February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:0383-1: Recommended update for libpfm
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Recommended Update: Recommended update for libpfm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0383-1 Rating: low References: #1017407 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds a few useful utilities to libpfm-devel: check_events, evt2raw and showevtinfo. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-206=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-206=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libpfm-debugsource-4.6.0-7.1 libpfm-devel-4.6.0-7.1 libpfm-devel-debuginfo-4.6.0-7.1 libpfm-devel-static-4.6.0-7.1 libpfm4-4.6.0-7.1 libpfm4-debuginfo-4.6.0-7.1 python-libpfm-4.6.0-7.1 python-libpfm-debuginfo-4.6.0-7.1 - openSUSE Leap 42.2 (x86_64): libpfm4-32bit-4.6.0-7.1 libpfm4-debuginfo-32bit-4.6.0-7.1 - openSUSE Leap 42.1 (i586 x86_64): libpfm-debugsource-4.6.0-6.1 libpfm-devel-4.6.0-6.1 libpfm-devel-debuginfo-4.6.0-6.1 libpfm-devel-static-4.6.0-6.1 libpfm4-4.6.0-6.1 libpfm4-debuginfo-4.6.0-6.1 python-libpfm-4.6.0-6.1 python-libpfm-debuginfo-4.6.0-6.1 - openSUSE Leap 42.1 (x86_64): libpfm4-32bit-4.6.0-6.1 libpfm4-debuginfo-32bit-4.6.0-6.1 References: https://bugzilla.suse.com/1017407

1 0

openSUSE-SU-2017:0382-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0382-1 Rating: important References: #1020856 Cross-References: CVE-2016-5545 CVE-2017-3290 CVE-2017-3316 CVE-2017-3332 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for virtualbox to version 5.1.14 fixes the following issues: These security issues were fixed: - CVE-2016-5545: Vulnerability in the GUI subcomponent of virtualbox allows unauthenticated attacker unauthorized update, insert or delete access to some data as well as unauthorized read access to a subset of VirtualBox accessible data and unauthorized ability to cause a partial denial of service (bsc#1020856). - CVE-2017-3290: Vulnerability in the Shared Folder subcomponent of virtualbox allows high privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). - CVE-2017-3316: Vulnerability in the GUI subcomponent of virtualbox allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox (bsc#1020856). - CVE-2017-3332: Vulnerability in the SVGA Emulation subcomponent of virtualbox allows low privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). For other changes please read the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-203=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): virtualbox-guest-desktop-icons-5.1.14-9.2 virtualbox-host-source-5.1.14-9.2 - openSUSE Leap 42.2 (x86_64): python-virtualbox-5.1.14-9.2 python-virtualbox-debuginfo-5.1.14-9.2 virtualbox-5.1.14-9.2 virtualbox-debuginfo-5.1.14-9.2 virtualbox-debugsource-5.1.14-9.2 virtualbox-devel-5.1.14-9.2 virtualbox-guest-kmp-default-5.1.14_k4.4.36_8-9.2 virtualbox-guest-kmp-default-debuginfo-5.1.14_k4.4.36_8-9.2 virtualbox-guest-tools-5.1.14-9.2 virtualbox-guest-tools-debuginfo-5.1.14-9.2 virtualbox-guest-x11-5.1.14-9.2 virtualbox-guest-x11-debuginfo-5.1.14-9.2 virtualbox-host-kmp-default-5.1.14_k4.4.36_8-9.2 virtualbox-host-kmp-default-debuginfo-5.1.14_k4.4.36_8-9.2 virtualbox-qt-5.1.14-9.2 virtualbox-qt-debuginfo-5.1.14-9.2 virtualbox-websrv-5.1.14-9.2 virtualbox-websrv-debuginfo-5.1.14-9.2 References: https://www.suse.com/security/cve/CVE-2016-5545.html https://www.suse.com/security/cve/CVE-2017-3290.html https://www.suse.com/security/cve/CVE-2017-3316.html https://www.suse.com/security/cve/CVE-2017-3332.html https://bugzilla.suse.com/1020856

1 0

openSUSE-RU-2017:0381-1: Recommended update for yast2-ruby-bindings
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Recommended Update: Recommended update for yast2-ruby-bindings ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0381-1 Rating: low References: #1014458 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-ruby-bindings fixes the following issues: - Do not crash when FastGettext is unable to find the empty.mo file (bsc#1014458) - Improved debugger support (FATE#318421) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-204=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-ruby-bindings-3.1.51.2-3.1 yast2-ruby-bindings-debuginfo-3.1.51.2-3.1 yast2-ruby-bindings-debugsource-3.1.51.2-3.1 References: https://bugzilla.suse.com/1014458

