February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:0383-1: Recommended update for libpfm
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Recommended Update: Recommended update for libpfm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0383-1 Rating: low References: #1017407 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds a few useful utilities to libpfm-devel: check_events, evt2raw and showevtinfo. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-206=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-206=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libpfm-debugsource-4.6.0-7.1 libpfm-devel-4.6.0-7.1 libpfm-devel-debuginfo-4.6.0-7.1 libpfm-devel-static-4.6.0-7.1 libpfm4-4.6.0-7.1 libpfm4-debuginfo-4.6.0-7.1 python-libpfm-4.6.0-7.1 python-libpfm-debuginfo-4.6.0-7.1 - openSUSE Leap 42.2 (x86_64): libpfm4-32bit-4.6.0-7.1 libpfm4-debuginfo-32bit-4.6.0-7.1 - openSUSE Leap 42.1 (i586 x86_64): libpfm-debugsource-4.6.0-6.1 libpfm-devel-4.6.0-6.1 libpfm-devel-debuginfo-4.6.0-6.1 libpfm-devel-static-4.6.0-6.1 libpfm4-4.6.0-6.1 libpfm4-debuginfo-4.6.0-6.1 python-libpfm-4.6.0-6.1 python-libpfm-debuginfo-4.6.0-6.1 - openSUSE Leap 42.1 (x86_64): libpfm4-32bit-4.6.0-6.1 libpfm4-debuginfo-32bit-4.6.0-6.1 References: https://bugzilla.suse.com/1017407

1 0

openSUSE-SU-2017:0382-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0382-1 Rating: important References: #1020856 Cross-References: CVE-2016-5545 CVE-2017-3290 CVE-2017-3316 CVE-2017-3332 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for virtualbox to version 5.1.14 fixes the following issues: These security issues were fixed: - CVE-2016-5545: Vulnerability in the GUI subcomponent of virtualbox allows unauthenticated attacker unauthorized update, insert or delete access to some data as well as unauthorized read access to a subset of VirtualBox accessible data and unauthorized ability to cause a partial denial of service (bsc#1020856). - CVE-2017-3290: Vulnerability in the Shared Folder subcomponent of virtualbox allows high privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). - CVE-2017-3316: Vulnerability in the GUI subcomponent of virtualbox allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox (bsc#1020856). - CVE-2017-3332: Vulnerability in the SVGA Emulation subcomponent of virtualbox allows low privileged attacker unauthorized creation, deletion or modification access to critical data and unauthorized ability to cause a hang or frequently repeatable crash (bsc#1020856). For other changes please read the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-203=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): virtualbox-guest-desktop-icons-5.1.14-9.2 virtualbox-host-source-5.1.14-9.2 - openSUSE Leap 42.2 (x86_64): python-virtualbox-5.1.14-9.2 python-virtualbox-debuginfo-5.1.14-9.2 virtualbox-5.1.14-9.2 virtualbox-debuginfo-5.1.14-9.2 virtualbox-debugsource-5.1.14-9.2 virtualbox-devel-5.1.14-9.2 virtualbox-guest-kmp-default-5.1.14_k4.4.36_8-9.2 virtualbox-guest-kmp-default-debuginfo-5.1.14_k4.4.36_8-9.2 virtualbox-guest-tools-5.1.14-9.2 virtualbox-guest-tools-debuginfo-5.1.14-9.2 virtualbox-guest-x11-5.1.14-9.2 virtualbox-guest-x11-debuginfo-5.1.14-9.2 virtualbox-host-kmp-default-5.1.14_k4.4.36_8-9.2 virtualbox-host-kmp-default-debuginfo-5.1.14_k4.4.36_8-9.2 virtualbox-qt-5.1.14-9.2 virtualbox-qt-debuginfo-5.1.14-9.2 virtualbox-websrv-5.1.14-9.2 virtualbox-websrv-debuginfo-5.1.14-9.2 References: https://www.suse.com/security/cve/CVE-2016-5545.html https://www.suse.com/security/cve/CVE-2017-3290.html https://www.suse.com/security/cve/CVE-2017-3316.html https://www.suse.com/security/cve/CVE-2017-3332.html https://bugzilla.suse.com/1020856

1 0

openSUSE-RU-2017:0381-1: Recommended update for yast2-ruby-bindings
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Recommended Update: Recommended update for yast2-ruby-bindings ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0381-1 Rating: low References: #1014458 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-ruby-bindings fixes the following issues: - Do not crash when FastGettext is unable to find the empty.mo file (bsc#1014458) - Improved debugger support (FATE#318421) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-204=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-ruby-bindings-3.1.51.2-3.1 yast2-ruby-bindings-debuginfo-3.1.51.2-3.1 yast2-ruby-bindings-debugsource-3.1.51.2-3.1 References: https://bugzilla.suse.com/1014458

