove support for tar and tar-like commands in comics backend (bsc#1046856). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1417=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1417=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): evince-3.20.2-6.1 evince-browser-plugin-3.20.2-6.1 evince-browser-plugin-debuginfo-3.20.2-6.1 evince-debuginfo-3.20.2-6.1 evince-debugsource-3.20.2-6.1 evince-devel-3.20.2-6.1 evince-plugin-comicsdocument-3.20.2-6.1 evince-plugin-comicsdocument-debuginfo-3.20.2-6.1 evince-plugin-djvudocument-3.20.2-6.1 evince-plugin-djvudocument-debuginfo-3.20.2-6.1 evince-plugin-dvidocument-3.20.2-6.1 evince-plugin-dvidocument-debuginfo-3.20.2-6.1 evince-plugin-pdfdocument-3.20.2-6.1 evince-plugin-pdfdocument-debuginfo-3.20.2-6.1 evince-plugin-psdocument-3.20.2-6.1 evince-plugin-psdocument-debuginfo-3.20.2-6.1 evince-plugin-tiffdocument-3.20.2-6.1 evince-plugin-tiffdocument-debuginfo-3.20.2-6.1 evince-plugin-xpsdocument-3.20.2-6.1 evince-plugin-xpsdocument-debuginfo-3.20.2-6.1 libevdocument3-4-3.20.2-6.1 libevdocument3-4-debuginfo-3.20.2-6.1 libevview3-3-3.20.2-6.1 libevview3-3-debuginfo-3.20.2-6.1 nautilus-evince-3.20.2-6.1 nautilus-evince-debuginfo-3.20.2-6.1 typelib-1_0-EvinceDocument-3_0-3.20.2-6.1 typelib-1_0-EvinceView-3_0-3.20.2-6.1 - openSUSE Leap 42.3 (noarch): evince-lang-3.20.2-6.1 - openSUSE Leap 42.2 (noarch): evince-lang-3.20.2-2.6.1 - openSUSE Leap 42.2 (x86_64): evince-3.20.2-2.6.1 evince-browser-plugin-3.20.2-2.6.1 evince-browser-plugin-debuginfo-3.20.2-2.6.1 evince-debuginfo-3.20.2-2.6.1 evince-debugsource-3.20.2-2.6.1 evince-devel-3.20.2-2.6.1 evince-plugin-comicsdocument-3.20.2-2.6.1 evince-plugin-comicsdocument-debuginfo-3.20.2-2.6.1 evince-plugin-djvudocument-3.20.2-2.6.1 evince-plugin-djvudocument-debuginfo-3.20.2-2.6.1 evince-plugin-dvidocument-3.20.2-2.6.1 evince-plugin-dvidocument-debuginfo-3.20.2-2.6.1 evince-plugin-pdfdocument-3.20.2-2.6.1 evince-plugin-pdfdocument-debuginfo-3.20.2-2.6.1 evince-plugin-psdocument-3.20.2-2.6.1 evince-plugin-psdocument-debuginfo-3.20.2-2.6.1 evince-plugin-tiffdocument-3.20.2-2.6.1 evince-plugin-tiffdocument-debuginfo-3.20.2-2.6.1 evince-plugin-xpsdocument-3.20.2-2.6.1 evince-plugin-xpsdocument-debuginfo-3.20.2-2.6.1 libevdocument3-4-3.20.2-2.6.1 libevdocument3-4-debuginfo-3.20.2-2.6.1 libevview3-3-3.20.2-2.6.1 libevview3-3-debuginfo-3.20.2-2.6.1 nautilus-evince-3.20.2-2.6.1 nautilus-evince-debuginfo-3.20.2-2.6.1 typelib-1_0-EvinceDocument-3_0-3.20.2-2.6.1 typelib-1_0-EvinceView-3_0-3.20.2-2.6.1 References: https://www.suse.com/security/cve/CVE-2017-1000083.html https://bugzilla.suse.com/1046856

1 0

openSUSE-RU-2017:3430-1: important: Recommended update for dracut
by maintenance＠opensuse.org 22 Dec '17

22 Dec '17

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3430-1 Rating: important References: #1011554 #1019938 #1048551 #1052840 #1067279 #1072424 #960669 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for dracut provides the following fixes: - Fix the task limit when running the emergency shell. This fixes a problem that was causing xfs_repair to crash when trying to repair a damaged XFS filesystem. (bsc#1019938) - Scan for files in /etc/multipath/conf.d when setting up a multipath configuration. (bsc#1048551) - Support AMD CPU families 0x16 and 0x17 (bsc#1072424) - Make ip=dhcp work. Previously, a network interface specifier was required. The new behaviour matches documented behaviour. - Remove 00systemd-bootchart, which is gone from systemd for some time (bsc#1067279) - support predictable interface names (boo#960669) - Include crc32c Intel module when using btrfs (bsc#1011554) - Switch back to fipvlan for bnx2fc (bsc#1052840) - 95fcoe: Allow bnc2x driver more time to complete DCB negotiation (bsc#1052840) - 95fcoe: add timeout initqueue entries (bsc#1052840) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1415=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): dracut-044.1-29.1 dracut-debuginfo-044.1-29.1 dracut-debugsource-044.1-29.1 dracut-fips-044.1-29.1 dracut-tools-044.1-29.1 References: https://bugzilla.suse.com/1011554 https://bugzilla.suse.com/1019938 https://bugzilla.suse.com/1048551 https://bugzilla.suse.com/1052840 https://bugzilla.suse.com/1067279 https://bugzilla.suse.com/1072424 https://bugzilla.suse.com/960669

