February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0397-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0397-1 Rating: moderate References: #1019036 #1019037 Cross-References: CVE-2016-10128 CVE-2016-10129 CVE-2016-10130 CVE-2017-5338 CVE-2017-5339 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgit2 fixes the following issues: - CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). - CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-213=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libgit2-22-0.22.1-8.1 libgit2-22-debuginfo-0.22.1-8.1 libgit2-debugsource-0.22.1-8.1 libgit2-devel-0.22.1-8.1 - openSUSE Leap 42.1 (x86_64): libgit2-22-32bit-0.22.1-8.1 libgit2-22-debuginfo-32bit-0.22.1-8.1 References: https://www.suse.com/security/cve/CVE-2016-10128.html https://www.suse.com/security/cve/CVE-2016-10129.html https://www.suse.com/security/cve/CVE-2016-10130.html https://www.suse.com/security/cve/CVE-2017-5338.html https://www.suse.com/security/cve/CVE-2017-5339.html https://bugzilla.suse.com/1019036 https://bugzilla.suse.com/1019037

1 0

openSUSE-RU-2017:0395-1: moderate: Recommended update for alsa
by maintenance＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Recommended Update: Recommended update for alsa ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0395-1 Rating: moderate References: #1017824 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides alsa-lib 1.1.3 including a regression fix for clementine and various other fixes and improvements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-215=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): alsa-1.1.3-6.1 alsa-debugsource-1.1.3-6.1 alsa-devel-1.1.3-6.1 libasound2-1.1.3-6.1 libasound2-debuginfo-1.1.3-6.1 - openSUSE Leap 42.2 (noarch): alsa-docs-1.1.3-6.1 - openSUSE Leap 42.2 (x86_64): alsa-devel-32bit-1.1.3-6.1 libasound2-32bit-1.1.3-6.1 libasound2-debuginfo-32bit-1.1.3-6.1 References: https://bugzilla.suse.com/1017824

1 0

openSUSE-SU-2017:0391-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0391-1 Rating: moderate References: #1017310 #1017312 #1017313 #1017314 #1017318 #1017321 #1017322 #1017324 #1017325 #1017326 #1020443 #1020448 Cross-References: CVE-2016-10048 CVE-2016-10050 CVE-2016-10051 CVE-2016-10052 CVE-2016-10059 CVE-2016-10064 CVE-2016-10065 CVE-2016-10068 CVE-2016-10069 CVE-2016-10070 CVE-2016-10146 CVE-2017-5511 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update for GraphicsMagick fixes several issues. These security issues were fixed: - CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310) - CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312) - CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313) - CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314) - CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318) - CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321) - CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322) - CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324) - CVE-2016-10069: Add check for invalid mat file (bsc#1017325). - CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326) - CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443) - CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-214=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): GraphicsMagick-1.3.21-26.1 GraphicsMagick-debuginfo-1.3.21-26.1 GraphicsMagick-debugsource-1.3.21-26.1 GraphicsMagick-devel-1.3.21-26.1 libGraphicsMagick++-Q16-11-1.3.21-26.1 libGraphicsMagick++-Q16-11-debuginfo-1.3.21-26.1 libGraphicsMagick++-devel-1.3.21-26.1 libGraphicsMagick-Q16-3-1.3.21-26.1 libGraphicsMagick-Q16-3-debuginfo-1.3.21-26.1 libGraphicsMagick3-config-1.3.21-26.1 libGraphicsMagickWand-Q16-2-1.3.21-26.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.21-26.1 perl-GraphicsMagick-1.3.21-26.1 perl-GraphicsMagick-debuginfo-1.3.21-26.1 References: https://www.suse.com/security/cve/CVE-2016-10048.html https://www.suse.com/security/cve/CVE-2016-10050.html https://www.suse.com/security/cve/CVE-2016-10051.html https://www.suse.com/security/cve/CVE-2016-10052.html https://www.suse.com/security/cve/CVE-2016-10059.html https://www.suse.com/security/cve/CVE-2016-10064.html https://www.suse.com/security/cve/CVE-2016-10065.html https://www.suse.com/security/cve/CVE-2016-10068.html https://www.suse.com/security/cve/CVE-2016-10069.html https://www.suse.com/security/cve/CVE-2016-10070.html https://www.suse.com/security/cve/CVE-2016-10146.html https://www.suse.com/security/cve/CVE-2017-5511.html https://bugzilla.suse.com/1017310 https://bugzilla.suse.com/1017312 https://bugzilla.suse.com/1017313 https://bugzilla.suse.com/1017314 https://bugzilla.suse.com/1017318 https://bugzilla.suse.com/1017321 https://bugzilla.suse.com/1017322 https://bugzilla.suse.com/1017324 https://bugzilla.suse.com/1017325 https://bugzilla.suse.com/1017326 https://bugzilla.suse.com/1020443 https://bugzilla.suse.com/1020448