1 0

openSUSE-SU-2017:0374-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0374-1 Rating: important References: #1020905 #1022053 Cross-References: CVE-2016-2183 CVE-2016-5546 CVE-2016-5547 CVE-2016-5548 CVE-2016-5549 CVE-2016-5552 CVE-2017-3231 CVE-2017-3241 CVE-2017-3252 CVE-2017-3253 CVE-2017-3260 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0): - S8138725: Add options for Javadoc generation - S8140353: Improve signature checking - S8151934, CVE-2017-3231: Resolve class resolution - S8156804, CVE-2017-3241: Better constraint checking - S8158406: Limited Parameter Processing - S8158997: JNDI Protocols Switch - S8159507: RuntimeVisibleAnnotation validation - S8161218: Better bytecode loading - S8161743, CVE-2017-3252: Provide proper login context - S8162577: Standardize logging levels - S8162973: Better component components - S8164143, CVE-2017-3260: Improve components for menu items - S8164147, CVE-2017-3261: Improve streaming socket output - S8165071, CVE-2016-2183: Expand TLS support - S8165344, CVE-2017-3272: Update concurrency support - S8166988, CVE-2017-3253: Improve image processing performance - S8167104, CVE-2017-3289: Additional class construction refinements - S8167223, CVE-2016-5552: URL handling improvements - S8168705, CVE-2016-5547: Better ObjectIdentifier validation - S8168714, CVE-2016-5546: Tighten ECDSA validation - S8168728, CVE-2016-5548: DSA signing improvements - S8168724, CVE-2016-5549: ECDSA signing improvements This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-201=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-201=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-6.4 java-1_8_0-openjdk-accessibility-1.8.0.121-6.4 java-1_8_0-openjdk-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-debugsource-1.8.0.121-6.4 java-1_8_0-openjdk-demo-1.8.0.121-6.4 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-devel-1.8.0.121-6.4 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-headless-1.8.0.121-6.4 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-src-1.8.0.121-6.4 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-6.4 - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-21.4 java-1_8_0-openjdk-accessibility-1.8.0.121-21.4 java-1_8_0-openjdk-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-debugsource-1.8.0.121-21.4 java-1_8_0-openjdk-demo-1.8.0.121-21.4 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-devel-1.8.0.121-21.4 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-headless-1.8.0.121-21.4 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-src-1.8.0.121-21.4 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-21.4 References: https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-5546.html https://www.suse.com/security/cve/CVE-2016-5547.html https://www.suse.com/security/cve/CVE-2016-5548.html https://www.suse.com/security/cve/CVE-2016-5549.html https://www.suse.com/security/cve/CVE-2016-5552.html https://www.suse.com/security/cve/CVE-2017-3231.html https://www.suse.com/security/cve/CVE-2017-3241.html https://www.suse.com/security/cve/CVE-2017-3252.html https://www.suse.com/security/cve/CVE-2017-3253.html https://www.suse.com/security/cve/CVE-2017-3260.html https://www.suse.com/security/cve/CVE-2017-3261.html https://www.suse.com/security/cve/CVE-2017-3272.html https://www.suse.com/security/cve/CVE-2017-3289.html https://bugzilla.suse.com/1020905 https://bugzilla.suse.com/1022053

1 0

openSUSE-SU-2017:0373-1: Security update for mupdf
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0373-1 Rating: low References: #1019877 Cross-References: CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mupdf to version 1.10a fixes the following issues: These security issues were fixed: - CVE-2016-10132: Null pointer dereference in regexp because of a missing check after allocating memory allowing for DoS (bsc#1019877). - CVE-2016-10133: Heap buffer overflow write in js_stackoverflow allowing for DoS or possible code execution (bsc#1019877). - CVE-2016-10141: An integer overflow vulnerability triggered by a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition (bsc#1019877). These non-security issues were fixed: - A bug with mutool and saving PDF files using the 'ascii' option has been fixed. - Stop defining OPJ_STATIC - FictionBook (FB2) e-book support. - Simple SVG parser (a small subset of SVG only). - mutool convert: a new document conversion tool and interface. - Multi-threaded rendering in mudraw. - Updated base 14 fonts from URW. - New CJK font with language specific variants. - Hyperlink support in EPUB. - Alpha channel is now optional in pixmaps. - More aggressive purging of cached objects. - Partial image decoding for lower memory use when banding. - Reduced default set of built-in CMap tables to the minimum required. - FZ_ENABLE_PDF, _XPS, _JS, to disable features at compile time. - Function level linking. - Dropped pdf object generation numbers from public interfaces. - Simplified PDF page, xobject, and annotation internals. - Closing and freeing devices and writers are now separate steps. - Improved PDF annotation editing interface (still a work in progress). - Document writer interface. - Banded image writer interface. - Bidirectional layout for Arabic and Hebrew scripts. - Shaping complex scripts for EPUB text layout. - Noto fallback fonts for EPUB layout. - mutool create: - Create new PDF files from scratch. - Read an annotated content stream in a text file and write a PDF file, automatically embedding font and image resources. - mutool run: + Run javascript scripts with MuPDF bindings. + The interface is similar to the new Java interface. - mutool draw: + Optional multi-threaded operation (Windows and pthreads). + Optional low memory mode (primarily for testing). - Set to best anti-alias mode (8) by default. - Ship mupdf-x11-curl as default mupdf. Drop non-curl version. - New URW fonts with greek and cyrillic. - 64-bit file support. - Updated FreeType to version 2.6.1. - Various font substitution bug fixes. - EPUB improvements: User style sheets, GIF images, Table of Contents, CJK text, Page margins and many bug fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-197=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): mupdf-1.10a-10.1 mupdf-devel-static-1.10a-10.1 References: https://www.suse.com/security/cve/CVE-2016-10132.html https://www.suse.com/security/cve/CVE-2016-10133.html https://www.suse.com/security/cve/CVE-2016-10141.html https://bugzilla.suse.com/1019877

