February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0547-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 22 Feb '17

22 Feb '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0547-1 Rating: important References: #1005666 #1015787 #1018100 #1023762 #1023888 #1024081 #1024234 #1024508 #1024938 #1025047 #1025048 #1025049 #1025050 #1025051 #1025053 #1025055 #1025057 #1025058 #1025059 #1025060 #1025061 #1025062 #1025063 #1025064 #1025065 #1025066 #1025067 #1025069 #1025070 #1025071 #1025072 #1025073 #1025074 #1025075 #1025076 #1025077 #1025079 #1025080 #1025081 #1025235 #1026024 #865869 #904489 #927455 #929871 #935087 #935088 #936445 #937609 #937612 #937616 #938550 #938891 #938892 #942512 #942685 #942925 #944001 #945649 #946057 #946902 #949440 #949472 #951615 #951844 #957805 #960300 #963193 #965344 #966278 #966910 #968230 #972844 #972951 #972993 #973855 #975596 #977685 #981038 #981709 #983087 #984779 #985562 #985850 #987192 #989953 #990384 #992712 #993841 #994881 Cross-References: CVE-2017-5897 CVE-2017-5970 CVE-2017-5986 CVE-2017-6074 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 86 fixes is now available. Description: The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to cause a denial of service (invalid free) or possibly have unspecified other impact via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024). - CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bnc#1025235). - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938). - CVE-2017-5897: A potential remote denial of service within the IPv6 GRE protocol was fixed. (bsc#1023762) The following non-security bugs were fixed: - btrfs: support NFSv2 export (bnc#929871). - btrfs: Direct I/O: Fix space accounting (bsc#1025058). - btrfs: add RAID 5/6 BTRFS_RBIO_REBUILD_MISSING operation (bsc#1025069). - btrfs: bail out if block group has different mixed flag (bsc#1025072). - btrfs: be more precise on errors when getting an inode from disk (bsc#981038). - btrfs: check pending chunks when shrinking fs to avoid corruption (bnc#936445). - btrfs: check prepare_uptodate_page() error code earlier (bnc#966910). - btrfs: do not BUG() during drop snapshot (bsc#1025076). - btrfs: do not collect ordered extents when logging that inode exists (bsc#977685). - btrfs: do not initialize a space info as full to prevent ENOSPC (bnc#944001). - btrfs: do not leak reloc root nodes on error (bsc#1025074). - btrfs: fix block group ->space_info null pointer dereference (bnc#935088). - btrfs: fix chunk allocation regression leading to transaction abort (bnc#938550). - btrfs: fix crash on close_ctree() if cleaner starts new transaction (bnc#938891). - btrfs: fix deadlock between direct IO reads and buffered writes (bsc#973855). - btrfs: fix deadlock between direct IO write and defrag/readpages (bnc#965344). - btrfs: fix device replace of a missing RAID 5/6 device (bsc#1025057). - btrfs: fix empty symlink after creating symlink and fsync parent dir (bsc#977685). - btrfs: fix extent accounting for partial direct IO writes (bsc#1025062). - btrfs: fix file corruption after cloning inline extents (bnc#942512). - btrfs: fix file loss on log replay after renaming a file and fsync (bsc#977685). - btrfs: fix file read corruption after extent cloning and fsync (bnc#946902). - btrfs: fix fitrim discarding device area reserved for boot loader's use (bsc#904489). - btrfs: fix for incorrect directory entries after fsync log replay (bsc#957805, bsc#977685). - btrfs: fix hang when failing to submit bio of directIO (bnc#942685). - btrfs: fix incremental send failure caused by balance (bsc#985850). - btrfs: fix invalid page accesses in extent_same (dedup) ioctl (bnc#968230). - btrfs: fix listxattrs not listing all xattrs packed in the same item (bsc#1025063). - btrfs: fix loading of orphan roots leading to BUG_ON (bsc#972844). - btrfs: fix memory corruption on failure to submit bio for direct IO (bnc#942685). - btrfs: fix memory leak in do_walk_down (bsc#1025075). - btrfs: fix memory leak in reading btree blocks (bsc#1025071). - btrfs: fix order by which delayed references are run (bnc#949440). - btrfs: fix page reading in extent_same ioctl leading to csum errors (bnc#968230). - btrfs: fix qgroup rescan worker initialization (bsc#1025077). - btrfs: fix qgroup sanity tests (bnc#951615). - btrfs: fix race between balance and unused block group deletion (bnc#938892). - btrfs: fix race between fsync and lockless direct IO writes (bsc#977685). - btrfs: fix race waiting for qgroup rescan worker (bnc#960300). - btrfs: fix regression running delayed references when using qgroups (bnc#951615). - btrfs: fix regression when running delayed references (bnc#951615). - btrfs: fix relocation incorrectly dropping data references (bsc#990384). - btrfs: fix shrinking truncate when the no_holes feature is enabled (bsc#1025053). - btrfs: fix sleeping inside atomic context in qgroup rescan worker (bnc#960300). - btrfs: fix stale dir entries after removing a link and fsync (bnc#942925). - btrfs: fix unreplayable log after snapshot delete + parent dir fsync (bsc#977685). - btrfs: fix warning in backref walking (bnc#966278). - btrfs: fix warning of bytes_may_use (bsc#1025065). - btrfs: fix wrong check for btrfs_force_chunk_alloc() (bnc#938550). - btrfs: handle quota reserve failure properly (bsc#1005666). - btrfs: incremental send, check if orphanized dir inode needs delayed rename (bsc#1025049). - btrfs: incremental send, do not delay directory renames unnecessarily (bsc#1025048). - btrfs: incremental send, fix clone operations for compressed extents (fate#316463). - btrfs: incremental send, fix premature rmdir operations (bsc#1025064). - btrfs: keep dropped roots in cache until transaction commit (bnc#935087, bnc#945649, bnc#951615). - btrfs: remove misleading handling of missing device scrub (bsc#1025055). - btrfs: remove unnecessary locking of cleaner_mutex to avoid deadlock (bsc#904489). - btrfs: return gracefully from balance if fs tree is corrupted (bsc#1025073). - btrfs: send, do not bug on inconsistent snapshots (bsc#985850). - btrfs: send, fix corner case for reference overwrite detection (bsc#1025080). - btrfs: send, fix file corruption due to incorrect cloning operations (bsc#1025060). - btrfs: set UNWRITTEN for prealloc'ed extents in fiemap (bsc#1025047). - btrfs: test_check_exists: Fix infinite loop when