1 0

openSUSE-RU-2017:0390-1: Recommended update for yast2-ruby-bindings
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Recommended Update: Recommended update for yast2-ruby-bindings ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0390-1 Rating: low References: #1014458 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-ruby-bindings fixes the following issue: - Do not crash when FastGettext is unable to find the empty.mo file (bsc#1014458) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-210=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): yast2-ruby-bindings-3.1.40.1-3.1 yast2-ruby-bindings-debuginfo-3.1.40.1-3.1 yast2-ruby-bindings-debugsource-3.1.40.1-3.1 References: https://bugzilla.suse.com/1014458

1 0

openSUSE-SU-2017:0389-1: moderate: Security update for cpio
by opensuse-security＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Security Update: Security update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0389-1 Rating: moderate References: #1020108 #963448 Cross-References: CVE-2016-2037 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for cpio fixes two issues. This security issue was fixed: - CVE-2016-2037: The cpio_safer_name_suffix function in util.c in cpio allowed remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file (bsc#963448). This non-security issue was fixed: - bsc#1020108: Always use 32 bit CRC to prevent checksum errors for files greater than 32MB This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-209=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-209=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): cpio-2.11-33.1 cpio-debuginfo-2.11-33.1 cpio-debugsource-2.11-33.1 - openSUSE Leap 42.2 (noarch): cpio-lang-2.11-33.1 - openSUSE Leap 42.1 (i586 x86_64): cpio-2.11-32.1 cpio-debuginfo-2.11-32.1 cpio-debugsource-2.11-32.1 - openSUSE Leap 42.1 (noarch): cpio-lang-2.11-32.1 References: https://www.suse.com/security/cve/CVE-2016-2037.html https://bugzilla.suse.com/1020108 https://bugzilla.suse.com/963448

1 0

openSUSE-SU-2017:0388-1: moderate: Security update for gstreamer-0_10-plugins-bad
by opensuse-security＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Security Update: Security update for gstreamer-0_10-plugins-bad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0388-1 Rating: moderate References: #1013659 Cross-References: CVE-2016-9809 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gstreamer-0_10-plugins-bad fixes the following issue: - CVE-2016-9809: Off by one read in gst_h264_parse_set_caps() (bsc#1013659) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-208=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gstreamer-0_10-plugins-bad-0.10.23-27.1 gstreamer-0_10-plugins-bad-debuginfo-0.10.23-27.1 gstreamer-0_10-plugins-bad-debugsource-0.10.23-27.1 gstreamer-0_10-plugins-bad-devel-0.10.23-27.1 gstreamer-0_10-plugins-bad-doc-0.10.23-27.1 libgstbasecamerabinsrc-0_10-23-0.10.23-27.1 libgstbasecamerabinsrc-0_10-23-debuginfo-0.10.23-27.1 libgstbasevideo-0_10-23-0.10.23-27.1 libgstbasevideo-0_10-23-debuginfo-0.10.23-27.1 libgstcodecparsers-0_10-23-0.10.23-27.1 libgstcodecparsers-0_10-23-debuginfo-0.10.23-27.1 libgstphotography-0_10-23-0.10.23-27.1 libgstphotography-0_10-23-debuginfo-0.10.23-27.1 libgstsignalprocessor-0_10-23-0.10.23-27.1 libgstsignalprocessor-0_10-23-debuginfo-0.10.23-27.1 libgstvdp-0_10-23-0.10.23-27.1 libgstvdp-0_10-23-debuginfo-0.10.23-27.1 - openSUSE Leap 42.2 (noarch): gstreamer-0_10-plugins-bad-lang-0.10.23-27.1 - openSUSE Leap 42.2 (x86_64): gstreamer-0_10-plugins-bad-32bit-0.10.23-27.1 gstreamer-0_10-plugins-bad-debuginfo-32bit-0.10.23-27.1 libgstbasecamerabinsrc-0_10-23-32bit-0.10.23-27.1 libgstbasecamerabinsrc-0_10-23-debuginfo-32bit-0.10.23-27.1 libgstbasevideo-0_10-23-32bit-0.10.23-27.1 libgstbasevideo-0_10-23-debuginfo-32bit-0.10.23-27.1 libgstcodecparsers-0_10-23-32bit-0.10.23-27.1 libgstcodecparsers-0_10-23-debuginfo-32bit-0.10.23-27.1 libgstphotography-0_10-23-32bit-0.10.23-27.1 libgstphotography-0_10-23-debuginfo-32bit-0.10.23-27.1 libgstsignalprocessor-0_10-23-32bit-0.10.23-27.1 libgstsignalprocessor-0_10-23-debuginfo-32bit-0.10.23-27.1 libgstvdp-0_10-23-32bit-0.10.23-27.1 libgstvdp-0_10-23-debuginfo-32bit-0.10.23-27.1 References: https://www.suse.com/security/cve/CVE-2016-9809.html https://bugzilla.suse.com/1013659

