February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0364-1: Security update for Wireshark
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for Wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0364-1 Rating: low References: #1021739 Cross-References: CVE-2017-5596 CVE-2017-5597 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to Wireshark 2.2.4 fixes two minor vulnerabilities that could be used to cause Wireshark to go into a large or infinite loop by sending specially crafted packages over the network or into a capture file. (bsc#1021739) - CVE-2017-5596: The ASTERIX dissector could go into an infinite loop (wnpa-sec-2017-01) - CVE-2017-5597: The DHCPv6 dissector could go into a large loop (wnpa-sec-2017-02) - Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.4.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-194=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): wireshark-2.2.4-7.1 wireshark-debuginfo-2.2.4-7.1 wireshark-debugsource-2.2.4-7.1 wireshark-devel-2.2.4-7.1 wireshark-ui-gtk-2.2.4-7.1 wireshark-ui-gtk-debuginfo-2.2.4-7.1 wireshark-ui-qt-2.2.4-7.1 wireshark-ui-qt-debuginfo-2.2.4-7.1 References: https://www.suse.com/security/cve/CVE-2017-5596.html https://www.suse.com/security/cve/CVE-2017-5597.html https://bugzilla.suse.com/1021739

1 0

openSUSE-SU-2017:0363-1: moderate: Security update for bzrtp
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for bzrtp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0363-1 Rating: moderate References: #1020844 Cross-References: CVE-2016-6271 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bzrtp fixes one security issue. The following vulnerability was fixed: - CVE-2016-6271: missing HVI check on DHPart2 packet reception may have allowed man-in-the-middle attackers to conduct spoofing attacks boo#1020844) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-193=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-193=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): bzrtp-debugsource-1.0.3-6.1 bzrtp-devel-1.0.3-6.1 libbzrtp0-1.0.3-6.1 libbzrtp0-debuginfo-1.0.3-6.1 - openSUSE Leap 42.2 (x86_64): libbzrtp0-32bit-1.0.3-6.1 libbzrtp0-debuginfo-32bit-1.0.3-6.1 - openSUSE Leap 42.1 (i586 x86_64): bzrtp-debugsource-1.0.3-5.1 bzrtp-devel-1.0.3-5.1 libbzrtp0-1.0.3-5.1 libbzrtp0-debuginfo-1.0.3-5.1 - openSUSE Leap 42.1 (x86_64): libbzrtp0-32bit-1.0.3-5.1 libbzrtp0-debuginfo-32bit-1.0.3-5.1 References: https://www.suse.com/security/cve/CVE-2016-6271.html https://bugzilla.suse.com/1020844

1 0

openSUSE-SU-2017:0362-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0362-1 Rating: moderate References: #982505 Cross-References: CVE-2016-4450 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following vulnerability: - CVE-2016-4450: Remote attackers could have caused a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-192=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-192=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): nginx-1.8.1-8.1 nginx-debuginfo-1.8.1-8.1 nginx-debugsource-1.8.1-8.1 - openSUSE Leap 42.1 (i586 x86_64): nginx-1.8.1-8.1 nginx-debuginfo-1.8.1-8.1 nginx-debugsource-1.8.1-8.1 References: https://www.suse.com/security/cve/CVE-2016-4450.html https://bugzilla.suse.com/982505

1 0

openSUSE-SU-2017:0361-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0361-1 Rating: moderate References: #982505 Cross-References: CVE-2016-4450 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following vulnerability: - CVE-2016-4450: Remote attackers could have caused a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-192=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nginx-1.8.1-9.1 nginx-debuginfo-1.8.1-9.1 nginx-debugsource-1.8.1-9.1 References: https://www.suse.com/security/cve/CVE-2016-4450.html https://bugzilla.suse.com/982505

1 0

openSUSE-RU-2017:0360-1: moderate: Recommended update for irssi
by maintenance＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Recommended Update: Recommended update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0360-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update contains irssi 1.0.0 for the SUSE Package Hub, with the following improvements: * irssiproxy can now forward all tags through a single port. * The kill buffer now remembers consecutive kills. New bindings were added: yank_next_cutbuffer and append_next_kill. * autolog_ignore_targets and activity_hide_targets learn a new syntax tag/* and * to ignore whole networks or everything. * hilight got a -matchcase flag to hilight case sensitively. * Display TLS connection information upon connect. You can disable this by setting tls_verbose_connect to FALSE * Certificate pinning for TLS certificates * /names and $[…] now uses utf8 string operations. * New setting completion_nicks_match_case * /channel /server /network now support modify subcommand. * New option sasl_disconnect_on_failure to disconnect when SASL log-in failed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-191=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.0.0-15.1 irssi-devel-1.0.0-15.1 References:

1 0

openSUSE-RU-2017:0359-1: Recommended update for MozillaFirefox-branding-openSUSE
by maintenance＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Recommended Update: Recommended update for MozillaFirefox-branding-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0359-1 Rating: low References: #1014292 #704121 #953164 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for MozillaFirefox-branding-openSUSE fixes a number of issues in the default bookmarks: - Fix openSUSE bookmarks which were not added to default profile. (boo#1014292) - Move openSUSE bookmarks from toolbar to menu - Use local favicon for all bookmarks. (Firefox 45+) - Fix links to "openSUSE Documentation" and "How to Participate" (boo#704121, boo#953164) - Remove DuckDuckGo search plugin. (included upstream) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-190=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-190=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-branding-openSUSE-45-9.1 - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-branding-openSUSE-45-7.1 References: https://bugzilla.suse.com/1014292 https://bugzilla.suse.com/704121 https://bugzilla.suse.com/953164

1 0

openSUSE-SU-2017:0358-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0358-1 Rating: important References: #1017174 #1021814 #1021817 #1021818 #1021819 #1021820 #1021821 #1021822 #1021823 #1021824 #1021826 #1021827 #1021828 #1021830 #1021831 #1021832 #1021833 #1021835 #1021837 #1021839 #1021840 #1021841 Cross-References: CVE-2017-5373 CVE-2017-5374 CVE-2017-5375 CVE-2017-5376 CVE-2017-5377 CVE-2017-5378 CVE-2017-5379 CVE-2017-5380 CVE-2017-5381 CVE-2017-5382 CVE-2017-5383 CVE-2017-5384 CVE-2017-5385 CVE-2017-5386 CVE-2017-5387 CVE-2017-5388 CVE-2017-5389 CVE-2017-5390 CVE-2017-5391 CVE-2017-5392 CVE-2017-5393 CVE-2017-5394 CVE-2017-5395 CVE-2017-5396 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for MozillaFirefox to version 51.0.1 fixes security issues and bugs. These security issues were fixed: * CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bmo#1325200, boo#1021814) * CVE-2017-5376: Use-after-free in XSL (bmo#1311687, boo#1021817) CVE-2017-5377: Memory corruption with transforms to create gradients in Skia (bmo#1306883, boo#1021826) * CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bmo#1312001, bmo#1330769, boo#1021818) * CVE-2017-5379: Use-after-free in Web Animations (bmo#1309198,boo#1021827) * CVE-2017-5380: Potential use-after-free during DOM manipulations (bmo#1322107, boo#1021819) * CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bmo#1297361, boo#1021820) * CVE-2017-5389: WebExtensions can install additional add-ons via modified host requests (bmo#1308688, boo#1021828) * CVE-2017-5396: Use-after-free with Media Decoder (bmo#1329403, boo#1021821) * CVE-2017-5381: Certificate Viewer exporting can be used to navigate and save to arbitrary filesystem locations (bmo#1017616, boo#1021830) * CVE-2017-5382: Feed preview can expose privileged content errors and exceptions (bmo#1295322, boo#1021831) * CVE-2017-5383: Location bar spoofing with unicode characters (bmo#1323338, bmo#1324716, boo#1021822) * CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC) (bmo#1255474, boo#1021832) * CVE-2017-5385: Data sent in multipart channels ignores referrer-policy response headers (bmo#1295945, boo#1021833) * CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions (bmo#1319070, boo#1021823) * CVE-2017-5391: Content about: pages can load privileged about: pages (bmo#1309310, boo#1021835) * CVE-2017-5393: Remove addons.mozilla.org CDN from whitelist for mozAddonManager (bmo#1309282, boo#1021837) * CVE-2017-5387: Disclosure of local file existence through TRACK tag error messages (bmo#1295023, boo#1021839) * CVE-2017-5388: WebRTC can be used to generate a large amount of UDP traffic for DDOS attacks (bmo#1281482, boo#1021840) * CVE-2017-5374: Memory safety bugs (boo#1021841) * CVE-2017-5373: Memory safety bugs (boo#1021824) These non-security issues in MozillaFirefox were fixed: * Added support for FLAC (Free Lossless Audio Codec) playback * Added support for WebGL 2 * Added Georgian (ka) and Kabyle (kab) locales * Support saving passwords for forms without 'submit' events * Improved video performance for users without GPU acceleration * Zoom indicator is shown in the URL bar if the zoom level is not at default level * View passwords from the prompt before saving them * Remove Belarusian (be) locale * Use Skia for content rendering (Linux) * Improve recognition of LANGUAGE env variable (boo#1017174) * Multiprocess incompatibility did not correctly register with some add-ons (bmo#1333423) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-187=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-187=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-51.0.1-50.2 MozillaFirefox-branding-upstream-51.0.1-50.2 MozillaFirefox-buildsymbols-51.0.1-50.2 MozillaFirefox-debuginfo-51.0.1-50.2 MozillaFirefox-debugsource-51.0.1-50.2 MozillaFirefox-devel-51.0.1-50.2 MozillaFirefox-translations-common-51.0.1-50.2 MozillaFirefox-translations-other-51.0.1-50.2 - openSUSE Leap 42.1 (x86_64): MozillaFirefox-51.0.1-50.2 MozillaFirefox-branding-upstream-51.0.1-50.2 MozillaFirefox-buildsymbols-51.0.1-50.2 MozillaFirefox-debuginfo-51.0.1-50.2 MozillaFirefox-debugsource-51.0.1-50.2 MozillaFirefox-devel-51.0.1-50.2 MozillaFirefox-translations-common-51.0.1-50.2 MozillaFirefox-translations-other-51.0.1-50.2 References: https://www.suse.com/security/cve/CVE-2017-5373.html https://www.suse.com/security/cve/CVE-2017-5374.html https://www.suse.com/security/cve/CVE-2017-5375.html https://www.suse.com/security/cve/CVE-2017-5376.html https://www.suse.com/security/cve/CVE-2017-5377.html https://www.suse.com/security/cve/CVE-2017-5378.html https://www.suse.com/security/cve/CVE-2017-5379.html https://www.suse.com/security/cve/CVE-2017-5380.html https://www.suse.com/security/cve/CVE-2017-5381.html https://www.suse.com/security/cve/CVE-2017-5382.html https://www.suse.com/security/cve/CVE-2017-5383.html https://www.suse.com/security/cve/CVE-2017-5384.html https://www.suse.com/security/cve/CVE-2017-5385.html https://www.suse.com/security/cve/CVE-2017-5386.html https://www.suse.com/security/cve/CVE-2017-5387.html https://www.suse.com/security/cve/CVE-2017-5388.html https://www.suse.com/security/cve/CVE-2017-5389.html https://www.suse.com/security/cve/CVE-2017-5390.html https://www.suse.com/security/cve/CVE-2017-5391.html https://www.suse.com/security/cve/CVE-2017-5392.html https://www.suse.com/security/cve/CVE-2017-5393.html https://www.suse.com/security/cve/CVE-2017-5394.html https://www.suse.com/security/cve/CVE-2017-5395.html https://www.suse.com/security/cve/CVE-2017-5396.html https://bugzilla.suse.com/1017174 https://bugzilla.suse.com/1021814 https://bugzilla.suse.com/1021817 https://bugzilla.suse.com/1021818 https://bugzilla.suse.com/1021819 https://bugzilla.suse.com/1021820 https://bugzilla.suse.com/1021821 https://bugzilla.suse.com/1021822 https://bugzilla.suse.com/1021823 https://bugzilla.suse.com/1021824 https://bugzilla.suse.com/1021826 https://bugzilla.suse.com/1021827 https://bugzilla.suse.com/1021828 https://bugzilla.suse.com/1021830 https://bugzilla.suse.com/1021831 https://bugzilla.suse.com/1021832 https://bugzilla.suse.com/1021833 https://bugzilla.suse.com/1021835 https://bugzilla.suse.com/1021837 https://bugzilla.suse.com/1021839 https://bugzilla.suse.com/1021840 https://bugzilla.suse.com/1021841

