February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0563-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 27 Feb '17

27 Feb '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0563-1 Rating: important References: #1013236 Cross-References: CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5209 CVE-2016-5210 CVE-2016-5211 CVE-2016-5212 CVE-2016-5213 CVE-2016-5214 CVE-2016-5215 CVE-2016-5216 CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5220 CVE-2016-5221 CVE-2016-5222 CVE-2016-5223 CVE-2016-5224 CVE-2016-5225 CVE-2016-5226 CVE-2016-9650 CVE-2016-9651 CVE-2016-9652 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update to Chromium 55.0.2883.75 fixes the following vulnerabilities: - CVE-2016-9651: Private property access in V8 - CVE-2016-5208: Universal XSS in Blink - CVE-2016-5207: Universal XSS in Blink - CVE-2016-5206: Same-origin bypass in PDFium - CVE-2016-5205: Universal XSS in Blink - CVE-2016-5204: Universal XSS in Blink - CVE-2016-5209: Out of bounds write in Blink - CVE-2016-5203: Use after free in PDFium - CVE-2016-5210: Out of bounds write in PDFium - CVE-2016-5212: Local file disclosure in DevTools - CVE-2016-5211: Use after free in PDFium - CVE-2016-5213: Use after free in V8 - CVE-2016-5214: File download protection bypass - CVE-2016-5216: Use after free in PDFium - CVE-2016-5215: Use after free in Webaudio - CVE-2016-5217: Use of unvalidated data in PDFium - CVE-2016-5218: Address spoofing in Omnibox - CVE-2016-5219: Use after free in V8 - CVE-2016-5221: Integer overflow in ANGLE - CVE-2016-5220: Local file access in PDFium - CVE-2016-5222: Address spoofing in Omnibox - CVE-2016-9650: CSP Referrer disclosure - CVE-2016-5223: Integer overflow in PDFium - CVE-2016-5226: Limited XSS in Blink - CVE-2016-5225: CSP bypass in Blink - CVE-2016-5224: Same-origin bypass in SVG - CVE-2016-9652: Various fixes from internal audits, fuzzing and other initiatives The default bookmarks override was removed. The following packaging changes are included: - Switch to system libraries: harfbuzz, zlib, ffmpeg, where available. - Chromium now requires harfbuzz >= 1.3.0 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-1496=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-55.0.2883.75-2.1 chromium-55.0.2883.75-2.1 References: https://www.suse.com/security/cve/CVE-2016-5203.html https://www.suse.com/security/cve/CVE-2016-5204.html https://www.suse.com/security/cve/CVE-2016-5205.html https://www.suse.com/security/cve/CVE-2016-5206.html https://www.suse.com/security/cve/CVE-2016-5207.html https://www.suse.com/security/cve/CVE-2016-5208.html https://www.suse.com/security/cve/CVE-2016-5209.html https://www.suse.com/security/cve/CVE-2016-5210.html https://www.suse.com/security/cve/CVE-2016-5211.html https://www.suse.com/security/cve/CVE-2016-5212.html https://www.suse.com/security/cve/CVE-2016-5213.html https://www.suse.com/security/cve/CVE-2016-5214.html https://www.suse.com/security/cve/CVE-2016-5215.html https://www.suse.com/security/cve/CVE-2016-5216.html https://www.suse.com/security/cve/CVE-2016-5217.html https://www.suse.com/security/cve/CVE-2016-5218.html https://www.suse.com/security/cve/CVE-2016-5219.html https://www.suse.com/security/cve/CVE-2016-5220.html https://www.suse.com/security/cve/CVE-2016-5221.html https://www.suse.com/security/cve/CVE-2016-5222.html https://www.suse.com/security/cve/CVE-2016-5223.html https://www.suse.com/security/cve/CVE-2016-5224.html https://www.suse.com/security/cve/CVE-2016-5225.html https://www.suse.com/security/cve/CVE-2016-5226.html https://www.suse.com/security/cve/CVE-2016-9650.html https://www.suse.com/security/cve/CVE-2016-9651.html https://www.suse.com/security/cve/CVE-2016-9652.html https://bugzilla.suse.com/1013236

1 0

openSUSE-RU-2017:0144-2: moderate: Recommended update for sysdig
by maintenance＠opensuse.org 27 Feb '17