1 0

openSUSE-SU-2017:0372-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0372-1 Rating: moderate References: #1021597 Cross-References: CVE-2015-8980 CVE-2016-6621 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to phpMyAdmin 4.4.15.10 fixes the following security issues: - CVE-2016-6621: Multiple vulnerabilities in setup script (PMASA-2016-44) - Open redirect (PMASA-2017-1) - CVE-2015-8980: php-gettext code execution (PMASA-2017-2) - DOS vulnerability in table editing (PMASA-2017-3) - CSS injection in themes (PMASA-2017-4) - SSRF in replication (PMASA-2017-6) - DOS in replication status (PMASA-2017-7) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-198=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-198=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): phpMyAdmin-4.4.15.10-31.2 - openSUSE Leap 42.1 (noarch): phpMyAdmin-4.4.15.10-31.2 References: https://www.suse.com/security/cve/CVE-2015-8980.html https://www.suse.com/security/cve/CVE-2016-6621.html https://bugzilla.suse.com/1021597

1 0

openSUSE-OU-2017:0371-1: moderate: Optional update for amanda
by maintenance＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Optional Update: Optional update for amanda ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0371-1 Rating: moderate References: #1022028 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for amanda adds the following functionality: - ssh support (boo#1022028) Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-199=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-199=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): amanda-3.3.6-6.1 amanda-debuginfo-3.3.6-6.1 amanda-debugsource-3.3.6-6.1 - openSUSE Leap 42.1 (i586 x86_64): amanda-3.3.6-4.1 amanda-debuginfo-3.3.6-4.1 amanda-debugsource-3.3.6-4.1 References: https://bugzilla.suse.com/1022028

1 0

openSUSE-RU-2017:0370-1: Recommended update for yum
by maintenance＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Recommended Update: Recommended update for yum ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0370-1 Rating: low References: #1012867 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yum provides the following fixes: - Fix parse restart_suggested flag required for SUSE Manager. (bsc#1012867) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-200=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-200=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): python-yum-3.4.3-18.1 yum-3.4.3-18.1 yum-updatesd-3.4.3-18.1 - openSUSE Leap 42.2 (noarch): yum-lang-3.4.3-18.1 - openSUSE Leap 42.1 (i586 x86_64): python-yum-3.4.3-17.1 yum-3.4.3-17.1 yum-updatesd-3.4.3-17.1 - openSUSE Leap 42.1 (noarch): yum-lang-3.4.3-17.1 References: https://bugzilla.suse.com/1012867

1 0

openSUSE-SU-2017:0369-1: Security update for mupdf
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0369-1 Rating: low References: #1019877 Cross-References: CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mupdf to version 1.10a fixes the following issues: These security issues were fixed: - CVE-2016-10132: Null pointer dereference in regexp because of a missing check after allocating memory allowing for DoS (bsc#1019877). - CVE-2016-10133: Heap buffer overflow write in js_stackoverflow allowing for DoS or possible code execution (bsc#1019877). - CVE-2016-10141: An integer overflow vulnerability triggered by a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition (bsc#1019877). These non-security issues were fixed: - A bug with mutool and saving PDF files using the 'ascii' option has been fixed. - Stop defining OPJ_STATIC Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-196=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): mupdf-1.10a-6.3 mupdf-devel-static-1.10a-6.3 References: https://www.suse.com/security/cve/CVE-2016-10132.html https://www.suse.com/security/cve/CVE-2016-10133.html https://www.suse.com/security/cve/CVE-2016-10141.html https://bugzilla.suse.com/1019877

1 0

openSUSE-SU-2017:0368-1: moderate: Security update for clamav-database
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0368-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav-database on January 30th refreshes the database. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-195=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-195=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201701300007-34.1 - openSUSE Leap 42.1 (noarch): clamav-database-201701300007-213.1 References:

1 0

openSUSE-SU-2017:0364-1: Security update for Wireshark
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for Wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0364-1 Rating: low References: #1021739 Cross-References: CVE-2017-5596 CVE-2017-5597 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to Wireshark 2.2.4 fixes two minor vulnerabilities that could be used to cause Wireshark to go into a large or infinite loop by sending specially crafted packages over the network or into a capture file. (bsc#1021739) - CVE-2017-5596: The ASTERIX dissector could go into an infinite loop (wnpa-sec-2017-01) - CVE-2017-5597: The DHCPv6 dissector could go into a large loop (wnpa-sec-2017-02) - Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.4.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-194=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): wireshark-2.2.4-7.1 wireshark-debuginfo-2.2.4-7.1 wireshark-debugsource-2.2.4-7.1 wireshark-devel-2.2.4-7.1 wireshark-ui-gtk-2.2.4-7.1 wireshark-ui-gtk-debuginfo-2.2.4-7.1 wireshark-ui-qt-2.2.4-7.1 wireshark-ui-qt-debuginfo-2.2.4-7.1 References: https://www.suse.com/security/cve/CVE-2017-5596.html https://www.suse.com/security/cve/CVE-2017-5597.html https://bugzilla.suse.com/1021739

1 0

openSUSE-SU-2017:0363-1: moderate: Security update for bzrtp
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for bzrtp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0363-1 Rating: moderate References: #1020844 Cross-References: CVE-2016-6271 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bzrtp fixes one security issue. The following vulnerability was fixed: - CVE-2016-6271: missing HVI check on DHPart2 packet reception may have allowed man-in-the-middle attackers to conduct spoofing attacks boo#1020844) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-193=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-193=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): bzrtp-debugsource-1.0.3-6.1 bzrtp-devel-1.0.3-6.1 libbzrtp0-1.0.3-6.1 libbzrtp0-debuginfo-1.0.3-6.1 - openSUSE Leap 42.2 (x86_64): libbzrtp0-32bit-1.0.3-6.1 libbzrtp0-debuginfo-32bit-1.0.3-6.1 - openSUSE Leap 42.1 (i586 x86_64): bzrtp-debugsource-1.0.3-5.1 bzrtp-devel-1.0.3-5.1 libbzrtp0-1.0.3-5.1 libbzrtp0-debuginfo-1.0.3-5.1 - openSUSE Leap 42.1 (x86_64): libbzrtp0-32bit-1.0.3-5.1 libbzrtp0-debuginfo-32bit-1.0.3-5.1 References: https://www.suse.com/security/cve/CVE-2016-6271.html https://bugzilla.suse.com/1020844

1 0

openSUSE-SU-2017:0362-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0362-1 Rating: moderate References: #982505 Cross-References: CVE-2016-4450 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following vulnerability: - CVE-2016-4450: Remote attackers could have caused a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-192=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-192=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): nginx-1.8.1-8.1 nginx-debuginfo-1.8.1-8.1 nginx-debugsource-1.8.1-8.1 - openSUSE Leap 42.1 (i586 x86_64): nginx-1.8.1-8.1 nginx-debuginfo-1.8.1-8.1 nginx-debugsource-1.8.1-8.1 References: https://www.suse.com/security/cve/CVE-2016-4450.html https://bugzilla.suse.com/982505

1 0

openSUSE-SU-2017:0361-1: moderate: Security update for nginx
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for nginx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0361-1 Rating: moderate References: #982505 Cross-References: CVE-2016-4450 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nginx fixes the following vulnerability: - CVE-2016-4450: Remote attackers could have caused a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-192=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nginx-1.8.1-9.1 nginx-debuginfo-1.8.1-9.1 nginx-debugsource-1.8.1-9.1 References: https://www.suse.com/security/cve/CVE-2016-4450.html https://bugzilla.suse.com/982505

1 0

openSUSE-RU-2017:0360-1: moderate: Recommended update for irssi
by maintenance＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Recommended Update: Recommended update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0360-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update contains irssi 1.0.0 for the SUSE Package Hub, with the following improvements: * irssiproxy can now forward all tags through a single port. * The kill buffer now remembers consecutive kills. New bindings were added: yank_next_cutbuffer and append_next_kill. * autolog_ignore_targets and activity_hide_targets learn a new syntax tag/* and * to ignore whole networks or everything. * hilight got a -matchcase flag to hilight case sensitively. * Display TLS connection information upon connect. You can disable this by setting tls_verbose_connect to FALSE * Certificate pinning for TLS certificates * /names and $[…] now uses utf8 string operations. * New setting completion_nicks_match_case * /channel /server /network now support modify subcommand. * New option sasl_disconnect_on_failure to disconnect when SASL log-in failed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-191=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.0.0-15.1 irssi-devel-1.0.0-15.1 References:

1 0

openSUSE-RU-2017:0359-1: Recommended update for MozillaFirefox-branding-openSUSE
by maintenance＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Recommended Update: Recommended update for MozillaFirefox-branding-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0359-1 Rating: low References: #1014292 #704121 #953164 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for MozillaFirefox-branding-openSUSE fixes a number of issues in the default bookmarks: - Fix openSUSE bookmarks which were not added to default profile. (boo#1014292) - Move openSUSE bookmarks from toolbar to menu - Use local favicon for all bookmarks. (Firefox 45+) - Fix links to "openSUSE Documentation" and "How to Participate" (boo#704121, boo#953164) - Remove DuckDuckGo search plugin. (included upstream) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-190=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-190=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-branding-openSUSE-45-9.1 - openSUSE Leap 42.1 (i586 x86_64): MozillaFirefox-branding-openSUSE-45-7.1 References: https://bugzilla.suse.com/1014292 https://bugzilla.suse.com/704121 https://bugzilla.suse.com/953164

1 0

openSUSE-SU-2017:0358-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0358-1 Rating: important References: #1017174 #1021814 #1021817 #1021818 #1021819 #1021820 #1021821 #1021822 #1021823 #1021824 #1021826 #1021827 #1021828 #1021830 #1021831 #1021832 #1021833 #1021835 #1021837 #1021839 #1021840 #1021841 Cross-References: CVE-2017-5373 CVE-2017-5374 CVE-2017-5375 CVE-2017-5376 CVE-2017-5377 CVE-2017-5378 CVE-2017-5379 CVE-2017-5380 CVE-2017-5381 CVE-2017-5382 CVE-2017-5383 CVE-2017-5384 CVE-2017-5385 CVE-2017-5386 CVE-2017-5387 CVE-2017-5388 CVE-2017-5389 CVE-2017-5390 CVE-2017-5391 CVE-2017-5392 CVE-2017-5393 CVE-2017-5394 CVE-2017-5395 CVE-2017-5396 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for MozillaFirefox to version 51.0.1 fixes security issues and bugs. These security issues were fixed: * CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bmo#1325200, boo#1021814) * CVE-2017-5376: Use-after-free in XSL (bmo#1311687, boo#1021817) CVE-2017-5377: Memory corruption with transforms to create gradients in Skia (bmo#1306883, boo#1021826) * CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bmo#1312001, bmo#1330769, boo#1021818) * CVE-2017-5379: Use-after-free in Web Animations (bmo#1309198,boo#1021827) * CVE-2017-5380: Potential use-after-free during DOM manipulations (bmo#1322107, boo#1021819) * CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bmo#1297361, boo#1021820) * CVE-2017-5389: WebExtensions can install additional add-ons via modified host requests (bmo#1308688, boo#1021828) * CVE-2017-5396: Use-after-free with Media Decoder (bmo#1329403, boo#1021821) * CVE-2017-5381: Certificate Viewer exporting can be used to navigate and save to arbitrary filesystem locations (bmo#1017616, boo#1021830) * CVE-2017-5382: Feed preview can expose privileged content errors and exceptions (bmo#1295322, boo#1021831) * CVE-2017-5383: Location bar spoofing with unicode characters (bmo#1323338, bmo#1324716, boo#1021822) * CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC) (bmo#1255474, boo#1021832) * CVE-2017-5385: Data sent in multipart channels ignores referrer-policy response headers (bmo#1295945, boo#1021833) * CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions (bmo#1319070, boo#1021823) * CVE-2017-5391: Content about: pages can load privileged about: pages (bmo#1309310, boo#1021835) * CVE-2017-5393: Remove addons.mozilla.org CDN from whitelist for mozAddonManager (bmo#1309282, boo#1021837) * CVE-2017-5387: Disclosure of local file existence through TRACK tag error messages (bmo#1295023, boo#1021839) * CVE-2017-5388: WebRTC can be used to generate a large amount of UDP traffic for DDOS attacks (bmo#1281482, boo#1021840) * CVE-2017-5374: Memory safety bugs (boo#1021841) * CVE-2017-5373: Memory safety bugs (boo#1021824) These non-security issues in MozillaFirefox were fixed: * Added support for FLAC (Free Lossless Audio Codec) playback * Added support for WebGL 2 * Added Georgian (ka) and Kabyle (kab) locales * Support saving passwords for forms without 'submit' events * Improved video performance for users without GPU acceleration * Zoom indicator is shown in the URL bar if the zoom level is not at default level * View passwords from the prompt before saving them * Remove Belarusian (be) locale * Use Skia for content rendering (Linux) * Improve recognition of LANGUAGE env variable (boo#1017174) * Multiprocess incompatibility did not correctly register with some add-ons (bmo#1333423) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-187=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-187=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-51.0.1-50.2 MozillaFirefox-branding-upstream-51.0.1-50.2 MozillaFirefox-buildsymbols-51.0.1-50.2 MozillaFirefox-debuginfo-51.0.1-50.2 MozillaFirefox-debugsource-51.0.1-50.2 MozillaFirefox-devel-51.0.1-50.2 MozillaFirefox-translations-common-51.0.1-50.2 MozillaFirefox-translations-other-51.0.1-50.2 - openSUSE Leap 42.1 (x86_64): MozillaFirefox-51.0.1-50.2 MozillaFirefox-branding-upstream-51.0.1-50.2 MozillaFirefox-buildsymbols-51.0.1-50.2 MozillaFirefox-debuginfo-51.0.1-50.2 MozillaFirefox-debugsource-51.0.1-50.2 MozillaFirefox-devel-51.0.1-50.2 MozillaFirefox-translations-common-51.0.1-50.2 MozillaFirefox-translations-other-51.0.1-50.2 References: https://www.suse.com/security/cve/CVE-2017-5373.html https://www.suse.com/security/cve/CVE-2017-5374.html https://www.suse.com/security/cve/CVE-2017-5375.html https://www.suse.com/security/cve/CVE-2017-5376.html https://www.suse.com/security/cve/CVE-2017-5377.html https://www.suse.com/security/cve/CVE-2017-5378.html https://www.suse.com/security/cve/CVE-2017-5379.html https://www.suse.com/security/cve/CVE-2017-5380.html https://www.suse.com/security/cve/CVE-2017-5381.html https://www.suse.com/security/cve/CVE-2017-5382.html https://www.suse.com/security/cve/CVE-2017-5383.html https://www.suse.com/security/cve/CVE-2017-5384.html https://www.suse.com/security/cve/CVE-2017-5385.html https://www.suse.com/security/cve/CVE-2017-5386.html https://www.suse.com/security/cve/CVE-2017-5387.html https://www.suse.com/security/cve/CVE-2017-5388.html https://www.suse.com/security/cve/CVE-2017-5389.html https://www.suse.com/security/cve/CVE-2017-5390.html https://www.suse.com/security/cve/CVE-2017-5391.html https://www.suse.com/security/cve/CVE-2017-5392.html https://www.suse.com/security/cve/CVE-2017-5393.html https://www.suse.com/security/cve/CVE-2017-5394.html https://www.suse.com/security/cve/CVE-2017-5395.html https://www.suse.com/security/cve/CVE-2017-5396.html https://bugzilla.suse.com/1017174 https://bugzilla.suse.com/1021814 https://bugzilla.suse.com/1021817 https://bugzilla.suse.com/1021818 https://bugzilla.suse.com/1021819 https://bugzilla.suse.com/1021820 https://bugzilla.suse.com/1021821 https://bugzilla.suse.com/1021822 https://bugzilla.suse.com/1021823 https://bugzilla.suse.com/1021824 https://bugzilla.suse.com/1021826 https://bugzilla.suse.com/1021827 https://bugzilla.suse.com/1021828 https://bugzilla.suse.com/1021830 https://bugzilla.suse.com/1021831 https://bugzilla.suse.com/1021832 https://bugzilla.suse.com/1021833 https://bugzilla.suse.com/1021835 https://bugzilla.suse.com/1021837 https://bugzilla.suse.com/1021839 https://bugzilla.suse.com/1021840 https://bugzilla.suse.com/1021841