1 0

openSUSE-RU-2017:3429-1: important: Recommended update for dracut
by maintenance＠opensuse.org 22 Dec '17

22 Dec '17

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3429-1 Rating: important References: #1011554 #1019938 #1036323 #1048551 #1052840 #1067279 #1072424 #960669 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for dracut provides the following fixes: - Fix the task limit when running the emergency shell. This fixes a problem that was causing xfs_repair to crash when trying to repair a damaged XFS filesystem. (bsc#1019938) - Scan for files in /etc/multipath/conf.d when setting up a multipath configuration. (bsc#1048551) - Support AMD CPU families 0x16 and 0x17 (bsc#1072424) - Make ip=dhcp work. Previously, a network interface specifier was required. The new behaviour matches documented behaviour. - Remove 00systemd-bootchart, which is gone from systemd for some time (bsc#1067279) - Support predictable interface names (boo#960669) - Include crc32c Intel module when using btrfs (bsc#1011554) - Switch back to fipvlan for bnx2fc (bsc#1052840) - 95fcoe: Allow bnc2x driver more time to complete DCB negotiation (bsc#1052840) - 95fcoe: add timeout initqueue entries (bsc#1052840) - 95fcoe: fix rules generation (bsc#1036323) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1416=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dracut-044.1-16.15.1 dracut-debuginfo-044.1-16.15.1 dracut-debugsource-044.1-16.15.1 dracut-fips-044.1-16.15.1 dracut-tools-044.1-16.15.1 References: https://bugzilla.suse.com/1011554 https://bugzilla.suse.com/1019938 https://bugzilla.suse.com/1036323 https://bugzilla.suse.com/1048551 https://bugzilla.suse.com/1052840 https://bugzilla.suse.com/1067279 https://bugzilla.suse.com/1072424 https://bugzilla.suse.com/960669

1 0

openSUSE-SU-2017:3427-1: important: Security update for enigmail
by opensuse-security＠opensuse.org 22 Dec '17

22 Dec '17

openSUSE Security Update: Security update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3427-1 Rating: important References: #1073858 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for enigmail to version 1.9.9 fixes the following issues (boo#1073858): * Enigmail could be coerced to use a malicious PGP public key with a corresponding secret key controlled by an attacker * Enigmail could have replayed encrypted content in partially encrypted e-mails, allowing a plaintext leak * Enigmail could be tricked into displaying incorrect signature verification results * Specially crafted content may cause denial of service Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1403=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1403=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): enigmail-1.9.9-9.1 - openSUSE Leap 42.2 (i586 x86_64): enigmail-1.9.9-2.13.1 References: https://bugzilla.suse.com/1073858

1 0

openSUSE-RU-2017:3426-1: moderate: Recommended update for qemu
by maintenance＠opensuse.org 22 Dec '17

22 Dec '17

openSUSE Recommended Update: Recommended update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3426-1 Rating: moderate References: #1048902 #1069178 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for qemu provides the following fix: - A previously released update introduced a regression making qemu use too much memory for Xen usage. (bsc#1069178) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1407=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): qemu-2.6.2-31.15.1 qemu-arm-2.6.2-31.15.1 qemu-arm-debuginfo-2.6.2-31.15.1 qemu-block-curl-2.6.2-31.15.1 qemu-block-curl-debuginfo-2.6.2-31.15.1 qemu-block-dmg-2.6.2-31.15.1 qemu-block-dmg-debuginfo-2.6.2-31.15.1 qemu-block-iscsi-2.6.2-31.15.1 qemu-block-iscsi-debuginfo-2.6.2-31.15.1 qemu-block-ssh-2.6.2-31.15.1 qemu-block-ssh-debuginfo-2.6.2-31.15.1 qemu-debugsource-2.6.2-31.15.1 qemu-extra-2.6.2-31.15.1 qemu-extra-debuginfo-2.6.2-31.15.1 qemu-guest-agent-2.6.2-31.15.1 qemu-guest-agent-debuginfo-2.6.2-31.15.1 qemu-kvm-2.6.2-31.15.1 qemu-lang-2.6.2-31.15.1 qemu-linux-user-2.6.2-31.15.1 qemu-linux-user-debuginfo-2.6.2-31.15.1 qemu-linux-user-debugsource-2.6.2-31.15.1 qemu-ppc-2.6.2-31.15.1 qemu-ppc-debuginfo-2.6.2-31.15.1 qemu-s390-2.6.2-31.15.1 qemu-s390-debuginfo-2.6.2-31.15.1 qemu-testsuite-2.6.2-31.15.2 qemu-tools-2.6.2-31.15.1 qemu-tools-debuginfo-2.6.2-31.15.1 qemu-x86-2.6.2-31.15.1 qemu-x86-debuginfo-2.6.2-31.15.1 - openSUSE Leap 42.2 (noarch): qemu-ipxe-1.0.0-31.15.1 qemu-seabios-1.9.1-31.15.1 qemu-sgabios-8-31.15.1 qemu-vgabios-1.9.1-31.15.1 - openSUSE Leap 42.2 (x86_64): qemu-block-rbd-2.6.2-31.15.1 qemu-block-rbd-debuginfo-2.6.2-31.15.1 References: https://bugzilla.suse.com/1048902 https://bugzilla.suse.com/1069178

