February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0499-1: important: Security update of chromium
by opensuse-security＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Security Update: Security update of chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0499-1 Rating: important References: #1022049 Cross-References: CVE-2017-5006 CVE-2017-5007 CVE-2017-5008 CVE-2017-5009 CVE-2017-5010 CVE-2017-5011 CVE-2017-5012 CVE-2017-5013 CVE-2017-5014 CVE-2017-5015 CVE-2017-5016 CVE-2017-5017 CVE-2017-5018 CVE-2017-5019 CVE-2017-5020 CVE-2017-5021 CVE-2017-5022 CVE-2017-5023 CVE-2017-5024 CVE-2017-5025 CVE-2017-5026 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: Google chromium was updated to 56.0.2924.87: * Various small fixes * Disabled option to enable/disable plugins in the chrome://plugins - Changed the build requirement of libavformat to library version 57.41.100, as included in ffmpeg 3.1.1, as only this version properly supports the public AVStream API 'codecpar'. It also contains the version update to 56.0.2924.76 (bsc#1022049): - CVE-2017-5007: Universal XSS in Blink - CVE-2017-5006: Universal XSS in Blink - CVE-2017-5008: Universal XSS in Blink - CVE-2017-5010: Universal XSS in Blink - CVE-2017-5011: Unauthorised file access in Devtools - CVE-2017-5009: Out of bounds memory access in WebRTC - CVE-2017-5012: Heap overflow in V8 - CVE-2017-5013: Address spoofing in Omnibox - CVE-2017-5014: Heap overflow in Skia - CVE-2017-5015: Address spoofing in Omnibox - CVE-2017-5019: Use after free in Renderer - CVE-2017-5016: UI spoofing in Blink - CVE-2017-5017: Uninitialised memory access in webm video - CVE-2017-5018: Universal XSS in chrome://apps - CVE-2017-5020: Universal XSS in chrome://downloads - CVE-2017-5021: Use after free in Extensions - CVE-2017-5022: Bypass of Content Security Policy in Blink - CVE-2017-5023: Type confusion in metrics - CVE-2017-5024: Heap overflow in FFmpeg - CVE-2017-5025: Heap overflow in FFmpeg - CVE-2017-5026: UI spoofing. Credit to Ronni Skansing - Enable VAAPI hardware accelerated video decoding. - Chromium 55.0.2883.87: * various fixes for crashes and specific wesites * update Google pinned certificates Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-273=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-273=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): harfbuzz-debugsource-1.4.2-3.1 harfbuzz-devel-1.4.2-3.1 harfbuzz-tools-1.4.2-3.1 harfbuzz-tools-debuginfo-1.4.2-3.1 libharfbuzz-icu0-1.4.2-3.1 libharfbuzz-icu0-debuginfo-1.4.2-3.1 libharfbuzz0-1.4.2-3.1 libharfbuzz0-debuginfo-1.4.2-3.1 - openSUSE Leap 42.2 (x86_64): chromedriver-56.0.2924.87-102.1 chromedriver-debuginfo-56.0.2924.87-102.1 chromium-56.0.2924.87-102.1 chromium-debuginfo-56.0.2924.87-102.1 chromium-debugsource-56.0.2924.87-102.1 libharfbuzz-icu0-32bit-1.4.2-3.1 libharfbuzz-icu0-debuginfo-32bit-1.4.2-3.1 libharfbuzz0-32bit-1.4.2-3.1 libharfbuzz0-debuginfo-32bit-1.4.2-3.1 - openSUSE Leap 42.1 (i586 x86_64): ffmpeg3-3.2.2-2.1 ffmpeg3-debuginfo-3.2.2-2.1 ffmpeg3-debugsource-3.2.2-2.1 libavcodec-devel-3.2.2-2.1 libavcodec57-3.2.2-2.1 libavcodec57-debuginfo-3.2.2-2.1 libavdevice-devel-3.2.2-2.1 libavdevice57-3.2.2-2.1 libavdevice57-debuginfo-3.2.2-2.1 libavfilter-devel-3.2.2-2.1 libavfilter6-3.2.2-2.1 libavfilter6-debuginfo-3.2.2-2.1 libavformat-devel-3.2.2-2.1 libavformat57-3.2.2-2.1 libavformat57-debuginfo-3.2.2-2.1 libavresample-devel-3.2.2-2.1 libavresample3-3.2.2-2.1 libavresample3-debuginfo-3.2.2-2.1 libavutil-devel-3.2.2-2.1 libavutil55-3.2.2-2.1 libavutil55-debuginfo-3.2.2-2.1 libpostproc-devel-3.2.2-2.1 libpostproc54-3.2.2-2.1 libpostproc54-debuginfo-3.2.2-2.1 libswresample-devel-3.2.2-2.1 libswresample2-3.2.2-2.1 libswresample2-debuginfo-3.2.2-2.1 libswscale-devel-3.2.2-2.1 libswscale4-3.2.2-2.1 libswscale4-debuginfo-3.2.2-2.1 - openSUSE Leap 42.1 (x86_64): chromedriver-56.0.2924.87-102.1 chromedriver-debuginfo-56.0.2924.87-102.1 chromium-56.0.2924.87-102.1 chromium-debuginfo-56.0.2924.87-102.1 chromium-debugsource-56.0.2924.87-102.1 libavcodec57-32bit-3.2.2-2.1 libavcodec57-debuginfo-32bit-3.2.2-2.1 libavdevice57-32bit-3.2.2-2.1 libavdevice57-debuginfo-32bit-3.2.2-2.1 libavfilter6-32bit-3.2.2-2.1 libavfilter6-debuginfo-32bit-3.2.2-2.1 libavformat57-32bit-3.2.2-2.1 libavformat57-debuginfo-32bit-3.2.2-2.1 libavresample3-32bit-3.2.2-2.1 libavresample3-debuginfo-32bit-3.2.2-2.1 libavutil55-32bit-3.2.2-2.1 libavutil55-debuginfo-32bit-3.2.2-2.1 libpostproc54-32bit-3.2.2-2.1 libpostproc54-debuginfo-32bit-3.2.2-2.1 libswresample2-32bit-3.2.2-2.1 libswresample2-debuginfo-32bit-3.2.2-2.1 libswscale4-32bit-3.2.2-2.1 libswscale4-debuginfo-32bit-3.2.2-2.1 References: https://www.suse.com/security/cve/CVE-2017-5006.html https://www.suse.com/security/cve/CVE-2017-5007.html https://www.suse.com/security/cve/CVE-2017-5008.html https://www.suse.com/security/cve/CVE-2017-5009.html https://www.suse.com/security/cve/CVE-2017-5010.html https://www.suse.com/security/cve/CVE-2017-5011.html https://www.suse.com/security/cve/CVE-2017-5012.html https://www.suse.com/security/cve/CVE-2017-5013.html https://www.suse.com/security/cve/CVE-2017-5014.html https://www.suse.com/security/cve/CVE-2017-5015.html https://www.suse.com/security/cve/CVE-2017-5016.html https://www.suse.com/security/cve/CVE-2017-5017.html https://www.suse.com/security/cve/CVE-2017-5018.html https://www.suse.com/security/cve/CVE-2017-5019.html https://www.suse.com/security/cve/CVE-2017-5020.html https://www.suse.com/security/cve/CVE-2017-5021.html https://www.suse.com/security/cve/CVE-2017-5022.html https://www.suse.com/security/cve/CVE-2017-5023.html https://www.suse.com/security/cve/CVE-2017-5024.html https://www.suse.com/security/cve/CVE-2017-5025.html https://www.suse.com/security/cve/CVE-2017-5026.html https://bugzilla.suse.com/1022049