searching for free space entries (bsc#987192). - btrfs: use btrfs_get_fs_root in resolve_indirect_ref (bnc#935087, bnc#945649). - btrfs: use received_uuid of parent during send (bsc#1025051). - btrfs: wake up extent state waiters on unlock through clear_extent_bits (bsc#1025050). - btrfs: Add handler for invalidate page (bsc#963193). - btrfs: Add qgroup tracing (bnc#935087, bnc#945649). - btrfs: Avoid truncate tailing page if fallocate range does not exceed inode size (bsc#1025059). - btrfs: Continue write in case of can_not_nocow (bsc#1025070). - btrfs: Ensure proper sector alignment for btrfs_free_reserved_data_space (bsc#1005666). - btrfs: Export and move leaf/subtree qgroup helpers to qgroup.c (bsc#983087). - btrfs: Fix a data space underflow warning (bsc#985562, bsc#975596, bsc#984779). - btrfs: Handle unaligned length in extent_same (bsc#937609). - btrfs: abort transaction on btrfs_reloc_cow_block() (bsc#1025081). - btrfs: add missing discards when unpinning extents with -o discard (bsc#904489). - btrfs: advertise which crc32c implementation is being used on mount (bsc#946057). - btrfs: allow dedupe of same inode (bsc#1025067). - btrfs: backref: Add special time_seq == (u64)-1 case for btrfs_find_all_roots() (bnc#935087, bnc#945649). - btrfs: backref: Do not merge refs which are not for same block (bnc#935087, bnc#945649). - btrfs: btrfs_issue_discard ensure offset/length are aligned to sector boundaries (bsc#904489). - btrfs: change max_inline default to 2048 (bsc#949472). - btrfs: delayed-ref: Cleanup the unneeded functions (bnc#935087, bnc#945649). - btrfs: delayed-ref: Use list to replace the ref_root in ref_head (bnc#935087, bnc#945649). - btrfs: delayed-ref: double free in btrfs_add_delayed_tree_ref() (bsc#1025079). - btrfs: delayed_ref: Add new function to record reserved space into delayed ref (bsc#963193). - btrfs: delayed_ref: release and free qgroup reserved at proper timing (bsc#963193). - btrfs: disable defrag of tree roots. - btrfs: do not create or leak aliased root while cleaning up orphans (bsc#994881). - btrfs: do not update mtime/ctime on deduped inodes (bsc#937616). - btrfs: explictly delete unused block groups in close_ctree and ro-remount (bsc#904489). - btrfs: extent-tree: Add new version of btrfs_check_data_free_space and btrfs_free_reserved_data_space (bsc#963193). - btrfs: extent-tree: Add new version of btrfs_delalloc_reserve/release_space (bsc#963193). - btrfs: extent-tree: Switch to new check_data_free_space and free_reserved_data_space (bsc#963193). - btrfs: extent-tree: Switch to new delalloc space reserve and release (bsc#963193). - btrfs: extent-tree: Use ref_node to replace unneeded parameters in __inc_extent_ref() and __free_extent() (bnc#935087, bnc#945649). - btrfs: extent_io: Introduce needed structure for recoding set/clear bits (bsc#963193). - btrfs: extent_io: Introduce new function clear_record_extent_bits() (bsc#963193). - btrfs: extent_io: Introduce new function set_record_extent_bits (bsc#963193). - btrfs: fallocate: Add support to accurate qgroup reserve (bsc#963193). - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls (bsc#1018100). - btrfs: fix clone / extent-same deadlocks (bsc#937612). - btrfs: fix deadlock with extent-same and readpage (bsc#937612). - btrfs: fix resending received snapshot with parent (bsc#1025061). - btrfs: handle non-fatal errors in btrfs_qgroup_inherit() (bsc#972951). - btrfs: increment ctx->pos for every emitted or skipped dirent in readdir (bsc#981709). - btrfs: iterate over unused chunk space in FITRIM (bsc#904489). - btrfs: make btrfs_issue_discard return bytes discarded (bsc#904489). - btrfs: make file clone aware of fatal signals (bsc#1015787). - btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609). - btrfs: properly track when rescan worker is running (bsc#989953). - btrfs: provide super_operations->inode_get_dev (bsc#927455). - btrfs: qgroup: Add function qgroup_update_counters() (bnc#935087, bnc#945649). - btrfs: qgroup: Add function qgroup_update_refcnt() (bnc#935087, bnc#945649). - btrfs: qgroup: Add handler for NOCOW and inline (bsc#963193). - btrfs: qgroup: Add new function to record old_roots (bnc#935087, bnc#945649). - btrfs: qgroup: Add new qgroup calculation function btrfs_qgroup_account_extents() (bnc#935087, bnc#945649). - btrfs: qgroup: Add new trace point for qgroup data reserve (bsc#963193). - btrfs: qgroup: Add the ability to skip given qgroup for old/new_roots (bnc#935087, bnc#945649). - btrfs: qgroup: Avoid calling btrfs_free_reserved_data_space in clear_bit_hook (bsc#963193). - btrfs: qgroup: Check if qgroup reserved space leaked (bsc#963193). - btrfs: qgroup: Cleanup old inaccurate facilities (bsc#963193). - btrfs: qgroup: Cleanup open-coded old/new_refcnt update and read (bnc#935087, bnc#945649). - btrfs: qgroup: Cleanup the old ref_node-oriented mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: Do not copy extent buffer to do qgroup rescan (bnc#960300). - btrfs: qgroup: Fix a race in delayed_ref which leads to abort trans (bsc#963193). - btrfs: qgroup: Fix a rebase bug which will cause qgroup double free (bsc#963193). - btrfs: qgroup: Fix a regression in qgroup reserved space (bnc#935087, bnc#945649). - btrfs: qgroup: Fix qgroup accounting when creating snapshot (bsc#972993). - btrfs: qgroup: Fix qgroup data leaking by using subtree tracing (bsc#983087). - btrfs: qgroup: Introduce btrfs_qgroup_reserve_data function (bsc#963193). - btrfs: qgroup: Introduce functions to release/free qgroup reserve data space (bsc#963193). - btrfs: qgroup: Introduce new functions to reserve/free metadata (bsc#963193). - btrfs: qgroup: Make snapshot accounting work with new extent-oriented qgroup (bnc#935087, bnc#945649). - btrfs: qgroup: Record possible quota-related extent for qgroup (bnc#935087, bnc#945649). - btrfs: qgroup: Switch rescan to new mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: Switch self test to extent-oriented qgroup mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: Switch to new extent-oriented qgroup mechanism (bnc#935087, bnc#945649). - btrfs: qgroup: Use new metadata reservation (bsc#963193). - btrfs: qgroup: account shared subtree during snapshot delete (bnc#935087, bnc#945649). - btrfs: qgroup: exit the rescan worker during umount (bnc#960300). - btrfs: qgroup: fix quota disable during rescan (bnc#960300). - btrfs: remove old tree_root dirent processing in btrfs_real_readdir() (bsc#981709). - btrfs: serialize subvolume mounts with potentially mismatching rw flags (bsc#951844). - btrfs: skip superblocks during discard (bsc#904489). - btrfs: syslog when quota is disabled. - btrfs: syslog when quota is enabled - btrfs: ulist: Add ulist_del() function (bnc#935087, bnc#945649). - btrfs: use the new VFS super_block_dev (bnc#865869). - btrfs: waiting on qgroup rescan should not always be interruptible (bsc#992712). - fs/super.c: add new super block sub devices super_block_dev (bnc#865869). - fs/super.c: fix race between freeze_super() and thaw_super() (bsc#1025066). - kabi: only use sops->get_inode_dev with proper fsflag (bsc#927455). - qgroup: Prevent qgroup->reserved from going subzero (bsc#993841). - vfs: add super_operations->get_inode_dev (bsc#927455). - xfs: do not allow di_size with high bit set (bsc#1024234). - xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508). - xfs: fix broken multi-fsb buffer logging (bsc#1024081). - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888). - xfs: track and serialize in-flight async buffers against unmount - kABI (bsc#1024508). - xfs: track and serialize in-flight async buffers against unmount (bsc#1024508). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-287=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.38-50.1 kernel-default-base-4.1.38-50.1 kernel-default-base-debuginfo-4.1.38-50.1 kernel-default-debuginfo-4.1.38-50.1 kernel-default-debugsource-4.1.38-50.1 kernel-default-devel-4.1.38-50.1 kernel-obs-build-4.1.38-50.2 kernel-obs-build-debugsource-4.1.38-50.2 kernel-obs-qa-4.1.38-50.1 kernel-syms-4.1.38-50.1 - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.38-50.1 kernel-debug-base-4.1.38-50.1 kernel-debug-base-debuginfo-4.1.38-50.1 kernel-debug-debuginfo-4.1.38-50.1 kernel-debug-debugsource-4.1.38-50.1 kernel-debug-devel-4.1.38-50.1 kernel-debug-devel-debuginfo-4.1.38-50.1 kernel-ec2-4.1.38-50.1 kernel-ec2-base-4.1.38-50.1 kernel-ec2-base-debuginfo-4.1.38-50.1 kernel-ec2-debuginfo-4.1.38-50.1 kernel-ec2-debugsource-4.1.38-50.1 kernel-ec2-devel-4.1.38-50.1 kernel-pv-4.1.38-50.1 kernel-pv-base-4.1.38-50.1 kernel-pv-base-debuginfo-4.1.38-50.1 kernel-pv-debuginfo-4.1.38-50.1 kernel-pv-debugsource-4.1.38-50.1 kernel-pv-devel-4.1.38-50.1 kernel-vanilla-4.1.38-50.1 kernel-vanilla-debuginfo-4.1.38-50.1 kernel-vanilla-debugsource-4.1.38-50.1 kernel-vanilla-devel-4.1.38-50.1 kernel-xen-4.1.38-50.1 kernel-xen-base-4.1.38-50.1 kernel-xen-base-debuginfo-4.1.38-50.1 kernel-xen-debuginfo-4.1.38-50.1 kernel-xen-debugsource-4.1.38-50.1 kernel-xen-devel-4.1.38-50.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.38-50.1 kernel-docs-4.1.38-50.3 kernel-docs-html-4.1.38-50.3 kernel-docs-pdf-4.1.38-50.3 kernel-macros-4.1.38-50.1 kernel-source-4.1.38-50.1 kernel-source-vanilla-4.1.38-50.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.38-50.1 kernel-pae-base-4.1.38-50.1 kernel-pae-base-debuginfo-4.1.38-50.1 kernel-pae-debuginfo-4.1.38-50.1 kernel-pae-debugsource-4.1.38-50.1 kernel-pae-devel-4.1.38-50.1 References: https://www.suse.com/security/cve/CVE-2017-5897.html https://www.suse.com/security/cve/CVE-2017-5970.html https://www.suse.com/security/cve/CVE-2017-5986.html https://www.suse.com/security/cve/CVE-2017-6074.html https://bugzilla.suse.com/1005666 https://bugzilla.suse.com/1015787 https://bugzilla.suse.com/1018100 https://bugzilla.suse.com/1023762 https://bugzilla.suse.com/1023888 https://bugzilla.suse.com/1024081 https://bugzilla.suse.com/1024234 https://bugzilla.suse.com/1024508 https://bugzilla.suse.com/1024938 https://bugzilla.suse.com/1025047 https://bugzilla.suse.com/1025048 https://bugzilla.suse.com/1025049 https://bugzilla.suse.com/1025050 https://bugzilla.suse.com/1025051 https://bugzilla.suse.com/1025053 https://bugzilla.suse.com/1025055 https://bugzilla.suse.com/1025057 https://bugzilla.suse.com/1025058 https://bugzilla.suse.com/1025059 https://bugzilla.suse.com/1025060 https://bugzilla.suse.com/1025061 https://bugzilla.suse.com/1025062 https://bugzilla.suse.com/1025063 https://bugzilla.suse.com/1025064 https://bugzilla.suse.com/1025065 https://bugzilla.suse.com/1025066 https://bugzilla.suse.com/1025067 https://bugzilla.suse.com/1025069 https://bugzilla.suse.com/1025070 https://bugzilla.suse.com/1025071 https://bugzilla.suse.com/1025072 https://bugzilla.suse.com/1025073 https://bugzilla.suse.com/1025074 https://bugzilla.suse.com/1025075 https://bugzilla.suse.com/1025076 https://bugzilla.suse.com/1025077 https://bugzilla.suse.com/1025079 https://bugzilla.suse.com/1025080 https://bugzilla.suse.com/1025081 https://bugzilla.suse.com/1025235 https://bugzilla.suse.com/1026024 https://bugzilla.suse.com/865869 https://bugzilla.suse.com/904489 https://bugzilla.suse.com/927455 https://bugzilla.suse.com/929871 https://bugzilla.suse.com/935087 https://bugzilla.suse.com/935088 https://bugzilla.suse.com/936445 https://bugzilla.suse.com/937609 https://bugzilla.suse.com/937612 https://bugzilla.suse.com/937616 https://bugzilla.suse.com/938550 https://bugzilla.suse.com/938891 https://bugzilla.suse.com/938892 https://bugzilla.suse.com/942512 https://bugzilla.suse.com/942685 https://bugzilla.suse.com/942925 https://bugzilla.suse.com/944001 https://bugzilla.suse.com/945649 https://bugzilla.suse.com/946057 https://bugzilla.suse.com/946902 https://bugzilla.suse.com/949440 https://bugzilla.suse.com/949472 https://bugzilla.suse.com/951615 https://bugzilla.suse.com/951844 https://bugzilla.suse.com/957805 https://bugzilla.suse.com/960300 https://bugzilla.suse.com/963193 https://bugzilla.suse.com/965344 https://bugzilla.suse.com/966278 https://bugzilla.suse.com/966910 https://bugzilla.suse.com/968230 https://bugzilla.suse.com/972844 https://bugzilla.suse.com/972951 https://bugzilla.suse.com/972993 https://bugzilla.suse.com/973855 https://bugzilla.suse.com/975596 https://bugzilla.suse.com/977685 https://bugzilla.suse.com/981038 https://bugzilla.suse.com/981709 https://bugzilla.suse.com/983087 https://bugzilla.suse.com/984779 https://bugzilla.suse.com/985562 https://bugzilla.suse.com/985850 https://bugzilla.suse.com/987192 https://bugzilla.suse.com/989953 https://bugzilla.suse.com/990384 https://bugzilla.suse.com/992712 https://bugzilla.suse.com/993841 https://bugzilla.suse.com/994881

