February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0511-1: moderate: Security update for vim
by opensuse-security＠opensuse.org 19 Feb '17

19 Feb '17

openSUSE Security Update: Security update for vim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0511-1 Rating: moderate References: #1024724 Cross-References: CVE-2017-5953 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vim fixes the following issues: - CVE-2017-5953: Fixed a possible overflow with corrupted spell file (bsc#1024724) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-280=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gvim-7.4.326-11.1 gvim-debuginfo-7.4.326-11.1 vim-7.4.326-11.1 vim-debuginfo-7.4.326-11.1 vim-debugsource-7.4.326-11.1 - openSUSE Leap 42.1 (noarch): vim-data-7.4.326-11.1 References: https://www.suse.com/security/cve/CVE-2017-5953.html https://bugzilla.suse.com/1024724

1 0

openSUSE-SU-2017:0510-1: important: Security update for opus
by opensuse-security＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Security Update: Security update for opus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0510-1 Rating: important References: #1020102 Cross-References: CVE-2017-0381 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opus fixes the following issues: - CVE-2017-0381: Fixed a remote code execution vulnerability in silk/NLSF_stabilize.c when playing certain media files (bsc#1020102) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-277=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-277=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libopus-devel-1.1-6.1 libopus-devel-static-1.1-6.1 libopus0-1.1-6.1 libopus0-debuginfo-1.1-6.1 opus-debugsource-1.1-6.1 - openSUSE Leap 42.2 (x86_64): libopus0-32bit-1.1-6.1 libopus0-debuginfo-32bit-1.1-6.1 - openSUSE Leap 42.1 (i586 x86_64): libopus-devel-1.1-5.1 libopus-devel-static-1.1-5.1 libopus0-1.1-5.1 libopus0-debuginfo-1.1-5.1 opus-debugsource-1.1-5.1 - openSUSE Leap 42.1 (x86_64): libopus0-32bit-1.1-5.1 libopus0-debuginfo-32bit-1.1-5.1 References: https://www.suse.com/security/cve/CVE-2017-0381.html https://bugzilla.suse.com/1020102

1 0

openSUSE-SU-2017:0509-1: moderate: Security update for open-vm-tools
by opensuse-security＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Security Update: Security update for open-vm-tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0509-1 Rating: moderate References: #1006796 #1007600 #1011057 #1013496 #913727 #971031 #978424 #985110 #994598 Cross-References: CVE-2015-5191 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: This update for open-vm-tools fixes the following issues: - Updated to 10.1.0 stable release (boo#1011057) + vmware-namespace-cmd command line utility. + gtk3 support + Common Agent Framework (CAF) + guest authentication with xmlsec1 + FreeBSD support + sub-command to push updated network information to the host on demand + udev rules for configuring SCSI timeouts in the guest + fixes for Ubuntu 16.10 + Fix for quiesced snapshot failure leaving guest file system quiesced (boo#1006796) + Fix for CVE-2015-5191 (boo#1007600) - Report SLES12-SAP guest OS as SLES12 (boo#1013496) - Remove building KMP modules. No longer needed or wanted for current releases. User space tool vmhgfs-fuse has replaced the need for vmhgfs kernel module. - Add udev rule to increase VMware virtual disk timeout values (boo#994598) - Fix vmtoolsd init script to run vmtoolsd in background. (boo#971031) + fix originally done in SLE-11-SP4 code base by tcech(a)suse.cz - Added patches for GCC 6 build failure (boo#985110) - Update to 10.0.7-gtk3 stable branch + add support for gtk3, needed by the dndcp and resolutionset plugins + remove files generated by autoreconf + a few minor build fixes - Update fixes copy-n-paste and drag-n-drop regressions (boo#978424) - Added new vmblock-fuse.service - Update to 10.0.7 stable branch + Added namespace command line utility "vmware-namespace-cmd". - Compile without gtkmm support for SLES12 based environments (which do not provide gtkmm2.4) - Update to 10.0.5 stable branch + [vgauth] fix timestamp check + [libresolutionSet.so] Add an error handler to X11 resolutionSet + [vmci.ko] Kill tasklet when unloading vmci module + [libvmbackup.so] Quiesced snapshots Skip freezing autofs mounts. + [vmhgfs.ko] make vmhgfs compatible with Linux kernel 4.2 - This update also addresses a suspend with systemd issue (boo#913727) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-276=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libvmtools-devel-10.1.0-6.1 libvmtools0-10.1.0-6.1 libvmtools0-debuginfo-10.1.0-6.1 open-vm-tools-10.1.0-6.1 open-vm-tools-debuginfo-10.1.0-6.1 open-vm-tools-debugsource-10.1.0-6.1 open-vm-tools-desktop-10.1.0-6.1 open-vm-tools-desktop-debuginfo-10.1.0-6.1 References: https://www.suse.com/security/cve/CVE-2015-5191.html https://bugzilla.suse.com/1006796 https://bugzilla.suse.com/1007600 https://bugzilla.suse.com/1011057 https://bugzilla.suse.com/1013496 https://bugzilla.suse.com/913727 https://bugzilla.suse.com/971031 https://bugzilla.suse.com/978424 https://bugzilla.suse.com/985110 https://bugzilla.suse.com/994598