1 0

openSUSE-RU-2017:0498-1: Recommended update for yast2-packager, yast2-update
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Recommended Update: Recommended update for yast2-packager, yast2-update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0498-1 Rating: low References: #1009834 #954813 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-packager and yast2-update provides fixes and enhancements. yast2-packager: - Prevent double URL encoding when using ISO images as repositories. (bsc#954813) - Packages module is able to perform a package selection proposal during system upgrade. (bsc#1009834) yast2-update: - Allow YaST modules to add packages during upgrade. (bsc#1009834) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-268=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-packager-3.1.121-3.1 yast2-update-3.1.44-3.1 yast2-update-FACTORY-3.1.44-3.1 References: https://bugzilla.suse.com/1009834 https://bugzilla.suse.com/954813

1 0

openSUSE-RU-2017:0497-1: moderate: Recommended update for font-util
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Recommended Update: Recommended update for font-util ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0497-1 Rating: moderate References: #1024391 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for font-util fixes the following issues: - fontrootdir was not set in font-util, leading to limited fidelity when creating scale files for fonts. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-270=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-270=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): font-util-1.3.1-4.1 font-util-debuginfo-1.3.1-4.1 font-util-debugsource-1.3.1-4.1 - openSUSE Leap 42.1 (i586 x86_64): font-util-1.3.1-3.1 font-util-debuginfo-1.3.1-3.1 font-util-debugsource-1.3.1-3.1 References: https://bugzilla.suse.com/1024391