1 0

openSUSE-RU-2017:0387-1: moderate: Recommended update for fate
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0387-1 Rating: moderate References: #1004536 #1006192 #1015881 #401198 #837526 #934673 #940928 #956270 #957827 #964882 #967367 #978153 #980276 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 13 recommended fixes can now be installed. Description: This update for fate fixes the following bugs and improvement requests: - boo#837526: fix filter in productviewer, rearrange columns and layout, also show feature open dates and deadlines - boo#964882: fix crash, QList::first() returns undefined on empty list, so check first - boo#1006192: have UTC time stamps in comments as in openfate - boo#940928: fix formatting and limit comment threads - boo#967367: remove bookmarks feature which is currently broken - boo#1004536: create an extra list for ECO stakeholders in feature view - boo#401198: Saving changes list of displayed features - bsc#934673: ECO edit tab is too small vertically on laptop screen - bsc#956270: Allow case-insensitive search - bsc#957827: Under Gnome/SLE12 checkboxes in "Only Status" pulldown menu of Custom Query dialog do not get displayed while KDE works - bsc#978153: usability improvements - bsc#980276: button icons on fresh Leap 42.1 / Gnome installation The following administative changes are included: - replace outdated inttools@ mail adress by featureadmin@ (bug via email) - make comments always editable by original author - fix fate process help view The following tracked packaging bug fixes are included: - require oxygen-icon-theme instead of oxygen5-icon-theme (boo#1015881) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-211=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-211=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): fate-1.5.5.7.1-18.1 fate-debuginfo-1.5.5.7.1-18.1 - openSUSE Leap 42.1 (i586 x86_64): fate-1.5.5.7.1-18.1 fate-debuginfo-1.5.5.7.1-18.1 References: https://bugzilla.suse.com/1004536 https://bugzilla.suse.com/1006192 https://bugzilla.suse.com/1015881 https://bugzilla.suse.com/401198 https://bugzilla.suse.com/837526 https://bugzilla.suse.com/934673 https://bugzilla.suse.com/940928 https://bugzilla.suse.com/956270 https://bugzilla.suse.com/957827 https://bugzilla.suse.com/964882 https://bugzilla.suse.com/967367 https://bugzilla.suse.com/978153 https://bugzilla.suse.com/980276