1 0

openSUSE-RU-2017:0508-1: Recommended update for lvm2
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0508-1 Rating: low References: #1012973 #1017034 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for lvm2 fixes the following issue: - Remove special case for md in 69-dm-lvm-metadata.rules. (bsc#1012973) - Booting from MPIO fails to activate LVM. (bsc#1017034) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-266=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): device-mapper-1.02.97-73.1 device-mapper-debuginfo-1.02.97-73.1 device-mapper-devel-1.02.97-73.1 lvm2-2.02.120-73.1 lvm2-clvm-2.02.120-73.1 lvm2-clvm-debuginfo-2.02.120-73.1 lvm2-cmirrord-2.02.120-73.1 lvm2-cmirrord-debuginfo-2.02.120-73.1 lvm2-debuginfo-2.02.120-73.1 lvm2-debugsource-2.02.120-73.1 lvm2-devel-2.02.120-73.1 - openSUSE Leap 42.1 (x86_64): device-mapper-32bit-1.02.97-73.1 device-mapper-debuginfo-32bit-1.02.97-73.1 device-mapper-devel-32bit-1.02.97-73.1 References: https://bugzilla.suse.com/1012973 https://bugzilla.suse.com/1017034

1 0

openSUSE-RU-2017:0507-1: Recommended update for vlc
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Recommended Update: Recommended update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0507-1 Rating: low References: #1012556 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for vlc fixes the following issues: - Change dependency of the language package on vlc-noX instead of vlc. (boo#1012556) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-267=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): vlc-lang-2.2.4-30.1 - openSUSE Leap 42.2 (x86_64): libvlc5-2.2.4-30.1 libvlc5-debuginfo-2.2.4-30.1 libvlccore8-2.2.4-30.1 libvlccore8-debuginfo-2.2.4-30.1 vlc-2.2.4-30.1 vlc-codec-gstreamer-2.2.4-30.1 vlc-codec-gstreamer-debuginfo-2.2.4-30.1 vlc-debuginfo-2.2.4-30.1 vlc-debugsource-2.2.4-30.1 vlc-devel-2.2.4-30.1 vlc-noX-2.2.4-30.1 vlc-noX-debuginfo-2.2.4-30.1 vlc-qt-2.2.4-30.1 vlc-qt-debuginfo-2.2.4-30.1 References: https://bugzilla.suse.com/1012556

1 0

openSUSE-RU-2017:0506-1: moderate: Recommended update for lxc
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Recommended Update: Recommended update for lxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0506-1 Rating: moderate References: #1019662 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lxc fixes the following issues: - lxc-start would fail to start containers when AppArmor confinement was used (boo#1019662) A openSUSE_apparmor_mount.conf was added, and the package now reloads apparmor related files upon installation and upgrade. In addition, lxc was updated to version 1.1.5. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-269=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): lxc-1.1.5-13.1 lxc-debuginfo-1.1.5-13.1 lxc-debugsource-1.1.5-13.1 lxc-devel-1.1.5-13.1 References: https://bugzilla.suse.com/1019662

1 0

openSUSE-SU-2017:0504-1: moderate: Security update for mupdf
by opensuse-security＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0504-1 Rating: moderate References: #1022503 #1022504 #1023760 #1023761 #1024679 Cross-References: CVE-2017-5627 CVE-2017-5628 CVE-2017-5896 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for mupdf fixes the following vulnerabilities: - CVE-2017-5627: Integer overflow in the mujs implementation (boo#1022503) - CVE-2017-5628: Integer overflow in the mujs implementation (boo#1022504) - CVE-2017-5896: heap overflow (boo#1023761, boo#1024679) - NULL pointer dereference in dodrawpage (boo#1023760) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-271=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-271=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): mupdf-1.10a-11.2 mupdf-devel-static-1.10a-11.2 - openSUSE Leap 42.1 (i586 x86_64): mupdf-1.10a-15.1 mupdf-devel-static-1.10a-15.1 References: https://www.suse.com/security/cve/CVE-2017-5627.html https://www.suse.com/security/cve/CVE-2017-5628.html https://www.suse.com/security/cve/CVE-2017-5896.html https://bugzilla.suse.com/1022503 https://bugzilla.suse.com/1022504 https://bugzilla.suse.com/1023760 https://bugzilla.suse.com/1023761 https://bugzilla.suse.com/1024679