1 0

openSUSE-SU-2017:0357-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0357-1 Rating: moderate References: #1021814 #1021817 #1021818 #1021819 #1021820 #1021821 #1021822 #1021824 #1021991 Cross-References: CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5390 CVE-2017-5396 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs. The following security issues from advisory MFSA 2017-03 were fixed (boo#1021991) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (boo#1021814) - CVE-2017-5376: Use-after-free in XSL (boo#1021817) - CVE-2017-5378: Pointer and frame data leakage of Javascript objects (boo#1021818) - CVE-2017-5380: Potential use-after-free during DOM manipulations (boo#1021819) - CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (boo#1021820) - CVE-2017-5396: Use-after-free with Media Decoder (boo#1021821) - CVE-2017-5383: Location bar spoofing with unicode characters (boo#1021822) - CVE-2017-5373: Memory safety bugs fixed in Thunderbird 45.7 (boo#1021824) The following non-security bugs were fixed: - Message preview pane non-functional after IMAP folder was renamed or moved - "Move To" button on "Search Messages" panel not working - Message sent to "undisclosed recipients" shows no recipient (non-functional since Thunderbird version 38) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-188=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-188=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): MozillaThunderbird-45.7.0-34.1 MozillaThunderbird-buildsymbols-45.7.0-34.1 MozillaThunderbird-debuginfo-45.7.0-34.1 MozillaThunderbird-debugsource-45.7.0-34.1 MozillaThunderbird-devel-45.7.0-34.1 MozillaThunderbird-translations-common-45.7.0-34.1 MozillaThunderbird-translations-other-45.7.0-34.1 - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-45.7.0-34.1 MozillaThunderbird-buildsymbols-45.7.0-34.1 MozillaThunderbird-debuginfo-45.7.0-34.1 MozillaThunderbird-debugsource-45.7.0-34.1 MozillaThunderbird-devel-45.7.0-34.1 MozillaThunderbird-translations-common-45.7.0-34.1 MozillaThunderbird-translations-other-45.7.0-34.1 References: https://www.suse.com/security/cve/CVE-2017-5373.html https://www.suse.com/security/cve/CVE-2017-5375.html https://www.suse.com/security/cve/CVE-2017-5376.html https://www.suse.com/security/cve/CVE-2017-5378.html https://www.suse.com/security/cve/CVE-2017-5380.html https://www.suse.com/security/cve/CVE-2017-5383.html https://www.suse.com/security/cve/CVE-2017-5390.html https://www.suse.com/security/cve/CVE-2017-5396.html https://bugzilla.suse.com/1021814 https://bugzilla.suse.com/1021817 https://bugzilla.suse.com/1021818 https://bugzilla.suse.com/1021819 https://bugzilla.suse.com/1021820 https://bugzilla.suse.com/1021821 https://bugzilla.suse.com/1021822 https://bugzilla.suse.com/1021824 https://bugzilla.suse.com/1021991

1 0

openSUSE-SU-2017:0356-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0356-1 Rating: important References: #1017174 #1021636 #984637 #990856 Cross-References: CVE-2016-6354 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for Seamonkey to version 2.46 fixes security issues and bugs. The following vulnerabilities were fixed: - Fix all Gecko related security issues between 43.0.1 and 49.0.2 - CVE-2016-6354: buffer overrun in flex (boo#990856) The following non-security changes are included: - improve recognition of LANGUAGE env variable (boo#1017174) - improve TLS compatibility with certain websites (boo#1021636) - Seamonkey now requires NSPR 4.12 and NSS 3.25 - based on Gecko 49.0.2 - Chatzilla and DOM Inspector were disabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-189=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-189=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): seamonkey-2.46-9.2 seamonkey-debuginfo-2.46-9.2 seamonkey-debugsource-2.46-9.2 seamonkey-translations-common-2.46-9.2 seamonkey-translations-other-2.46-9.2 - openSUSE Leap 42.1 (i586 x86_64): seamonkey-2.46-9.2 seamonkey-debuginfo-2.46-9.2 seamonkey-debugsource-2.46-9.2 seamonkey-translations-common-2.46-9.2 seamonkey-translations-other-2.46-9.2 References: https://www.suse.com/security/cve/CVE-2016-6354.html https://bugzilla.suse.com/1017174 https://bugzilla.suse.com/1021636 https://bugzilla.suse.com/984637 https://bugzilla.suse.com/990856