1 0

openSUSE-SU-2017:0357-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0357-1 Rating: moderate References: #1021814 #1021817 #1021818 #1021819 #1021820 #1021821 #1021822 #1021824 #1021991 Cross-References: CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5390 CVE-2017-5396 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs. The following security issues from advisory MFSA 2017-03 were fixed (boo#1021991) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (boo#1021814) - CVE-2017-5376: Use-after-free in XSL (boo#1021817) - CVE-2017-5378: Pointer and frame data leakage of Javascript objects (boo#1021818) - CVE-2017-5380: Potential use-after-free during DOM manipulations (boo#1021819) - CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (boo#1021820) - CVE-2017-5396: Use-after-free with Media Decoder (boo#1021821) - CVE-2017-5383: Location bar spoofing with unicode characters (boo#1021822) - CVE-2017-5373: Memory safety bugs fixed in Thunderbird 45.7 (boo#1021824) The following non-security bugs were fixed: - Message preview pane non-functional after IMAP folder was renamed or moved - "Move To" button on "Search Messages" panel not working - Message sent to "undisclosed recipients" shows no recipient (non-functional since Thunderbird version 38) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-188=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-188=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): MozillaThunderbird-45.7.0-34.1 MozillaThunderbird-buildsymbols-45.7.0-34.1 MozillaThunderbird-debuginfo-45.7.0-34.1 MozillaThunderbird-debugsource-45.7.0-34.1 MozillaThunderbird-devel-45.7.0-34.1 MozillaThunderbird-translations-common-45.7.0-34.1 MozillaThunderbird-translations-other-45.7.0-34.1 - openSUSE Leap 42.1 (i586 x86_64): MozillaThunderbird-45.7.0-34.1 MozillaThunderbird-buildsymbols-45.7.0-34.1 MozillaThunderbird-debuginfo-45.7.0-34.1 MozillaThunderbird-debugsource-45.7.0-34.1 MozillaThunderbird-devel-45.7.0-34.1 MozillaThunderbird-translations-common-45.7.0-34.1 MozillaThunderbird-translations-other-45.7.0-34.1 References: https://www.suse.com/security/cve/CVE-2017-5373.html https://www.suse.com/security/cve/CVE-2017-5375.html https://www.suse.com/security/cve/CVE-2017-5376.html https://www.suse.com/security/cve/CVE-2017-5378.html https://www.suse.com/security/cve/CVE-2017-5380.html https://www.suse.com/security/cve/CVE-2017-5383.html https://www.suse.com/security/cve/CVE-2017-5390.html https://www.suse.com/security/cve/CVE-2017-5396.html https://bugzilla.suse.com/1021814 https://bugzilla.suse.com/1021817 https://bugzilla.suse.com/1021818 https://bugzilla.suse.com/1021819 https://bugzilla.suse.com/1021820 https://bugzilla.suse.com/1021821 https://bugzilla.suse.com/1021822 https://bugzilla.suse.com/1021824 https://bugzilla.suse.com/1021991