1 0

openSUSE-RU-2017:0496-1: Recommended update for spec-cleaner
by maintenance＠opensuse.org 18 Feb '17

18 Feb '17

openSUSE Recommended Update: Recommended update for spec-cleaner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0496-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides version 0.9.2 of spec-cleaner with various minimal fixes. Additionally, an option to keep vertical space in preamble, if desired, has been added. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-265=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-265=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): spec-cleaner-0.9.2-26.1 spec-cleaner-format_spec_file-0.9.2-26.1 - openSUSE Leap 42.1 (noarch): spec-cleaner-0.9.2-26.1 spec-cleaner-format_spec_file-0.9.2-26.1 References:

1 0

openSUSE-SU-2017:0488-1: moderate: Security update for postfixadmin
by opensuse-security＠opensuse.org 17 Feb '17

17 Feb '17

openSUSE Security Update: Security update for postfixadmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0488-1 Rating: moderate References: #1024211 Cross-References: CVE-2017-5930 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: postfixadmin was updated to 3.0.2 to fix the following issues: - PostfixAdmin 3.0.2: - SECURITY: don't allow to delete protected aliases (CVE-2017-5930, boo#1024211) - fix VacationHandler for PostgreSQL - AliasHandler: restrict mailbox subquery to allowed and specified domains to improve performance on setups with lots of mailboxes - allow switching between dovecot:* password schemes while still accepting passwords hashed using the previous dovecot:* scheme - FetchmailHandler: use a valid date as default for 'date' - fix date formatting in non-english languages when using PostgreSQL - various small fixes - PostfixAdmin 3.0: - add sqlite backend option - add configurable smtp helo (CONF["smtp_client"]) - new translation: ro (Romanian) - language update: tw, cs, de - fix escaping in gen_show_status() (could be used to DOS list-virtual by creating a mail address with special chars) - add CSRF protection for POST requests - list.tpl: base edit/editactive/delete links in list.tpl on $RAW_item to avoid double escaping, and fix some corner cases - fix db_quota_text() for postgresql (concat() vs. ||) - change default date for 'created' and 'updated' columns from 0000-00-00 (which causes problems with MySQL strict mode) to 2000-01-01 - allow punicode even in TLDs - update Smarty to 3.1.29 - add checks to login.php and cli to ensure database layout is up to date - whitelist '-1' as valid value for postfixadmin-cli - don't stripslashes() the password in pacrypt - various small bugfixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-261=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-261=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): postfixadmin-3.0.2-3.1 - openSUSE Leap 42.1 (noarch): postfixadmin-3.0.2-5.1 References: https://www.suse.com/security/cve/CVE-2017-5930.html https://bugzilla.suse.com/1024211

1 0

openSUSE-SU-2017:0487-1: moderate: Security update for openssl
by opensuse-security＠opensuse.org 17 Feb '17

17 Feb '17

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0487-1 Rating: moderate References: #1000677 #1001912 #1004499 #1005878 #1019334 #1021641 #1022085 #1022271 Cross-References: CVE-2016-2108 CVE-2016-7056 CVE-2016-8610 CVE-2017-3731 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has four fixes is now available. Description: This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - fix ca-bundle path (bsc#1022271) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-255=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libopenssl-devel-1.0.1i-21.1 libopenssl1_0_0-1.0.1i-21.1 libopenssl1_0_0-debuginfo-1.0.1i-21.1 libopenssl1_0_0-hmac-1.0.1i-21.1 openssl-1.0.1i-21.1 openssl-debuginfo-1.0.1i-21.1 openssl-debugsource-1.0.1i-21.1 - openSUSE Leap 42.1 (noarch): openssl-doc-1.0.1i-21.1 - openSUSE Leap 42.1 (x86_64): libopenssl-devel-32bit-1.0.1i-21.1 libopenssl1_0_0-32bit-1.0.1i-21.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-21.1 libopenssl1_0_0-hmac-32bit-1.0.1i-21.1 References: https://www.suse.com/security/cve/CVE-2016-2108.html https://www.suse.com/security/cve/CVE-2016-7056.html https://www.suse.com/security/cve/CVE-2016-8610.html https://www.suse.com/security/cve/CVE-2017-3731.html https://bugzilla.suse.com/1000677 https://bugzilla.suse.com/1001912 https://bugzilla.suse.com/1004499 https://bugzilla.suse.com/1005878 https://bugzilla.suse.com/1019334 https://bugzilla.suse.com/1021641 https://bugzilla.suse.com/1022085 https://bugzilla.suse.com/1022271