1 0

openSUSE-RU-2017:0546-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 22 Feb '17

22 Feb '17

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0546-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for opera to version 43.0.2442.991 fixes the following issues: Hi, Today, we have a Stable Opera update with fixes for: – QUIC memory leak – Layout issues on Mac older than 10.12 Chromium is also updated to version 56.0.2924.87. Please see: https://www.opera.com/blogs/desktop/2017/02/opera-stable-43-0-2442-991-upda te/ Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-290=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2017-290=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-43.0.2442.991-24.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-43.0.2442.991-61.1 References:

1 0

openSUSE-SU-2017:0541-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 22 Feb '17

22 Feb '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0541-1 Rating: important References: #1012382 #1018100 #1019168 #1020048 #1021082 #1022181 #1022304 #1023762 #1023884 #1023888 #1024081 #1024234 #1024508 #1024938 #1025235 #1026024 #969479 #982783 #989056 #998106 Cross-References: CVE-2017-5897 CVE-2017-5970 CVE-2017-5986 CVE-2017-6074 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 16 fixes is now available. Description: The openSUSE Leap 42.2 kernel was updated to 4.4.49 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-5986: A userlevel triggerable BUG_ON on sctp_wait_for_sndbuf was fixed. (bsc#1025235) - CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938). - CVE-2017-5897: A potential remote denial of service within the IPv6 GRE protocol was fixed. (bsc#1023762) - CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to cause a denial of service (invalid free) or possibly have unspecified other impact via an application that makes an IPV6_RECVPKTINFO setsockopt system call. (bsc#1026024). The following non-security bugs were fixed: - btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls (bsc#1018100). - iwlwifi: Expose the default fallback ucode API to module info (boo#1021082, boo#1023884). - kabi: protect struct tcp_fastopen_cookie (kabi). - md: ensure md devices are freed before module is unloaded (bsc#1022304). - md: Fix a regression reported by bsc#1020048 in patches.fixes/0003-md-lockless-I-O-submission-for-RAID1.patch (bsc#982783,bsc#998106,bsc#1020048). - net: ethtool: Initialize buffer when querying device channel settings (bsc#969479 FATE#320634). - net: implement netif_cond_dbg macro (bsc#1019168). - sfc: reduce severity of PIO buffer alloc failures (bsc#1019168). - sfc: refactor debug-or-warnings printks (bsc#1019168). - xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056). - xfs: do not allow di_size with high bit set (bsc#1024234). - xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508). - xfs: fix broken multi-fsb buffer logging (bsc#1024081). - xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056). - xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888). - xfs: track and serialize in-flight async buffers against unmount (bsc#1024508). - xfs: track and serialize in-flight async buffers against unmount - kABI (bsc#1024508). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-286=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): kernel-devel-4.4.49-16.1 kernel-docs-4.4.49-16.2 kernel-docs-html-4.4.49-16.2 kernel-docs-pdf-4.4.49-16.2 kernel-macros-4.4.49-16.1 kernel-source-4.4.49-16.1 kernel-source-vanilla-4.4.49-16.1 - openSUSE Leap 42.2 (x86_64): kernel-debug-4.4.49-16.1 kernel-debug-base-4.4.49-16.1 kernel-debug-base-debuginfo-4.4.49-16.1 kernel-debug-debuginfo-4.4.49-16.1 kernel-debug-debugsource-4.4.49-16.1 kernel-debug-devel-4.4.49-16.1 kernel-debug-devel-debuginfo-4.4.49-16.1 kernel-default-4.4.49-16.1 kernel-default-base-4.4.49-16.1 kernel-default-base-debuginfo-4.4.49-16.1 kernel-default-debuginfo-4.4.49-16.1 kernel-default-debugsource-4.4.49-16.1 kernel-default-devel-4.4.49-16.1 kernel-obs-build-4.4.49-16.1 kernel-obs-build-debugsource-4.4.49-16.1 kernel-obs-qa-4.4.49-16.1 kernel-syms-4.4.49-16.1 kernel-vanilla-4.4.49-16.1 kernel-vanilla-base-4.4.49-16.1 kernel-vanilla-base-debuginfo-4.4.49-16.1 kernel-vanilla-debuginfo-4.4.49-16.1 kernel-vanilla-debugsource-4.4.49-16.1 kernel-vanilla-devel-4.4.49-16.1 References: https://www.suse.com/security/cve/CVE-2017-5897.html https://www.suse.com/security/cve/CVE-2017-5970.html https://www.suse.com/security/cve/CVE-2017-5986.html https://www.suse.com/security/cve/CVE-2017-6074.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1018100 https://bugzilla.suse.com/1019168 https://bugzilla.suse.com/1020048 https://bugzilla.suse.com/1021082 https://bugzilla.suse.com/1022181 https://bugzilla.suse.com/1022304 https://bugzilla.suse.com/1023762 https://bugzilla.suse.com/1023884 https://bugzilla.suse.com/1023888 https://bugzilla.suse.com/1024081 https://bugzilla.suse.com/1024234 https://bugzilla.suse.com/1024508 https://bugzilla.suse.com/1024938 https://bugzilla.suse.com/1025235 https://bugzilla.suse.com/1026024 https://bugzilla.suse.com/969479 https://bugzilla.suse.com/982783 https://bugzilla.suse.com/989056 https://bugzilla.suse.com/998106

1 0

openSUSE-SU-2017:0531-1: moderate: Security update for profanity
by opensuse-security＠opensuse.org 21 Feb '17

21 Feb '17

openSUSE Security Update: Security update for profanity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0531-1 Rating: moderate References: #1024696 Cross-References: CVE-2017-5592 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for profanity fixes the following issues: Changes in profanity: - CVE-2017-5592: The incorrect message carbons implementation that could allow user impersonification was fixed (boo#1024696) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-285=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-285=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): profanity-0.5.0-4.1 profanity-debuginfo-0.5.0-4.1 profanity-debugsource-0.5.0-4.1 profanity-mini-0.5.0-4.1 profanity-mini-debuginfo-0.5.0-4.1 profanity-standard-0.5.0-4.1 profanity-standard-debuginfo-0.5.0-4.1 - openSUSE Leap 42.1 (i586 x86_64): profanity-0.4.7-3.1 profanity-debuginfo-0.4.7-3.1 profanity-debugsource-0.4.7-3.1 References: https://www.suse.com/security/cve/CVE-2017-5592.html https://bugzilla.suse.com/1024696

1 0

openSUSE-SU-2017:0528-1: moderate: Security update for libplist
by opensuse-security＠opensuse.org 21 Feb '17

21 Feb '17

openSUSE Security Update: Security update for libplist ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0528-1 Rating: moderate References: #1019531 #1023807 #1023822 #1023848 Cross-References: CVE-2017-5209 CVE-2017-5834 CVE-2017-5835 CVE-2017-5836 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libplist fixes the following issues: - CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (bsc#1019531). - CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed (bsc#1023848) - CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822) - CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-283=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libplist++-devel-1.12-7.1 libplist++3-1.12-7.1 libplist++3-debuginfo-1.12-7.1 libplist-debugsource-1.12-7.1 libplist-devel-1.12-7.1 libplist3-1.12-7.1 libplist3-debuginfo-1.12-7.1 plistutil-1.12-7.1 plistutil-debuginfo-1.12-7.1 python-plist-1.12-7.1 python-plist-debuginfo-1.12-7.1 - openSUSE Leap 42.1 (x86_64): libplist++3-32bit-1.12-7.1 libplist++3-debuginfo-32bit-1.12-7.1 libplist3-32bit-1.12-7.1 libplist3-debuginfo-32bit-1.12-7.1 References: https://www.suse.com/security/cve/CVE-2017-5209.html https://www.suse.com/security/cve/CVE-2017-5834.html https://www.suse.com/security/cve/CVE-2017-5835.html https://www.suse.com/security/cve/CVE-2017-5836.html https://bugzilla.suse.com/1019531 https://bugzilla.suse.com/1023807 https://bugzilla.suse.com/1023822 https://bugzilla.suse.com/1023848

1 0

openSUSE-SU-2017:0527-1: moderate: Security update for nodejs
by opensuse-security＠opensuse.org 21 Feb '17