1 0

openSUSE-SU-2017:0356-1: important: Security update for seamonkey
by opensuse-security＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Security Update: Security update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0356-1 Rating: important References: #1017174 #1021636 #984637 #990856 Cross-References: CVE-2016-6354 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for Seamonkey to version 2.46 fixes security issues and bugs. The following vulnerabilities were fixed: - Fix all Gecko related security issues between 43.0.1 and 49.0.2 - CVE-2016-6354: buffer overrun in flex (boo#990856) The following non-security changes are included: - improve recognition of LANGUAGE env variable (boo#1017174) - improve TLS compatibility with certain websites (boo#1021636) - Seamonkey now requires NSPR 4.12 and NSS 3.25 - based on Gecko 49.0.2 - Chatzilla and DOM Inspector were disabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-189=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-189=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): seamonkey-2.46-9.2 seamonkey-debuginfo-2.46-9.2 seamonkey-debugsource-2.46-9.2 seamonkey-translations-common-2.46-9.2 seamonkey-translations-other-2.46-9.2 - openSUSE Leap 42.1 (i586 x86_64): seamonkey-2.46-9.2 seamonkey-debuginfo-2.46-9.2 seamonkey-debugsource-2.46-9.2 seamonkey-translations-common-2.46-9.2 seamonkey-translations-other-2.46-9.2 References: https://www.suse.com/security/cve/CVE-2016-6354.html https://bugzilla.suse.com/1017174 https://bugzilla.suse.com/1021636 https://bugzilla.suse.com/984637 https://bugzilla.suse.com/990856

1 0

openSUSE-RU-2017:0355-1: moderate: Recommended update for mozilla-nss, mozilla-nspr
by maintenance＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Recommended Update: Recommended update for mozilla-nss, mozilla-nspr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0355-1 Rating: moderate References: #1021636 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update contains mozilla-nspr version 4.13.1 and mozilla-nss version 3.28.1. In addition to fixing bugs, these versions are required dependencies for security updates for Mozilla Firefox and Seamonkey. These issues were fixed in mozilla-nss: - fix minor TLS compatibility issues with certain websites (boo#1021636) - NSS was updated to 3.28.1 - list of root CA certificates was updates - includes support for TLS 1.3 draft -18 These issues in mozilla-nspr were fixed: - PL_strcmp (and others) were fixed to return consistent results when one of the arguments is NULL. - PollEvent was fixed to not block on clear. - Pipes are always nonblocking. - PR_GetNameForIdentity: added thread safety lock and bound checks. - Removed the PLArena freelist. - Avoid some integer overflows. - fixed several comments. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-186=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-186=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libfreebl3-3.28.1-35.1 libfreebl3-debuginfo-3.28.1-35.1 libsoftokn3-3.28.1-35.1 libsoftokn3-debuginfo-3.28.1-35.1 mozilla-nspr-4.13.1-13.1 mozilla-nspr-debuginfo-4.13.1-13.1 mozilla-nspr-debugsource-4.13.1-13.1 mozilla-nspr-devel-4.13.1-13.1 mozilla-nss-3.28.1-35.1 mozilla-nss-certs-3.28.1-35.1 mozilla-nss-certs-debuginfo-3.28.1-35.1 mozilla-nss-debuginfo-3.28.1-35.1 mozilla-nss-debugsource-3.28.1-35.1 mozilla-nss-devel-3.28.1-35.1 mozilla-nss-sysinit-3.28.1-35.1 mozilla-nss-sysinit-debuginfo-3.28.1-35.1 mozilla-nss-tools-3.28.1-35.1 mozilla-nss-tools-debuginfo-3.28.1-35.1 - openSUSE Leap 42.2 (x86_64): libfreebl3-32bit-3.28.1-35.1 libfreebl3-debuginfo-32bit-3.28.1-35.1 libsoftokn3-32bit-3.28.1-35.1 libsoftokn3-debuginfo-32bit-3.28.1-35.1 mozilla-nspr-32bit-4.13.1-13.1 mozilla-nspr-debuginfo-32bit-4.13.1-13.1 mozilla-nss-32bit-3.28.1-35.1 mozilla-nss-certs-32bit-3.28.1-35.1 mozilla-nss-certs-debuginfo-32bit-3.28.1-35.1 mozilla-nss-debuginfo-32bit-3.28.1-35.1 mozilla-nss-sysinit-32bit-3.28.1-35.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.1-35.1 - openSUSE Leap 42.1 (i586 x86_64): libfreebl3-3.28.1-35.2 libfreebl3-debuginfo-3.28.1-35.2 libsoftokn3-3.28.1-35.2 libsoftokn3-debuginfo-3.28.1-35.2 mozilla-nspr-4.13.1-13.1 mozilla-nspr-debuginfo-4.13.1-13.1 mozilla-nspr-debugsource-4.13.1-13.1 mozilla-nspr-devel-4.13.1-13.1 mozilla-nss-3.28.1-35.2 mozilla-nss-certs-3.28.1-35.2 mozilla-nss-certs-debuginfo-3.28.1-35.2 mozilla-nss-debuginfo-3.28.1-35.2 mozilla-nss-debugsource-3.28.1-35.2 mozilla-nss-devel-3.28.1-35.2 mozilla-nss-sysinit-3.28.1-35.2 mozilla-nss-sysinit-debuginfo-3.28.1-35.2 mozilla-nss-tools-3.28.1-35.2 mozilla-nss-tools-debuginfo-3.28.1-35.2 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.28.1-35.2 libfreebl3-debuginfo-32bit-3.28.1-35.2 libsoftokn3-32bit-3.28.1-35.2 libsoftokn3-debuginfo-32bit-3.28.1-35.2 mozilla-nspr-32bit-4.13.1-13.1 mozilla-nspr-debuginfo-32bit-4.13.1-13.1 mozilla-nss-32bit-3.28.1-35.2 mozilla-nss-certs-32bit-3.28.1-35.2 mozilla-nss-certs-debuginfo-32bit-3.28.1-35.2 mozilla-nss-debuginfo-32bit-3.28.1-35.2 mozilla-nss-sysinit-32bit-3.28.1-35.2 mozilla-nss-sysinit-debuginfo-32bit-3.28.1-35.2 References: https://bugzilla.suse.com/1021636