1 0

openSUSE-RU-2017:0355-1: moderate: Recommended update for mozilla-nss, mozilla-nspr
by maintenance＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Recommended Update: Recommended update for mozilla-nss, mozilla-nspr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0355-1 Rating: moderate References: #1021636 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update contains mozilla-nspr version 4.13.1 and mozilla-nss version 3.28.1. In addition to fixing bugs, these versions are required dependencies for security updates for Mozilla Firefox and Seamonkey. These issues were fixed in mozilla-nss: - fix minor TLS compatibility issues with certain websites (boo#1021636) - NSS was updated to 3.28.1 - list of root CA certificates was updates - includes support for TLS 1.3 draft -18 These issues in mozilla-nspr were fixed: - PL_strcmp (and others) were fixed to return consistent results when one of the arguments is NULL. - PollEvent was fixed to not block on clear. - Pipes are always nonblocking. - PR_GetNameForIdentity: added thread safety lock and bound checks. - Removed the PLArena freelist. - Avoid some integer overflows. - fixed several comments. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-186=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-186=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libfreebl3-3.28.1-35.1 libfreebl3-debuginfo-3.28.1-35.1 libsoftokn3-3.28.1-35.1 libsoftokn3-debuginfo-3.28.1-35.1 mozilla-nspr-4.13.1-13.1 mozilla-nspr-debuginfo-4.13.1-13.1 mozilla-nspr-debugsource-4.13.1-13.1 mozilla-nspr-devel-4.13.1-13.1 mozilla-nss-3.28.1-35.1 mozilla-nss-certs-3.28.1-35.1 mozilla-nss-certs-debuginfo-3.28.1-35.1 mozilla-nss-debuginfo-3.28.1-35.1 mozilla-nss-debugsource-3.28.1-35.1 mozilla-nss-devel-3.28.1-35.1 mozilla-nss-sysinit-3.28.1-35.1 mozilla-nss-sysinit-debuginfo-3.28.1-35.1 mozilla-nss-tools-3.28.1-35.1 mozilla-nss-tools-debuginfo-3.28.1-35.1 - openSUSE Leap 42.2 (x86_64): libfreebl3-32bit-3.28.1-35.1 libfreebl3-debuginfo-32bit-3.28.1-35.1 libsoftokn3-32bit-3.28.1-35.1 libsoftokn3-debuginfo-32bit-3.28.1-35.1 mozilla-nspr-32bit-4.13.1-13.1 mozilla-nspr-debuginfo-32bit-4.13.1-13.1 mozilla-nss-32bit-3.28.1-35.1 mozilla-nss-certs-32bit-3.28.1-35.1 mozilla-nss-certs-debuginfo-32bit-3.28.1-35.1 mozilla-nss-debuginfo-32bit-3.28.1-35.1 mozilla-nss-sysinit-32bit-3.28.1-35.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.1-35.1 - openSUSE Leap 42.1 (i586 x86_64): libfreebl3-3.28.1-35.2 libfreebl3-debuginfo-3.28.1-35.2 libsoftokn3-3.28.1-35.2 libsoftokn3-debuginfo-3.28.1-35.2 mozilla-nspr-4.13.1-13.1 mozilla-nspr-debuginfo-4.13.1-13.1 mozilla-nspr-debugsource-4.13.1-13.1 mozilla-nspr-devel-4.13.1-13.1 mozilla-nss-3.28.1-35.2 mozilla-nss-certs-3.28.1-35.2 mozilla-nss-certs-debuginfo-3.28.1-35.2 mozilla-nss-debuginfo-3.28.1-35.2 mozilla-nss-debugsource-3.28.1-35.2 mozilla-nss-devel-3.28.1-35.2 mozilla-nss-sysinit-3.28.1-35.2 mozilla-nss-sysinit-debuginfo-3.28.1-35.2 mozilla-nss-tools-3.28.1-35.2 mozilla-nss-tools-debuginfo-3.28.1-35.2 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.28.1-35.2 libfreebl3-debuginfo-32bit-3.28.1-35.2 libsoftokn3-32bit-3.28.1-35.2 libsoftokn3-debuginfo-32bit-3.28.1-35.2 mozilla-nspr-32bit-4.13.1-13.1 mozilla-nspr-debuginfo-32bit-4.13.1-13.1 mozilla-nss-32bit-3.28.1-35.2 mozilla-nss-certs-32bit-3.28.1-35.2 mozilla-nss-certs-debuginfo-32bit-3.28.1-35.2 mozilla-nss-debuginfo-32bit-3.28.1-35.2 mozilla-nss-sysinit-32bit-3.28.1-35.2 mozilla-nss-sysinit-debuginfo-32bit-3.28.1-35.2 References: https://bugzilla.suse.com/1021636

1 0