21 Feb '17

openSUSE Security Update: Security update for nodejs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0527-1 Rating: moderate References: #1009528 #1022085 #1022086 Cross-References: CVE-2016-7055 CVE-2017-3731 CVE-2017-3732 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: nodejs was updated to LTS release 4.7.3 to fix the following issues: * deps: upgrade embedded openssl sources to 1.0.2k (CVE-2017-3731, CVE-2017-3732, CVE-2016-7055, boo#1022085, boo#1022086, boo#1009528) Changes in LTS release 4.7.1: * build: shared library support is now working for AIX builds * repl: passing options to the repl will no longer overwrite defaults * timers: recanceling a cancelled timers will no longer throw Changes in LTS release 4.7.0: * build: introduce the configure --shared option for embedders * debugger: make listen address configurable in debugger server * dgram: generalized send queue to handle close, fixing a potential throw when dgram socket is closed in the listening event handler * http: introduce the 451 status code "Unavailable For Legal Reasons" * gtest: the test reporter now outputs tap comments as yamlish * tls: introduce secureContext for tls.connect (useful for caching client certificates, key, and CA certificates) * tls: fix memory leak when writing data to TLSWrap instance during handshake * src: node no longer aborts when c-ares initialization fails Changes in LTS release 4.6.2: * build: it is now possible to build the documentation from the release tarball * buffer: Buffer.alloc() will no longer incorrectly return a zero filled buffer when an encoding is passed * deps/npm: upgrade npm in LTS to 2.15.11 * repl: enable tab completion for global properties * url: url.format() will now encode all "#" in search Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-284=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nodejs-4.7.3-39.1 nodejs-debuginfo-4.7.3-39.1 nodejs-debugsource-4.7.3-39.1 nodejs-devel-4.7.3-39.1 npm-4.7.3-39.1 - openSUSE Leap 42.1 (noarch): nodejs-docs-4.7.3-39.1 References: https://www.suse.com/security/cve/CVE-2016-7055.html https://www.suse.com/security/cve/CVE-2017-3731.html https://www.suse.com/security/cve/CVE-2017-3732.html https://bugzilla.suse.com/1009528 https://bugzilla.suse.com/1022085 https://bugzilla.suse.com/1022086

1 0

openSUSE-SU-2017:0515-1: moderate: Security update for mcabber
by opensuse-security＠opensuse.org 20 Feb '17

20 Feb '17

openSUSE Security Update: Security update for mcabber ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0515-1 Rating: moderate References: #1024690 Cross-References: CVE-2017-5589 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: mcabber was updated to 1.0.5 to fix the following issues: * Much better performances with huge rosters. * Fix an issue with carbons (CVE-2017-5589, boo#1024690). * Fix a small memory leak. * contrib/vim: Support reloading filetype detection. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-282=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): mcabber-1.0.5-6.1 mcabber-debuginfo-1.0.5-6.1 mcabber-debugsource-1.0.5-6.1 mcabber-devel-1.0.5-6.1 References: https://www.suse.com/security/cve/CVE-2017-5589.html https://bugzilla.suse.com/1024690

1 0

openSUSE-SU-2017:0514-1: moderate: Security update for firebird
by opensuse-security＠opensuse.org 19 Feb '17

19 Feb '17

openSUSE Security Update: Security update for firebird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0514-1 Rating: moderate References: #1023990 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for firebird fixes the following issues: - security vulnerability fix for bypassing 'Restrict UDF' value of UdfAccess config directive (boo#1023990) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-279=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-279=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): firebird-2.5.6.27020-10.1 firebird-classic-2.5.6.27020-10.1 firebird-classic-debuginfo-2.5.6.27020-10.1 firebird-classic-debugsource-2.5.6.27020-10.1 firebird-debuginfo-2.5.6.27020-10.1 firebird-debugsource-2.5.6.27020-10.1 firebird-devel-2.5.6.27020-10.1 firebird-superserver-2.5.6.27020-10.1 firebird-superserver-debuginfo-2.5.6.27020-10.1 libfbclient2-2.5.6.27020-10.1 libfbclient2-debuginfo-2.5.6.27020-10.1 libfbclient2-devel-2.5.6.27020-10.1 libfbembed-devel-2.5.6.27020-10.1 libfbembed2_5-2.5.6.27020-10.1 libfbembed2_5-debuginfo-2.5.6.27020-10.1 - openSUSE Leap 42.2 (noarch): firebird-doc-2.5.6.27020-10.1 - openSUSE Leap 42.2 (x86_64): firebird-32bit-2.5.6.27020-10.1 firebird-debuginfo-32bit-2.5.6.27020-10.1 libfbclient2-32bit-2.5.6.27020-10.1 libfbclient2-debuginfo-32bit-2.5.6.27020-10.1 libfbembed2_5-32bit-2.5.6.27020-10.1 libfbembed2_5-debuginfo-32bit-2.5.6.27020-10.1 - openSUSE Leap 42.1 (i586 x86_64): firebird-2.5.6.27020-10.1 firebird-classic-2.5.6.27020-10.1 firebird-classic-debuginfo-2.5.6.27020-10.1 firebird-classic-debugsource-2.5.6.27020-10.1 firebird-debuginfo-2.5.6.27020-10.1 firebird-debugsource-2.5.6.27020-10.1 firebird-devel-2.5.6.27020-10.1 firebird-superserver-2.5.6.27020-10.1 firebird-superserver-debuginfo-2.5.6.27020-10.1 libfbclient2-2.5.6.27020-10.1 libfbclient2-debuginfo-2.5.6.27020-10.1 libfbclient2-devel-2.5.6.27020-10.1 libfbembed-devel-2.5.6.27020-10.1 libfbembed2_5-2.5.6.27020-10.1 libfbembed2_5-debuginfo-2.5.6.27020-10.1 - openSUSE Leap 42.1 (noarch): firebird-doc-2.5.6.27020-10.1 - openSUSE Leap 42.1 (x86_64): firebird-32bit-2.5.6.27020-10.1 firebird-debuginfo-32bit-2.5.6.27020-10.1 libfbclient2-32bit-2.5.6.27020-10.1 libfbclient2-debuginfo-32bit-2.5.6.27020-10.1 libfbembed2_5-32bit-2.5.6.27020-10.1 libfbembed2_5-debuginfo-32bit-2.5.6.27020-10.1 References: https://bugzilla.suse.com/1023990

1 0

openSUSE-SU-2017:0513-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 19 Feb '17