1 0

openSUSE-SU-2017:0354-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 01 Feb '17

01 Feb '17

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0354-1 Rating: moderate References: #1021814 #1021817 #1021818 #1021819 #1021820 #1021821 #1021822 #1021824 #1021991 Cross-References: CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5390 CVE-2017-5396 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update to Mozilla Thunderbird 45.7.0 fixes security issues and bugs. The following security issues from advisory MFSA 2017-03 were fixed (boo#1021991) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts: - CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (boo#1021814) - CVE-2017-5376: Use-after-free in XSL (boo#1021817) - CVE-2017-5378: Pointer and frame data leakage of Javascript objects (boo#1021818) - CVE-2017-5380: Potential use-after-free during DOM manipulations (boo#1021819) - CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (boo#1021820) - CVE-2017-5396: Use-after-free with Media Decoder (boo#1021821) - CVE-2017-5383: Location bar spoofing with unicode characters (boo#1021822) - CVE-2017-5373: Memory safety bugs fixed in Thunderbird 45.7 (boo#1021824) The following non-security bugs were fixed: - Message preview pane non-functional after IMAP folder was renamed or moved - "Move To" button on "Search Messages" panel not working - Message sent to "undisclosed recipients" shows no recipient (non-functional since Thunderbird version 38) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-188=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): MozillaThunderbird-45.7.0-23.1 MozillaThunderbird-devel-45.7.0-23.1 MozillaThunderbird-translations-common-45.7.0-23.1 MozillaThunderbird-translations-other-45.7.0-23.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64): MozillaThunderbird-debuginfo-45.7.0-23.1 MozillaThunderbird-debugsource-45.7.0-23.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-buildsymbols-45.7.0-23.1 References: https://www.suse.com/security/cve/CVE-2017-5373.html https://www.suse.com/security/cve/CVE-2017-5375.html https://www.suse.com/security/cve/CVE-2017-5376.html https://www.suse.com/security/cve/CVE-2017-5378.html https://www.suse.com/security/cve/CVE-2017-5380.html https://www.suse.com/security/cve/CVE-2017-5383.html https://www.suse.com/security/cve/CVE-2017-5390.html https://www.suse.com/security/cve/CVE-2017-5396.html https://bugzilla.suse.com/1021814 https://bugzilla.suse.com/1021817 https://bugzilla.suse.com/1021818 https://bugzilla.suse.com/1021819 https://bugzilla.suse.com/1021820 https://bugzilla.suse.com/1021821 https://bugzilla.suse.com/1021822 https://bugzilla.suse.com/1021824 https://bugzilla.suse.com/1021991

1 0