27 Feb '17

openSUSE Recommended Update: Recommended update for sysdig ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0144-2 Rating: moderate References: #1017181 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sysdig fixes the following issues: - Update to version 0.13.0 (boo#1017181): - Add ability to open concatenated capture files. - evtin.* fields can be used also for displaying now. - Fix driver for Kernel 4.9. - Fix on IPv4 mapped IPv6 parsing. - Fix memory leak #694. - Fix issue #687 about connecting to an K8s API server via HTTPS. - Fix compilation issues when using non-bundled OpenSSL #672. - Fix compilation issues under S390 architecture. - Fix various issues on k8s parsing. - Fix stale thread info when parsing processes within containers. (#665) - Avoid getting cwd from driver, causes issues on Kernel 4.8. - Add new filters container.mount.* to match container mount points. - Add new filter container.privileged to match containers running in privileged mode. - Add support for latest kubernetes features: k8s.deployment.* and k8s.rs.* filters are now available. - Added glob operator for strings, works as classic shell glob path matcher. - Added pmatch operator. - Add less package on docker image. - Enable building on s390x. - Use current macros for KMP building. - Drop sysdig-kmp-preamble. - Use exclusivearch instead of excluding architectures. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-90=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x x86_64): sysdig-0.13.0-2.1 sysdig-debuginfo-0.13.0-2.1 sysdig-debugsource-0.13.0-2.1 sysdig-kmp-default-0.13.0_k3.12.49_11-2.1 sysdig-kmp-default-debuginfo-0.13.0_k3.12.49_11-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): sysdig-kmp-xen-0.13.0_k3.12.49_11-2.1 sysdig-kmp-xen-debuginfo-0.13.0_k3.12.49_11-2.1 References: https://bugzilla.suse.com/1017181

1 0

openSUSE-RU-2017:0562-1: moderate: Recommended update for wwwoffle
by maintenance＠opensuse.org 25 Feb '17

25 Feb '17

openSUSE Recommended Update: Recommended update for wwwoffle ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0562-1 Rating: moderate References: #1026023 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for wwwoffle fixes the following issues: - boo#1026023: Browser connections to wwwoffle hit SYN flood detection limit In addition, the following upstream changes are included: - crypto key length tweaks Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-295=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-295=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): wwwoffle-2.9j-11.1 wwwoffle-debuginfo-2.9j-11.1 wwwoffle-debugsource-2.9j-11.1 - openSUSE Leap 42.1 (i586 x86_64): wwwoffle-2.9j-10.1 wwwoffle-debuginfo-2.9j-10.1 wwwoffle-debugsource-2.9j-10.1 References: https://bugzilla.suse.com/1026023

1 0

openSUSE-RU-2017:0561-1: moderate: Recommended update for gnuhealth, tryton, trytond, trytond_account_invoice
by maintenance＠opensuse.org 25 Feb '17

25 Feb '17

openSUSE Recommended Update: Recommended update for gnuhealth, tryton, trytond, trytond_account_invoice ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0561-1 Rating: moderate References: #1025542 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth fixes a number of bugs. Fixes in GNU Health 3.06: - Traceback when assigning a new meal order - Traceback when displaying patient critical info in non-english languages - Wrong widget for mealtime field - Remove readonly from patient meal order warning, to correctly save state of the field The dependencies tryton, trytond, trytond_account_invoice were updated for minor bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-296=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): gnuhealth-3.0.6-6.1 tryton-3.8.13-8.1 trytond-3.8.9-7.1 trytond_account_invoice-3.8.5-6.2 References: https://bugzilla.suse.com/1025542

1 0

openSUSE-RU-2017:0560-1: Recommended update for clamav-database
by maintenance＠opensuse.org 25 Feb '17

25 Feb '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0560-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh February 20th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-294=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-294=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201702200005-43.1 - openSUSE Leap 42.1 (noarch): clamav-database-201702200005-222.1 References:

1 0

openSUSE-RU-2017:0559-1: important: Recommended update for tigervnc
by maintenance＠opensuse.org 24 Feb '17