19 Feb '17

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0513-1 Rating: important References: #1020905 Cross-References: CVE-2016-2183 CVE-2016-5546 CVE-2016-5547 CVE-2016-5548 CVE-2016-5549 CVE-2016-5552 CVE-2017-3231 CVE-2017-3241 CVE-2017-3252 CVE-2017-3253 CVE-2017-3259 CVE-2017-3260 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: - Oracle Critical Patch Update of January 2017 to OpenJDK 7u131 (bsc#1020905): * Security Fixes - S8138725: Add options for Javadoc generation - S8140353: Improve signature checking - S8151934, CVE-2017-3231: Resolve class resolution - S8156804, CVE-2017-3241: Better constraint checking - S8158406: Limited Parameter Processing - S8158997: JNDI Protocols Switch - S8159507: RuntimeVisibleAnnotation validation - S8161218: Better bytecode loading - S8161743, CVE-2017-3252: Provide proper login context - S8162577: Standardize logging levels - S8162973: Better component components - S8164143, CVE-2017-3260: Improve components for menu items - S8164147, CVE-2017-3261: Improve streaming socket output - S8165071, CVE-2016-2183: Expand TLS support - S8165344, CVE-2017-3272: Update concurrency support - S8166988, CVE-2017-3253: Improve image processing performance - S8167104, CVE-2017-3289: Additional class construction refinements - S8167223, CVE-2016-5552: URL handling improvements - S8168705, CVE-2016-5547: Better ObjectIdentifier validation - S8168714, CVE-2016-5546: Tighten ECDSA validation - S8168728, CVE-2016-5548: DSA signing improvments - S8168724, CVE-2016-5549: ECDSA signing improvments - S6253144: Long narrowing conversion should describe the algorithm used and implied "risks" - S6328537: Improve javadocs for Socket class by adding references to SocketOptions - S6978886: javadoc shows stacktrace after print error resulting from disk full - S6995421: Eliminate the static dependency to sun.security.ec.ECKeyFactory - S6996372: synchronizing handshaking hash - S7027045: (doc) java/awt/Window.java has several typos in javadoc - S7054969: Null-check-in-finally pattern in java/security documentation - S7072353: JNDI libraries do not build with javac -Xlint:all -Werror - S7075563: Broken link in "javax.swing.SwingWorker" - S7077672: jdk8_tl nightly fail in step-2 build on 8/10/11 - S7088502: Security libraries don't build with javac -Werror - S7092447: Clarify the default locale used in each locale sensitive operation - S7093640: Enable client-side TLS 1.2 by default - S7103570: AtomicIntegerFieldUpdater does not work when SecurityManager is installed - S7117360: Warnings in java.util.concurrent.atomic package - S7117465: Warning cleanup for IMF classes - S7187144: JavaDoc for ScriptEngineFactory.getProgram() contains an error - S8000418: javadoc should used a standard "generated by javadoc" string - S8000666: javadoc should write directly to Writer instead of composing strings - S8000673: remove dead code from HtmlWriter and subtypes - S8000970: break out auxiliary classes that will prevent multi-core compilation of the JDK - S8001669: javadoc internal DocletAbortException should set cause when appropriate - S8008949: javadoc stopped copying doc-files - S8011402: Move blacklisting certificate logic from hard code to data - S8011547: Update XML Signature implementation to Apache Santuario 1.5.4 - S8012288: XML DSig API allows wrong tag names and extra elements in SignedInfo - S8016217: More javadoc warnings - S8017325: Cleanup of the javadoc <code> tag in java.security.cert - S8017326: Cleanup of the javadoc <code> tag in java.security.spec - S8019772: Fix doclint issues in javax.crypto and javax.security subpackages - S8020557: javadoc cleanup in javax.security - S8020688: Broken links in documentation at http://docs.oracle.com/javase/6/docs/api/index. - S8021108: Clean up doclint warnings and errors in java.text package - S8021417: Fix doclint issues in java.util.concurrent - S8021833: javadoc cleanup in java.net - S8022120: JCK test api/javax_xml/crypto/dsig/TransformService/index_ParamMethods fails - S8022175: Fix doclint warnings in javax.print - S8022406: Fix doclint issues in java.beans - S8022746: List of spelling errors in API doc - S8024779: [macosx] SwingNode crashes on exit - S8025085: [javadoc] some errors in javax/swing - S8025218: [javadoc] some errors in java/awt classes - S8025249: [javadoc] fix some javadoc errors in javax/swing/ - S8025409: Fix javadoc comments errors and warning reported by doclint report - S8026021: more fix of javadoc errors and warnings reported by doclint, see the description - S8037099: [macosx] Remove all references to GC from native OBJ-C code - S8038184: XMLSignature throws StringIndexOutOfBoundsException if ID attribute value is empty String - S8038349: Signing XML with DSA throws Exception when key is larger than 1024 bits - S8049244: XML Signature performance issue caused by unbuffered signature data - S8049432: New tests for TLS property jdk.tls.client.protocols - S8050893: (smartcardio) Invert reset argument in tests in sun/security/smartcardio - S8059212: Modify regression tests so that they do not just fail if no cardreader found - S8068279: (typo in the spec) javax.script.ScriptEngineFactory.getLanguageName - S8068491: Update the protocol for references of docs.oracle.com to HTTPS. - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java needs to be updated for JDK-8061210 - S8076369: Introduce