1 0

openSUSE-SU-2017:0374-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0374-1 Rating: important References: #1020905 #1022053 Cross-References: CVE-2016-2183 CVE-2016-5546 CVE-2016-5547 CVE-2016-5548 CVE-2016-5549 CVE-2016-5552 CVE-2017-3231 CVE-2017-3241 CVE-2017-3252 CVE-2017-3253 CVE-2017-3260 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: This update for java-1_8_0-openjdk fixes the following issues: Oracle Critical Patch Update of January 2017 (bsc#1020905) Upgrade to version jdk8u121 (icedtea 3.3.0): - S8138725: Add options for Javadoc generation - S8140353: Improve signature checking - S8151934, CVE-2017-3231: Resolve class resolution - S8156804, CVE-2017-3241: Better constraint checking - S8158406: Limited Parameter Processing - S8158997: JNDI Protocols Switch - S8159507: RuntimeVisibleAnnotation validation - S8161218: Better bytecode loading - S8161743, CVE-2017-3252: Provide proper login context - S8162577: Standardize logging levels - S8162973: Better component components - S8164143, CVE-2017-3260: Improve components for menu items - S8164147, CVE-2017-3261: Improve streaming socket output - S8165071, CVE-2016-2183: Expand TLS support - S8165344, CVE-2017-3272: Update concurrency support - S8166988, CVE-2017-3253: Improve image processing performance - S8167104, CVE-2017-3289: Additional class construction refinements - S8167223, CVE-2016-5552: URL handling improvements - S8168705, CVE-2016-5547: Better ObjectIdentifier validation - S8168714, CVE-2016-5546: Tighten ECDSA validation - S8168728, CVE-2016-5548: DSA signing improvements - S8168724, CVE-2016-5549: ECDSA signing improvements This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-201=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-201=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-6.4 java-1_8_0-openjdk-accessibility-1.8.0.121-6.4 java-1_8_0-openjdk-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-debugsource-1.8.0.121-6.4 java-1_8_0-openjdk-demo-1.8.0.121-6.4 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-devel-1.8.0.121-6.4 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-headless-1.8.0.121-6.4 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-6.4 java-1_8_0-openjdk-src-1.8.0.121-6.4 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-6.4 - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-21.4 java-1_8_0-openjdk-accessibility-1.8.0.121-21.4 java-1_8_0-openjdk-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-debugsource-1.8.0.121-21.4 java-1_8_0-openjdk-demo-1.8.0.121-21.4 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-devel-1.8.0.121-21.4 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-headless-1.8.0.121-21.4 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-21.4 java-1_8_0-openjdk-src-1.8.0.121-21.4 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-21.4 References: https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-5546.html https://www.suse.com/security/cve/CVE-2016-5547.html https://www.suse.com/security/cve/CVE-2016-5548.html https://www.suse.com/security/cve/CVE-2016-5549.html https://www.suse.com/security/cve/CVE-2016-5552.html https://www.suse.com/security/cve/CVE-2017-3231.html https://www.suse.com/security/cve/CVE-2017-3241.html https://www.suse.com/security/cve/CVE-2017-3252.html https://www.suse.com/security/cve/CVE-2017-3253.html https://www.suse.com/security/cve/CVE-2017-3260.html https://www.suse.com/security/cve/CVE-2017-3261.html https://www.suse.com/security/cve/CVE-2017-3272.html https://www.suse.com/security/cve/CVE-2017-3289.html https://bugzilla.suse.com/1020905 https://bugzilla.suse.com/1022053

1 0

openSUSE-SU-2017:0373-1: Security update for mupdf
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0373-1 Rating: low References: #1019877 Cross-References: CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mupdf to version 1.10a fixes the following issues: These security issues were fixed: - CVE-2016-10132: Null pointer dereference in regexp because of a missing check after allocating memory allowing for DoS (bsc#1019877). - CVE-2016-10133: Heap buffer overflow write in js_stackoverflow allowing for DoS or possible code execution (bsc#1019877). - CVE-2016-10141: An integer overflow vulnerability triggered by a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition (bsc#1019877). These non-security issues were fixed: - A bug with mutool and saving PDF files using the 'ascii' option has been fixed. - Stop defining OPJ_STATIC - FictionBook (FB2) e-book support. - Simple SVG parser (a small subset of SVG only). - mutool convert: a new document conversion tool and interface. - Multi-threaded rendering in mudraw. - Updated base 14 fonts from URW. - New CJK font with language specific variants. - Hyperlink support in EPUB. - Alpha channel is now optional in pixmaps. - More aggressive purging of cached objects. - Partial image decoding for lower memory use when banding. - Reduced default set of built-in CMap tables to the minimum required. - FZ_ENABLE_PDF, _XPS, _JS, to disable features at compile time. - Function level linking. - Dropped pdf object generation numbers from public interfaces. - Simplified PDF page, xobject, and annotation internals. - Closing and freeing devices and writers are now separate steps. - Improved PDF annotation editing interface (still a work in progress). - Document writer interface. - Banded image writer interface. - Bidirectional layout for Arabic and Hebrew scripts. - Shaping complex scripts for EPUB text layout. - Noto fallback fonts for EPUB layout. - mutool create: - Create new PDF files from scratch. - Read an annotated content stream in a text file and write a PDF file, automatically embedding font and image resources. - mutool run: + Run javascript scripts with MuPDF bindings. + The interface is similar to the new Java interface. - mutool draw: + Optional multi-threaded operation (Windows and pthreads). + Optional low memory mode (primarily for testing). - Set to best anti-alias mode (8) by default. - Ship mupdf-x11-curl as default mupdf. Drop non-curl version. - New URW fonts with greek and cyrillic. - 64-bit file support. - Updated FreeType to version 2.6.1. - Various font substitution bug fixes. - EPUB improvements: User style sheets, GIF images, Table of Contents, CJK text, Page margins and many bug fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-197=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): mupdf-1.10a-10.1 mupdf-devel-static-1.10a-10.1 References: https://www.suse.com/security/cve/CVE-2016-10132.html https://www.suse.com/security/cve/CVE-2016-10133.html https://www.suse.com/security/cve/CVE-2016-10141.html https://bugzilla.suse.com/1019877