24 Feb '17

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0559-1 Rating: important References: #1024929 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tigervnc fixes the following issues: - reconnection to tigervnc session would fail (boo#1024929) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-293=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-293=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libXvnc-devel-1.6.0-14.1 libXvnc1-1.6.0-14.1 libXvnc1-debuginfo-1.6.0-14.1 tigervnc-1.6.0-14.1 tigervnc-debuginfo-1.6.0-14.1 tigervnc-debugsource-1.6.0-14.1 xorg-x11-Xvnc-1.6.0-14.1 xorg-x11-Xvnc-debuginfo-1.6.0-14.1 - openSUSE Leap 42.1 (i586 x86_64): tigervnc-1.5.0-35.1 tigervnc-debuginfo-1.5.0-35.1 tigervnc-debugsource-1.5.0-35.1 xorg-x11-Xvnc-1.5.0-35.1 xorg-x11-Xvnc-debuginfo-1.5.0-35.1 References: https://bugzilla.suse.com/1024929

1 0

openSUSE-RU-2017:0558-1: important: Recommended update for pidgin-sipe
by maintenance＠opensuse.org 23 Feb '17

23 Feb '17

openSUSE Recommended Update: Recommended update for pidgin-sipe ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0558-1 Rating: important References: #965323 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pidgin-sipe fixes the following issues: - bsc#965323: support newer versions of Skype for Business Pidgin-sipe was also updated to 1.22.0, including the following improvements: - Support for Lync Autodiscover - Application Sharing Viewer - Improve desktop sharing - Audio functionality improvements Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-291=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-291=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): libpurple-plugin-sipe-lang-1.22.0-3.1 pidgin-plugin-sipe-1.22.0-3.1 - openSUSE Leap 42.2 (x86_64): libpurple-plugin-sipe-1.22.0-3.1 libpurple-plugin-sipe-debuginfo-1.22.0-3.1 pidgin-sipe-debugsource-1.22.0-3.1 telepathy-sipe-1.22.0-3.1 telepathy-sipe-debuginfo-1.22.0-3.1 - openSUSE Leap 42.1 (i586 x86_64): libpurple-plugin-sipe-1.22.0-6.1 libpurple-plugin-sipe-debuginfo-1.22.0-6.1 pidgin-sipe-debugsource-1.22.0-6.1 telepathy-sipe-1.22.0-6.1 telepathy-sipe-debuginfo-1.22.0-6.1 - openSUSE Leap 42.1 (noarch): libpurple-plugin-sipe-lang-1.22.0-6.1 pidgin-plugin-sipe-1.22.0-6.1 References: https://bugzilla.suse.com/965323

1 0

openSUSE-SU-2017:0557-1: moderate: Security update for libXpm
by opensuse-security＠opensuse.org 23 Feb '17

23 Feb '17

openSUSE Security Update: Security update for libXpm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0557-1 Rating: moderate References: #1021315 Cross-References: CVE-2016-10164 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libXpm fixes the following issues: - A heap overflow in XPM handling could be used by attackers supplying XPM files to crash or potentially execute code. (bsc#1021315) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-292=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-292=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libXpm-debugsource-3.5.11-8.1 libXpm-devel-3.5.11-8.1 libXpm-tools-3.5.11-8.1 libXpm-tools-debuginfo-3.5.11-8.1 libXpm4-3.5.11-8.1 libXpm4-debuginfo-3.5.11-8.1 - openSUSE Leap 42.2 (x86_64): libXpm-devel-32bit-3.5.11-8.1 libXpm4-32bit-3.5.11-8.1 libXpm4-debuginfo-32bit-3.5.11-8.1 - openSUSE Leap 42.1 (i586 x86_64): libXpm-debugsource-3.5.11-7.1 libXpm-devel-3.5.11-7.1 libXpm-tools-3.5.11-7.1 libXpm-tools-debuginfo-3.5.11-7.1 libXpm4-3.5.11-7.1 libXpm4-debuginfo-3.5.11-7.1 - openSUSE Leap 42.1 (x86_64): libXpm-devel-32bit-3.5.11-7.1 libXpm4-32bit-3.5.11-7.1 libXpm4-debuginfo-32bit-3.5.11-7.1 References: https://www.suse.com/security/cve/CVE-2016-10164.html https://bugzilla.suse.com/1021315

1 0

openSUSE-SU-2017:0552-1: moderate: Security update for libquicktime
by opensuse-security＠opensuse.org 22 Feb '17