the jdk.tls.client.protocols system property for JDK 7u - S8139565: Restrict certificates with DSA keys less than 1024 bits - S8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions - S8140587: Atomic*FieldUpdaters should use Class.isInstance instead of direct class check - S8143959: Certificates requiring blacklisting - S8145984: [macosx] sun.lwawt.macosx.CAccessible leaks - S8148516: Improve the default strength of EC in JDK - S8149029: Secure validation of XML based digital signature always enabled when checking wrapping attacks - S8151893: Add security property to configure XML Signature secure validation mode - S8155760: Implement Serialization Filtering - S8156802: Better constraint checking - S8161228: URL objects with custom protocol handlers have port changed after deserializing - S8161571: Verifying ECDSA signatures permits trailing bytes - S8163304: jarsigner -verbose -verify should print the algorithms used to sign the jar - S8164908: ReflectionFactory support for IIOP and custom serialization - S8165230: RMIConnection addNotificationListeners failing with specific inputs - S8166393: disabledAlgorithms property should not be strictly parsed - S8166591: [macos 10.12] Trackpad scrolling of text on OS X 10.12 Sierra is very fast (Trackpad, Retina only) - S8166739: Improve extensibility of ObjectInputFilter information passed to the filter - S8166875: (tz) Support tzdata2016g - S8166878: Connection reset during TLS handshake - S8167356: Follow up fix for jdk8 backport of 8164143. Changes for CMenuComponent.m were missed - S8167459: Add debug output for indicating if a chosen ciphersuite was legacy - S8167472: Chrome interop regression with JDK-8148516 - S8167591: Add MD5 to signed JAR restrictions - S8168861: AnchorCertificates uses hardcoded password for cacerts keystore - S8168993: JDK8u121 L10n resource file update - S8169191: (tz) Support tzdata2016i - S8169688: Backout (remove) MD5 from jdk.jar.disabledAlgorithms for January CPU - S8169911: Enhanced tests for jarsigner -verbose -verify after JDK-8163304 - S8170131: Certificates not being blocked by jdk.tls.disabledAlgorithms property - S8170268: 8u121 L10n resource file update - msgdrop 20 - S8173622: Backport of 7180907 is incomplete - S8173849: Fix use of java.util.Base64 in test cases - S8173854: [TEST] Update DHEKeySizing test case following 8076328 & 8081760 - CVE-2017-3259 Vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. * Backports - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef on __APPLE__and _LLP64 systems. - S8000351, PR3316, RH1390708: Tenuring threshold should be unsigned - S8153711, PR3315, RH1284948: [REDO] GlobalRefs never deleted when processing invokeMethod command - S8170888, PR3316, RH1390708: [linux] support for cgroup memory limits in container (ie Docker) environments * Bug fixes - PR3318: Replace 'infinality' with 'improved font rendering' (--enable-improved-font-rendering) - PR3318: Fix compatibility with vanilla Fontconfig - PR3318: Fix glyph y advance - PR3318: Always round glyph advance in 26.6 space - PR3318: Simplify glyph advance handling - PR3324: Fix NSS_LIBDIR substitution in make_generic_profile.sh broken by PR1989 * AArch64 port - S8165673, PR3320: AArch64: Fix JNI floating point argument handling This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-278=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-278=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.131-40.1 java-1_7_0-openjdk-accessibility-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-debugsource-1.7.0.131-40.1 java-1_7_0-openjdk-demo-1.7.0.131-40.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-devel-1.7.0.131-40.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-headless-1.7.0.131-40.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-src-1.7.0.131-40.1 - openSUSE Leap 42.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.131-40.1 - openSUSE Leap 42.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.131-40.1 java-1_7_0-openjdk-accessibility-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.131-40.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-debugsource-1.7.0.131-40.1 java-1_7_0-openjdk-demo-1.7.0.131-40.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-devel-1.7.0.131-40.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-headless-1.7.0.131-40.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.131-40.1 java-1_7_0-openjdk-src-1.7.0.131-40.1 - openSUSE Leap 42.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.131-40.1 References: https://www.suse.com/security/cve/CVE-2016-2183.html https://www.suse.com/security/cve/CVE-2016-5546.html https://www.suse.com/security/cve/CVE-2016-5547.html https://www.suse.com/security/cve/CVE-2016-5548.html https://www.suse.com/security/cve/CVE-2016-5549.html https://www.suse.com/security/cve/CVE-2016-5552.html https://www.suse.com/security/cve/CVE-2017-3231.html https://www.suse.com/security/cve/CVE-2017-3241.html https://www.suse.com/security/cve/CVE-2017-3252.html https://www.suse.com/security/cve/CVE-2017-3253.html https://www.suse.com/security/cve/CVE-2017-3259.html https://www.suse.com/security/cve/CVE-2017-3260.html https://www.suse.com/security/cve/CVE-2017-3261.html https://www.suse.com/security/cve/CVE-2017-3272.html https://www.suse.com/security/cve/CVE-2017-3289.html https://bugzilla.suse.com/1020905

