December 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:3273-1: Recommended update for clamav-database
by maintenance＠opensuse.org 13 Dec '17

13 Dec '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3273-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Dec 11th 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1367=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201712110009-54.115.1 References:

1 0

openSUSE-SU-2017:3272-1: moderate: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Dec '17

12 Dec '17

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3272-1 Rating: moderate References: #1072034 Cross-References: CVE-2017-7843 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaFirefox to 52.5.2esr fixes the following issue: - CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data (boo#1072034, bmo#1410106, MFSA 2017-28) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1366=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1366=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.5.2-69.1 MozillaFirefox-branding-upstream-52.5.2-69.1 MozillaFirefox-buildsymbols-52.5.2-69.1 MozillaFirefox-debuginfo-52.5.2-69.1 MozillaFirefox-debugsource-52.5.2-69.1 MozillaFirefox-devel-52.5.2-69.1 MozillaFirefox-translations-common-52.5.2-69.1 MozillaFirefox-translations-other-52.5.2-69.1 - openSUSE Leap 42.2 (x86_64): MozillaFirefox-52.5.2-57.24.1 MozillaFirefox-branding-upstream-52.5.2-57.24.1 MozillaFirefox-buildsymbols-52.5.2-57.24.1 MozillaFirefox-debuginfo-52.5.2-57.24.1 MozillaFirefox-debugsource-52.5.2-57.24.1 MozillaFirefox-devel-52.5.2-57.24.1 MozillaFirefox-translations-common-52.5.2-57.24.1 MozillaFirefox-translations-other-52.5.2-57.24.1 References: https://www.suse.com/security/cve/CVE-2017-7843.html https://bugzilla.suse.com/1072034

1 0

openSUSE-SU-2017:3271-1: moderate: Security update for fossil
by opensuse-security＠opensuse.org 12 Dec '17

12 Dec '17

openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3271-1 Rating: moderate References: #1071709 Cross-References: CVE-2017-17459 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fossil to version 2.4 fixes the following issues: - CVE-2017-17459: Client-side code execution via crafted "ssh://" URLs (bsc#1071709) The impact of this vulnerability is more limited than similar vectors fixed in other SCMs, as there is no known way to mask the repository URL or otherwise trigger non-interactively. This update also contains all bug fixes and improvements in the 2.4 release: - URL Aliases - tech-note search capability - Various added command line options - Annation depth is now configurable The following legacy options are no longer available: - --no-dir-symlinks option - legacy configuration sync protocol Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1365=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1365=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): fossil-2.4-6.1 fossil-debuginfo-2.4-6.1 fossil-debugsource-2.4-6.1 - openSUSE Leap 42.2 (i586 x86_64): fossil-2.4-5.6.1 fossil-debuginfo-2.4-5.6.1 fossil-debugsource-2.4-5.6.1 References: https://www.suse.com/security/cve/CVE-2017-17459.html https://bugzilla.suse.com/1071709

1 0

openSUSE-SU-2017:3270-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 12 Dec '17