22 Feb '17

openSUSE Security Update: Security update for libquicktime ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0552-1 Rating: moderate References: #1022805 Cross-References: CVE-2016-2399 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libquicktime fixes the following issues: - CVE-2016-2399: A Integer overflow in the quicktime_read_pascal function in libquicktime allowed remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom [boo#1022805] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-288=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-288=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libquicktime-debugsource-1.2.4cvs20150223-6.1 libquicktime-devel-1.2.4cvs20150223-6.1 libquicktime-tools-1.2.4cvs20150223-6.1 libquicktime-tools-debuginfo-1.2.4cvs20150223-6.1 libquicktime0-1.2.4cvs20150223-6.1 libquicktime0-debuginfo-1.2.4cvs20150223-6.1 - openSUSE Leap 42.2 (x86_64): libquicktime0-32bit-1.2.4cvs20150223-6.1 libquicktime0-debuginfo-32bit-1.2.4cvs20150223-6.1 - openSUSE Leap 42.1 (i586 x86_64): libquicktime-debugsource-1.2.4cvs20150223-4.1 libquicktime-devel-1.2.4cvs20150223-4.1 libquicktime-tools-1.2.4cvs20150223-4.1 libquicktime-tools-debuginfo-1.2.4cvs20150223-4.1 libquicktime0-1.2.4cvs20150223-4.1 libquicktime0-debuginfo-1.2.4cvs20150223-4.1 - openSUSE Leap 42.1 (x86_64): libquicktime0-32bit-1.2.4cvs20150223-4.1 libquicktime0-debuginfo-32bit-1.2.4cvs20150223-4.1 References: https://www.suse.com/security/cve/CVE-2016-2399.html https://bugzilla.suse.com/1022805

1 0

openSUSE-SU-2017:0548-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 22 Feb '17

22 Feb '17

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0548-1 Rating: moderate References: #1022263 #1022264 #1022265 #1022283 #1022284 #1022553 Cross-References: CVE-2016-10166 CVE-2016-10167 CVE-2016-10168 CVE-2016-6906 CVE-2016-6912 CVE-2016-9317 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for gd fixes the following security issues: - CVE-2016-6906: An out-of-bounds read in TGA decompression was fixed which could have lead to crashes. (bsc#1022553) - CVE-2016-6912: Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) allowed remote attackers to have unspecified impact via large width and height values. (bsc#1022284) - CVE-2016-9317: The gdImageCreate function in the GD Graphics Library (aka libgd) allowed remote attackers to cause a denial of service (system hang) via an oversized image. (bsc#1022283) - CVE-2016-10166: A potential unsigned underflow in gd interpolation functions could lead to memory corruption in the GD Graphics Library (aka libgd) (bsc#1022263) - CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx() could lead to libgd running out of memory even on small files. (bsc#1022264) - CVE-2016-10168: A signed integer overflow in the GD Graphics Library (aka libgd) could lead to memory corruption (bsc#1022265) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-289=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-289=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gd-2.1.0-16.1 gd-debuginfo-2.1.0-16.1 gd-debugsource-2.1.0-16.1 gd-devel-2.1.0-16.1 - openSUSE Leap 42.2 (x86_64): gd-32bit-2.1.0-16.1 gd-debuginfo-32bit-2.1.0-16.1 - openSUSE Leap 42.1 (i586 x86_64): gd-2.1.0-19.1 gd-debuginfo-2.1.0-19.1 gd-debugsource-2.1.0-19.1 gd-devel-2.1.0-19.1 - openSUSE Leap 42.1 (x86_64): gd-32bit-2.1.0-19.1 gd-debuginfo-32bit-2.1.0-19.1 References: https://www.suse.com/security/cve/CVE-2016-10166.html https://www.suse.com/security/cve/CVE-2016-10167.html https://www.suse.com/security/cve/CVE-2016-10168.html https://www.suse.com/security/cve/CVE-2016-6906.html https://www.suse.com/security/cve/CVE-2016-6912.html https://www.suse.com/security/cve/CVE-2016-9317.html https://bugzilla.suse.com/1022263 https://bugzilla.suse.com/1022264 https://bugzilla.suse.com/1022265 https://bugzilla.suse.com/1022283 https://bugzilla.suse.com/1022284 https://bugzilla.suse.com/1022553

1 0