1 0

openSUSE-SU-2017:0512-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 19 Feb '17

19 Feb '17

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0512-1 Rating: moderate References: #1019611 #1022103 Cross-References: CVE-2017-5225 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for tiff fixes the following issues: - CVE-2017-5225: A crafted TIFF image could cause a crash and potential code execution when processed by the 'tiffcp' utility (bsc#1019611). Also a regression from the version update to 4.0.7 was fixed in handling TIFFTAG_FAXRECVPARAMS. (bsc#1022103) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-281=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-281=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libtiff-devel-4.0.7-15.1 libtiff5-4.0.7-15.1 libtiff5-debuginfo-4.0.7-15.1 tiff-4.0.7-15.1 tiff-debuginfo-4.0.7-15.1 tiff-debugsource-4.0.7-15.1 - openSUSE Leap 42.2 (x86_64): libtiff-devel-32bit-4.0.7-15.1 libtiff5-32bit-4.0.7-15.1 libtiff5-debuginfo-32bit-4.0.7-15.1 - openSUSE Leap 42.1 (i586 x86_64): libtiff-devel-4.0.7-15.1 libtiff5-4.0.7-15.1 libtiff5-debuginfo-4.0.7-15.1 tiff-4.0.7-15.1 tiff-debuginfo-4.0.7-15.1 tiff-debugsource-4.0.7-15.1 - openSUSE Leap 42.1 (x86_64): libtiff-devel-32bit-4.0.7-15.1 libtiff5-32bit-4.0.7-15.1 libtiff5-debuginfo-32bit-4.0.7-15.1 References: https://www.suse.com/security/cve/CVE-2017-5225.html https://bugzilla.suse.com/1019611 https://bugzilla.suse.com/1022103

1 0