12 Dec '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3270-1 Rating: important References: #1047054 #1051847 #1052758 #1052764 #1060577 #1061587 Cross-References: CVE-2017-10799 CVE-2017-12140 CVE-2017-12644 CVE-2017-12662 CVE-2017-14733 CVE-2017-14994 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: * CVE-2017-12140: ReadDCMImage in coders\dcm.c has a ninteger signedness error leading to excessive memory consumption (bnc#1051847) * CVE-2017-14994: NULL pointer in ReadDCMImage in coders/dcm.c could lead to denial of service (bnc#1061587) * CVE-2017-12662: Memory leak in WritePDFImage in coders/pdf.c could lead to denial of service (bnc#1052758) * CVE-2017-14733: Heap overflow on ReadRLEImage in coders/rle.c could lead to denial of service (bnc#1060577) * CVE-2017-12644: Memory leak in ReadDCMImage in coders\dcm.c could lead to denial of service (bnc#1052764) * CVE-2017-10799: denial of service (OOM) can occur inReadDPXImage() (bnc#1047054) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1362=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1362=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-47.1 GraphicsMagick-debuginfo-1.3.25-47.1 GraphicsMagick-debugsource-1.3.25-47.1 GraphicsMagick-devel-1.3.25-47.1 libGraphicsMagick++-Q16-12-1.3.25-47.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-47.1 libGraphicsMagick++-devel-1.3.25-47.1 libGraphicsMagick-Q16-3-1.3.25-47.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-47.1 libGraphicsMagick3-config-1.3.25-47.1 libGraphicsMagickWand-Q16-2-1.3.25-47.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-47.1 perl-GraphicsMagick-1.3.25-47.1 perl-GraphicsMagick-debuginfo-1.3.25-47.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.48.1 GraphicsMagick-debuginfo-1.3.25-11.48.1 GraphicsMagick-debugsource-1.3.25-11.48.1 GraphicsMagick-devel-1.3.25-11.48.1 libGraphicsMagick++-Q16-12-1.3.25-11.48.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.48.1 libGraphicsMagick++-devel-1.3.25-11.48.1 libGraphicsMagick-Q16-3-1.3.25-11.48.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.48.1 libGraphicsMagick3-config-1.3.25-11.48.1 libGraphicsMagickWand-Q16-2-1.3.25-11.48.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.48.1 perl-GraphicsMagick-1.3.25-11.48.1 perl-GraphicsMagick-debuginfo-1.3.25-11.48.1 References: https://www.suse.com/security/cve/CVE-2017-10799.html https://www.suse.com/security/cve/CVE-2017-12140.html https://www.suse.com/security/cve/CVE-2017-12644.html https://www.suse.com/security/cve/CVE-2017-12662.html https://www.suse.com/security/cve/CVE-2017-14733.html https://www.suse.com/security/cve/CVE-2017-14994.html https://bugzilla.suse.com/1047054 https://bugzilla.suse.com/1051847 https://bugzilla.suse.com/1052758 https://bugzilla.suse.com/1052764 https://bugzilla.suse.com/1060577 https://bugzilla.suse.com/1061587

1 0

openSUSE-RU-2017:3269-1: moderate: Recommended update for gnuhealth, tryton, trytond, trytond_purchase_request
by maintenance＠opensuse.org 12 Dec '17

12 Dec '17

openSUSE Recommended Update: Recommended update for gnuhealth, tryton, trytond, trytond_purchase_request ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3269-1 Rating: moderate References: #1071565 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth, tryton fixes the following issues: Fixes in gnuhealth 3.2.9: - Removing the patient field before saving the record generates an error - ome on_change numeric method operations generate traceback - WHR should be on the same line as hip and waist fields Tryton was updated to 4.2.9, trytond to 4.2.8, trytond_purchase_request to 4.2.3 for several minor code bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1363=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): gnuhealth-3.2.9-41.1 tryton-4.2.9-22.1 trytond-4.2.8-24.1 trytond_purchase_request-4.2.3-6.1 References: https://bugzilla.suse.com/1071565

1 0

openSUSE-SU-2017:3268-1: moderate: Security update for libheimdal
by opensuse-security＠opensuse.org 12 Dec '17

12 Dec '17

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3268-1 Rating: moderate References: #1071675 Cross-References: CVE-2017-17439 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libheimdal fixes the following issues: - CVE-2017-17439: Remote unauthenticated attackers may have crashed the KDC (boo#1071675) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1364=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1364=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libheimdal-7.4.0-6.1 libheimdal-debuginfo-7.4.0-6.1 libheimdal-debugsource-7.4.0-6.1 libheimdal-devel-7.4.0-6.1 - openSUSE Leap 42.2 (i586 x86_64): libheimdal-7.4.0-2.6.1 libheimdal-debuginfo-7.4.0-2.6.1 libheimdal-debugsource-7.4.0-2.6.1 libheimdal-devel-7.4.0-2.6.1 References: https://www.suse.com/security/cve/CVE-2017-17439.html https://bugzilla.suse.com/1071675

1 0

openSUSE-RU-2017:3261-1: moderate: Recommended update for compat-openssl098
by maintenance＠opensuse.org 10 Dec '17