1 0

openSUSE-SU-2017:0486-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 17 Feb '17

17 Feb '17

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0486-1 Rating: important References: #1008253 #1020868 #1020873 #1020875 #1020877 #1020878 #1020882 #1020884 #1020885 #1020891 #1020894 #1020896 #1022428 Cross-References: CVE-2016-6664 CVE-2017-3238 CVE-2017-3243 CVE-2017-3244 CVE-2017-3257 CVE-2017-3258 CVE-2017-3265 CVE-2017-3291 CVE-2017-3312 CVE-2017-3317 CVE-2017-3318 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has two fixes is now available. Description: This mariadb version update to 10.0.29 fixes the following issues: - CVE-2017-3318: unspecified vulnerability affecting Error Handling (bsc#1020896) - CVE-2017-3317: unspecified vulnerability affecting Logging (bsc#1020894) - CVE-2017-3312: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 (bsc#1020873) - CVE-2017-3291: unrestricted mysqld_safe's ledir (bsc#1020884) - CVE-2017-3265: unsafe chmod/chown use in init script (bsc#1020885) - CVE-2017-3258: unspecified vulnerability in the DDL component (bsc#1020875) - CVE-2017-3257: unspecified vulnerability affecting InnoDB (bsc#1020878) - CVE-2017-3244: unspecified vulnerability affecing the DML component (bsc#1020877) - CVE-2017-3243: unspecified vulnerability affecting the Charsets component (bsc#1020891) - CVE-2017-3238: unspecified vulnerability affecting the Optimizer component (bsc#1020882) - CVE-2016-6664: Root Privilege Escalation (bsc#1008253) - Applications using the client library for MySQL (libmysqlclient.so) had a use-after-free issue that could cause the applications to crash (bsc#1022428) - notable changes: * XtraDB updated to 5.6.34-79.1 * TokuDB updated to 5.6.34-79.1 * Innodb updated to 5.6.35 * Performance Schema updated to 5.6.35 Release notes and changelog: * https://kb.askmonty.org/en/mariadb-10029-release-notes * https://kb.askmonty.org/en/mariadb-10029-changelog This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-257=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-257=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libmysqlclient-devel-10.0.29-18.1 libmysqlclient18-10.0.29-18.1 libmysqlclient18-debuginfo-10.0.29-18.1 libmysqlclient_r18-10.0.29-18.1 libmysqld-devel-10.0.29-18.1 libmysqld18-10.0.29-18.1 libmysqld18-debuginfo-10.0.29-18.1 mariadb-10.0.29-18.1 mariadb-bench-10.0.29-18.1 mariadb-bench-debuginfo-10.0.29-18.1 mariadb-client-10.0.29-18.1 mariadb-client-debuginfo-10.0.29-18.1 mariadb-debuginfo-10.0.29-18.1 mariadb-debugsource-10.0.29-18.1 mariadb-errormessages-10.0.29-18.1 mariadb-test-10.0.29-18.1 mariadb-test-debuginfo-10.0.29-18.1 mariadb-tools-10.0.29-18.1 mariadb-tools-debuginfo-10.0.29-18.1 - openSUSE Leap 42.2 (x86_64): libmysqlclient18-32bit-10.0.29-18.1 libmysqlclient18-debuginfo-32bit-10.0.29-18.1 libmysqlclient_r18-32bit-10.0.29-18.1 - openSUSE Leap 42.1 (i586 x86_64): libmysqlclient-devel-10.0.29-18.1 libmysqlclient18-10.0.29-18.1 libmysqlclient18-debuginfo-10.0.29-18.1 libmysqlclient_r18-10.0.29-18.1 libmysqld-devel-10.0.29-18.1 libmysqld18-10.0.29-18.1 libmysqld18-debuginfo-10.0.29-18.1 mariadb-10.0.29-18.1 mariadb-bench-10.0.29-18.1 mariadb-bench-debuginfo-10.0.29-18.1 mariadb-client-10.0.29-18.1 mariadb-client-debuginfo-10.0.29-18.1 mariadb-debuginfo-10.0.29-18.1 mariadb-debugsource-10.0.29-18.1 mariadb-errormessages-10.0.29-18.1 mariadb-test-10.0.29-18.1 mariadb-test-debuginfo-10.0.29-18.1 mariadb-tools-10.0.29-18.1 mariadb-tools-debuginfo-10.0.29-18.1 - openSUSE Leap 42.1 (x86_64): libmysqlclient18-32bit-10.0.29-18.1 libmysqlclient18-debuginfo-32bit-10.0.29-18.1 libmysqlclient_r18-32bit-10.0.29-18.1 References: https://www.suse.com/security/cve/CVE-2016-6664.html https://www.suse.com/security/cve/CVE-2017-3238.html https://www.suse.com/security/cve/CVE-2017-3243.html https://www.suse.com/security/cve/CVE-2017-3244.html https://www.suse.com/security/cve/CVE-2017-3257.html https://www.suse.com/security/cve/CVE-2017-3258.html https://www.suse.com/security/cve/CVE-2017-3265.html https://www.suse.com/security/cve/CVE-2017-3291.html https://www.suse.com/security/cve/CVE-2017-3312.html https://www.suse.com/security/cve/CVE-2017-3317.html https://www.suse.com/security/cve/CVE-2017-3318.html https://bugzilla.suse.com/1008253 https://bugzilla.suse.com/1020868 https://bugzilla.suse.com/1020873 https://bugzilla.suse.com/1020875 https://bugzilla.suse.com/1020877 https://bugzilla.suse.com/1020878 https://bugzilla.suse.com/1020882 https://bugzilla.suse.com/1020884 https://bugzilla.suse.com/1020885 https://bugzilla.suse.com/1020891 https://bugzilla.suse.com/1020894 https://bugzilla.suse.com/1020896 https://bugzilla.suse.com/1022428