1 0

openSUSE-SU-2017:3425-1: moderate: Security update for postgresql96
by opensuse-security＠opensuse.org 22 Dec '17

22 Dec '17

openSUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3425-1 Rating: moderate References: #1067841 #1067844 Cross-References: CVE-2017-15098 CVE-2017-15099 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql96 fixes the following issues: Security issues fixed: - CVE-2017-15098: Fix crash due to rowtype mismatch in json{b}_populate_recordset() (bsc#1067844). - CVE-2017-15099: Ensure that INSERT ... ON CONFLICT DO UPDATE checks table permissions and RLS policies in all cases (bsc#1067841). Bug fixes: - Update to version 9.6.6: * https://www.postgresql.org/docs/9.6/static/release-9-6-6.html * https://www.postgresql.org/docs/9.6/static/release-9-6-5.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1411=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1411=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libecpg6-9.6.6-9.1 libecpg6-debuginfo-9.6.6-9.1 libpq5-9.6.6-9.1 libpq5-debuginfo-9.6.6-9.1 postgresql96-9.6.6-9.1 postgresql96-contrib-9.6.6-9.1 postgresql96-contrib-debuginfo-9.6.6-9.1 postgresql96-debuginfo-9.6.6-9.1 postgresql96-debugsource-9.6.6-9.1 postgresql96-devel-9.6.6-9.1 postgresql96-devel-debuginfo-9.6.6-9.1 postgresql96-libs-debugsource-9.6.6-9.1 postgresql96-plperl-9.6.6-9.1 postgresql96-plperl-debuginfo-9.6.6-9.1 postgresql96-plpython-9.6.6-9.1 postgresql96-plpython-debuginfo-9.6.6-9.1 postgresql96-pltcl-9.6.6-9.1 postgresql96-pltcl-debuginfo-9.6.6-9.1 postgresql96-server-9.6.6-9.1 postgresql96-server-debuginfo-9.6.6-9.1 postgresql96-test-9.6.6-9.1 - openSUSE Leap 42.3 (x86_64): libecpg6-32bit-9.6.6-9.1 libecpg6-debuginfo-32bit-9.6.6-9.1 libpq5-32bit-9.6.6-9.1 libpq5-debuginfo-32bit-9.6.6-9.1 - openSUSE Leap 42.3 (noarch): postgresql96-docs-9.6.6-9.1 - openSUSE Leap 42.2 (i586 x86_64): libecpg6-9.6.6-8.1 libecpg6-debuginfo-9.6.6-8.1 libpq5-9.6.6-8.1 libpq5-debuginfo-9.6.6-8.1 postgresql96-9.6.6-8.1 postgresql96-contrib-9.6.6-8.1 postgresql96-contrib-debuginfo-9.6.6-8.1 postgresql96-debuginfo-9.6.6-8.1 postgresql96-debugsource-9.6.6-8.1 postgresql96-devel-9.6.6-8.1 postgresql96-devel-debuginfo-9.6.6-8.1 postgresql96-libs-debugsource-9.6.6-8.1 postgresql96-plperl-9.6.6-8.1 postgresql96-plperl-debuginfo-9.6.6-8.1 postgresql96-plpython-9.6.6-8.1 postgresql96-plpython-debuginfo-9.6.6-8.1 postgresql96-pltcl-9.6.6-8.1 postgresql96-pltcl-debuginfo-9.6.6-8.1 postgresql96-server-9.6.6-8.1 postgresql96-server-debuginfo-9.6.6-8.1 postgresql96-test-9.6.6-8.1 - openSUSE Leap 42.2 (x86_64): libecpg6-32bit-9.6.6-8.1 libecpg6-debuginfo-32bit-9.6.6-8.1 libpq5-32bit-9.6.6-8.1 libpq5-debuginfo-32bit-9.6.6-8.1 - openSUSE Leap 42.2 (noarch): postgresql96-docs-9.6.6-8.1 References: https://www.suse.com/security/cve/CVE-2017-15098.html https://www.suse.com/security/cve/CVE-2017-15099.html https://bugzilla.suse.com/1067841 https://bugzilla.suse.com/1067844

1 0