1 0

openSUSE-SU-2017:0386-1: important: Security update for gnutls
by opensuse-security＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0386-1 Rating: important References: #1005879 #1018832 #999646 Cross-References: CVE-2016-7444 CVE-2016-8610 CVE-2017-5335 CVE-2017-5336 CVE-2017-5337 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for gnutls fixes the following security issues: - GnuTLS could have crashed when processing maliciously crafted OpenPGP certificates (GNUTLS-SA-2017-2, bsc#1018832, CVE-2017-5335, CVE-2017-5337, CVE-2017-5336) - GnuTLS could have falsely accepted certificates when using OCSP (GNUTLS-SA-2016-3, bsc#999646, CVE-2016-7444) - GnuTLS could have suffered from 100% CPU load DoS attacks by using SSL alert packets during the handshake (bsc#1005879, CVE-2016-8610) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-207=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-207=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gnutls-3.2.15-9.1 gnutls-debuginfo-3.2.15-9.1 gnutls-debugsource-3.2.15-9.1 libgnutls-devel-3.2.15-9.1 libgnutls-openssl-devel-3.2.15-9.1 libgnutls-openssl27-3.2.15-9.1 libgnutls-openssl27-debuginfo-3.2.15-9.1 libgnutls28-3.2.15-9.1 libgnutls28-debuginfo-3.2.15-9.1 libgnutlsxx-devel-3.2.15-9.1 libgnutlsxx28-3.2.15-9.1 libgnutlsxx28-debuginfo-3.2.15-9.1 - openSUSE Leap 42.2 (x86_64): libgnutls-devel-32bit-3.2.15-9.1 libgnutls28-32bit-3.2.15-9.1 libgnutls28-debuginfo-32bit-3.2.15-9.1 - openSUSE Leap 42.1 (i586 x86_64): gnutls-3.2.15-8.1 gnutls-debuginfo-3.2.15-8.1 gnutls-debugsource-3.2.15-8.1 libgnutls-devel-3.2.15-8.1 libgnutls-openssl-devel-3.2.15-8.1 libgnutls-openssl27-3.2.15-8.1 libgnutls-openssl27-debuginfo-3.2.15-8.1 libgnutls28-3.2.15-8.1 libgnutls28-debuginfo-3.2.15-8.1 libgnutlsxx-devel-3.2.15-8.1 libgnutlsxx28-3.2.15-8.1 libgnutlsxx28-debuginfo-3.2.15-8.1 - openSUSE Leap 42.1 (x86_64): libgnutls-devel-32bit-3.2.15-8.1 libgnutls28-32bit-3.2.15-8.1 libgnutls28-debuginfo-32bit-3.2.15-8.1 References: https://www.suse.com/security/cve/CVE-2016-7444.html https://www.suse.com/security/cve/CVE-2016-8610.html https://www.suse.com/security/cve/CVE-2017-5335.html https://www.suse.com/security/cve/CVE-2017-5336.html https://www.suse.com/security/cve/CVE-2017-5337.html https://bugzilla.suse.com/1005879 https://bugzilla.suse.com/1018832 https://bugzilla.suse.com/999646

1 0

openSUSE-OU-2017:0385-1: Initial release of python3-kiwi and python3-future
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Optional Update: Initial release of python3-kiwi and python3-future ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0385-1 Rating: low References: #1011342 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds python3-kiwi and python3-future to openSUSE Leap 42.2. python3-kiwi is the next generation of the SUSE appliance builder. python3-future provides easy, safe support for Python 2/3 compatibility. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-205=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kiwi-boot-requires-8.28.3-2.1 kiwi-pxeboot-8.28.3-2.1 kiwi-tools-8.28.3-2.1 kiwi-tools-debuginfo-8.28.3-2.1 python3-kiwi-8.28.3-2.1 python3-kiwi-debugsource-8.28.3-2.1 - openSUSE Leap 42.2 (noarch): python3-future-0.16.0-2.1 References: https://bugzilla.suse.com/1011342

1 0

openSUSE-RU-2017:0384-1: moderate: Recommended update for tolua++
by maintenance＠opensuse.org 04 Feb '17

04 Feb '17

openSUSE Recommended Update: Recommended update for tolua++ ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0384-1 Rating: moderate References: #1018120 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tolua++ fixes the following issues: - tolua++ would add version/date information to generated code, causing dependent packages to be constantly re-published (bsc#1018120). Remove version and timestamp from generated files. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-202=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-202=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): tolua++-1.0.93-18.1 tolua++-debuginfo-1.0.93-18.1 tolua++-debugsource-1.0.93-18.1 - openSUSE Leap 42.1 (i586 x86_64): tolua++-1.0.93-17.1 tolua++-debuginfo-1.0.93-17.1 tolua++-debugsource-1.0.93-17.1 References: https://bugzilla.suse.com/1018120

1 0