10 Dec '17

openSUSE Recommended Update: Recommended update for compat-openssl098 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3261-1 Rating: moderate References: #1032261 #1034941 #1065363 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for compat-openssl098 fixes the following issues: Bugs fixed: - Backport the alternative SSL root CA chain lookup patches (bsc#1032261) - Fixed a crash in DES_fcrypt (bsc#1065363) - backported the DEFAULT_SUSE cipher list alias (bsc#1034941) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1361=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-21.2 libopenssl0_9_8-0.9.8j-21.2 libopenssl0_9_8-debuginfo-0.9.8j-21.2 - openSUSE Leap 42.3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-21.2 libopenssl0_9_8-debuginfo-32bit-0.9.8j-21.2 References: https://bugzilla.suse.com/1032261 https://bugzilla.suse.com/1034941 https://bugzilla.suse.com/1065363

1 0

openSUSE-RU-2017:3260-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 09 Dec '17

09 Dec '17

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3260-1 Rating: moderate References: #1049272 #1057498 #1063462 #1065430 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for nvme-cli provides the following fixes: - Allow override queue depth and nr io queues on connect-all. (bsc#1063462) - Generate Spec compliant UUID NQNs. (bsc#1057498) - Fix connecting when using the --hostid parameter. (bsc#1049272) - Decode KATO feature in nvme get-feature. (bsc#1065430) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1359=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): nvme-cli-1.2-7.1 nvme-cli-debuginfo-1.2-7.1 nvme-cli-debugsource-1.2-7.1 References: https://bugzilla.suse.com/1049272 https://bugzilla.suse.com/1057498 https://bugzilla.suse.com/1063462 https://bugzilla.suse.com/1065430

1 0

openSUSE-SU-2017:3259-1: important: Security update for the OBS toolchain
by opensuse-security＠opensuse.org 09 Dec '17

09 Dec '17

openSUSE Security Update: Security update for the OBS toolchain ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3259-1 Rating: important References: #1059858 #1061500 #1069904 #665768 #938556 Cross-References: CVE-2010-4226 CVE-2017-14804 CVE-2017-9274 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This OBS toolchain update fixes the following issues: Package 'build': - CVE-2010-4226: force use of bsdtar for VMs (bnc#665768) - CVE-2017-14804: Improve file name check extractbuild (bsc#1069904) - switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217) Package 'obs-service-source_validator': - CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556). - Update to version 0.7 - use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858) Package 'osc': - update to version 0.162.0 - add Recommends: ca-certificates to enable TLS verification without manually installing them. (bnc#1061500) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1360=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1360=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): build-20171128-5.1 build-initvm-i586-20171128-5.1 build-initvm-x86_64-20171128-5.1 build-mkbaselibs-20171128-5.1 build-mkdrpms-20171128-5.1 obs-service-source_validator-0.7-16.1 osc-0.162.0-10.1 - openSUSE Leap 42.2 (noarch): build-20171128-2.6.1 build-initvm-i586-20171128-2.6.1 build-initvm-x86_64-20171128-2.6.1 build-mkbaselibs-20171128-2.6.1 build-mkdrpms-20171128-2.6.1 obs-service-source_validator-0.7-13.6.1 osc-0.162.0-7.7.1 References: https://www.suse.com/security/cve/CVE-2010-4226.html https://www.suse.com/security/cve/CVE-2017-14804.html https://www.suse.com/security/cve/CVE-2017-9274.html https://bugzilla.suse.com/1059858 https://bugzilla.suse.com/1061500 https://bugzilla.suse.com/1069904 https://bugzilla.suse.com/665768 https://bugzilla.suse.com/938556

1 0

openSUSE-RU-2017:3258-1: moderate: Recommended update for spec-cleaner
by maintenance＠opensuse.org 08 Dec '17

08 Dec '17

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:3258-1 Rating: moderate References: #1071561 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spec-cleaner to version contains the following improvements and fixes: - Recognize new rpm trigger* events - Remove otherproviders conflicts syntax (just keep the pkg name) - Detect more apache macros - Drop obsolete py_requires macro Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1356=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1356=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): spec-cleaner-1.0.1-37.1 spec-cleaner-format_spec_file-1.0.1-37.1 - openSUSE Leap 42.2 (noarch): spec-cleaner-1.0.1-31.15.1 spec-cleaner-format_spec_file-1.0.1-31.15.1 References: https://bugzilla.suse.com/1071561

1 0