1 0

openSUSE-OU-2017:0502-1: moderate: Optional update for dtv-scan-tables, v4l-utils
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Optional Update: Optional update for dtv-scan-tables, v4l-utils ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0502-1 Rating: moderate References: #1018436 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update introduces the package dtv-scan-tables and provides version 1.8.0 for v4l-utils. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-275=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dvb-utils-1.8.0-6.1 dvb-utils-debuginfo-1.8.0-6.1 libdvbv5-0-1.8.0-6.1 libdvbv5-0-debuginfo-1.8.0-6.1 libdvbv5-devel-1.8.0-6.1 libv4l-1.8.0-6.1 libv4l-debuginfo-1.8.0-6.1 libv4l-devel-1.8.0-6.1 libv4l1-0-1.8.0-6.1 libv4l1-0-debuginfo-1.8.0-6.1 libv4l2-0-1.8.0-6.1 libv4l2-0-debuginfo-1.8.0-6.1 libv4l2rds0-1.8.0-6.1 libv4l2rds0-debuginfo-1.8.0-6.1 libv4lconvert0-1.8.0-6.1 libv4lconvert0-debuginfo-1.8.0-6.1 qv4l2-1.8.0-6.1 qv4l2-debuginfo-1.8.0-6.1 v4l-utils-1.8.0-6.1 v4l-utils-debuginfo-1.8.0-6.1 v4l-utils-debugsource-1.8.0-6.1 v4l-utils-devel-tools-1.8.0-6.1 v4l-utils-devel-tools-debuginfo-1.8.0-6.1 - openSUSE Leap 42.2 (x86_64): libdvbv5-0-32bit-1.8.0-6.1 libdvbv5-0-debuginfo-32bit-1.8.0-6.1 libv4l-32bit-1.8.0-6.1 libv4l-debuginfo-32bit-1.8.0-6.1 libv4l-devel-32bit-1.8.0-6.1 libv4l1-0-32bit-1.8.0-6.1 libv4l1-0-debuginfo-32bit-1.8.0-6.1 libv4l2-0-32bit-1.8.0-6.1 libv4l2-0-debuginfo-32bit-1.8.0-6.1 libv4l2rds0-32bit-1.8.0-6.1 libv4l2rds0-debuginfo-32bit-1.8.0-6.1 libv4lconvert0-32bit-1.8.0-6.1 libv4lconvert0-debuginfo-32bit-1.8.0-6.1 - openSUSE Leap 42.2 (noarch): dtv-scan-tables-20161227-2.1 dtv-scan-tables-v5-20161227-2.1 libdvbv5-0-lang-1.8.0-6.1 v4l-utils-lang-1.8.0-6.1 References: https://bugzilla.suse.com/1018436

1 0

openSUSE-SU-2017:0501-1: moderate: Security update for viewvc
by opensuse-security＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Security Update: Security update for viewvc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0501-1 Rating: moderate References: #1024393 Cross-References: CVE-2017-5938 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for viewvc to version 1.1.26 fixes the following issues: - vievwc 1.1.26, including one security fix: * CVE-2017-5938 escape nav_data name to avoid XSS attack (boo#1024393) - vievwc 1.1.25: * fix _rev2optrev assertion on long input - license is BSD-2-Clause, package LICENSE text - Update viewvc.conf for Apache 2.4 syntax. - viewvc 1.1.24: * fix minor bug in human_readable boolean calculation * allow hr_funout option to apply to unidiff diffs, too * fix infinite loop in rcsparse * fix iso8601 timezone offset handling * add support for renamed roots * fix minor buglet in viewvc-install error message Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-274=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-274=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): viewvc-1.1.26-6.1 - openSUSE Leap 42.1 (noarch): viewvc-1.1.26-5.1 References: https://www.suse.com/security/cve/CVE-2017-5938.html https://bugzilla.suse.com/1024393

1 0

openSUSE-RU-2017:0500-1: Recommended update for fate
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0500-1 Rating: low References: #1024737 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fate fixes the following issues: - The mouse wheel is now (better) usable in the general tab of the feature editor. - Better label for priority editor table. - Update fate.desktop file to have official menu categories listed. (boo#1024737) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-264=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-264=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): fate-1.5.5.7.2-21.1 fate-debuginfo-1.5.5.7.2-21.1 - openSUSE Leap 42.1 (i586 x86_64): fate-1.5.5.7.2-21.1 fate-debuginfo-1.5.5.7.2-21.1 References: https://bugzilla.suse.com/1024737

1 0