1 0

openSUSE-SU-2017:0372-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0372-1 Rating: moderate References: #1021597 Cross-References: CVE-2015-8980 CVE-2016-6621 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to phpMyAdmin 4.4.15.10 fixes the following security issues: - CVE-2016-6621: Multiple vulnerabilities in setup script (PMASA-2016-44) - Open redirect (PMASA-2017-1) - CVE-2015-8980: php-gettext code execution (PMASA-2017-2) - DOS vulnerability in table editing (PMASA-2017-3) - CSS injection in themes (PMASA-2017-4) - SSRF in replication (PMASA-2017-6) - DOS in replication status (PMASA-2017-7) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-198=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-198=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): phpMyAdmin-4.4.15.10-31.2 - openSUSE Leap 42.1 (noarch): phpMyAdmin-4.4.15.10-31.2 References: https://www.suse.com/security/cve/CVE-2015-8980.html https://www.suse.com/security/cve/CVE-2016-6621.html https://bugzilla.suse.com/1021597

1 0

openSUSE-OU-2017:0371-1: moderate: Optional update for amanda
by maintenance＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Optional Update: Optional update for amanda ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0371-1 Rating: moderate References: #1022028 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for amanda adds the following functionality: - ssh support (boo#1022028) Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-199=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-199=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): amanda-3.3.6-6.1 amanda-debuginfo-3.3.6-6.1 amanda-debugsource-3.3.6-6.1 - openSUSE Leap 42.1 (i586 x86_64): amanda-3.3.6-4.1 amanda-debuginfo-3.3.6-4.1 amanda-debugsource-3.3.6-4.1 References: https://bugzilla.suse.com/1022028

1 0

openSUSE-RU-2017:0370-1: Recommended update for yum
by maintenance＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Recommended Update: Recommended update for yum ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0370-1 Rating: low References: #1012867 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yum provides the following fixes: - Fix parse restart_suggested flag required for SUSE Manager. (bsc#1012867) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-200=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-200=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): python-yum-3.4.3-18.1 yum-3.4.3-18.1 yum-updatesd-3.4.3-18.1 - openSUSE Leap 42.2 (noarch): yum-lang-3.4.3-18.1 - openSUSE Leap 42.1 (i586 x86_64): python-yum-3.4.3-17.1 yum-3.4.3-17.1 yum-updatesd-3.4.3-17.1 - openSUSE Leap 42.1 (noarch): yum-lang-3.4.3-17.1 References: https://bugzilla.suse.com/1012867

1 0

openSUSE-SU-2017:0369-1: Security update for mupdf
by opensuse-security＠opensuse.org 03 Feb '17

03 Feb '17

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0369-1 Rating: low References: #1019877 Cross-References: CVE-2016-10132 CVE-2016-10133 CVE-2016-10141 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for mupdf to version 1.10a fixes the following issues: These security issues were fixed: - CVE-2016-10132: Null pointer dereference in regexp because of a missing check after allocating memory allowing for DoS (bsc#1019877). - CVE-2016-10133: Heap buffer overflow write in js_stackoverflow allowing for DoS or possible code execution (bsc#1019877). - CVE-2016-10141: An integer overflow vulnerability triggered by a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition (bsc#1019877). These non-security issues were fixed: - A bug with mutool and saving PDF files using the 'ascii' option has been fixed. - Stop defining OPJ_STATIC Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-196=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): mupdf-1.10a-6.3 mupdf-devel-static-1.10a-6.3 References: https://www.suse.com/security/cve/CVE-2016-10132.html https://www.suse.com/security/cve/CVE-2016-10133.html https://www.suse.com/security/cve/CVE-2016-10141.html https://bugzilla.suse.com/1019877

1 0

openSUSE-SU-2017:0368-1: moderate: Security update for clamav-database
by opensuse-security＠opensuse.org 02 Feb '17

02 Feb '17

openSUSE Security Update: Security update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0368-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav-database on January 30th refreshes the database. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-195=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-195=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201701300007-34.1 - openSUSE Leap 42.1 (noarch): clamav-database-201701300007-213.1 References:

1 0