1 0

openSUSE-RU-2017:0485-1: Recommended update for clamav-database
by maintenance＠opensuse.org 17 Feb '17

17 Feb '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0485-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Feb 13th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-254=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-254=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201702130005-40.1 - openSUSE Leap 42.1 (noarch): clamav-database-201702130005-219.1 References:

1 0

openSUSE-SU-2017:0484-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 17 Feb '17

17 Feb '17

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0484-1 Rating: moderate References: #1019036 #1019037 Cross-References: CVE-2016-10128 CVE-2016-10129 CVE-2016-10130 CVE-2017-5338 CVE-2017-5339 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgit2 fixes the several issues. These security issues were fixed: - CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). - CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). - CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-262=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libgit2-24-0.24.1-6.1 libgit2-24-debuginfo-0.24.1-6.1 libgit2-debugsource-0.24.1-6.1 libgit2-devel-0.24.1-6.1 - openSUSE Leap 42.2 (x86_64): libgit2-24-32bit-0.24.1-6.1 libgit2-24-debuginfo-32bit-0.24.1-6.1 References: https://www.suse.com/security/cve/CVE-2016-10128.html https://www.suse.com/security/cve/CVE-2016-10129.html https://www.suse.com/security/cve/CVE-2016-10130.html https://www.suse.com/security/cve/CVE-2017-5338.html https://www.suse.com/security/cve/CVE-2017-5339.html https://bugzilla.suse.com/1019036 https://bugzilla.suse.com/1019037

1 0

openSUSE-SU-2017:0483-1: moderate: Security update for expat
by opensuse-security＠opensuse.org 17 Feb '17

17 Feb '17

openSUSE Security Update: Security update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0483-1 Rating: moderate References: #983215 #983216 Cross-References: CVE-2012-6702 CVE-2016-5300 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for expat fixes the following security issues: - CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, made it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function. (bsc#983215) - CVE-2016-5300: The XML parser in Expat did not use sufficient entropy for hash initialization, which allowed context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. (bsc#983216) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-260=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-260=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): expat-2.1.0-19.1 expat-debuginfo-2.1.0-19.1 expat-debugsource-2.1.0-19.1 libexpat-devel-2.1.0-19.1 libexpat1-2.1.0-19.1 libexpat1-debuginfo-2.1.0-19.1 - openSUSE Leap 42.2 (x86_64): expat-debuginfo-32bit-2.1.0-19.1 libexpat-devel-32bit-2.1.0-19.1 libexpat1-32bit-2.1.0-19.1 libexpat1-debuginfo-32bit-2.1.0-19.1 - openSUSE Leap 42.1 (i586 x86_64): expat-2.1.0-20.1 expat-debuginfo-2.1.0-20.1 expat-debugsource-2.1.0-20.1 libexpat-devel-2.1.0-20.1 libexpat1-2.1.0-20.1 libexpat1-debuginfo-2.1.0-20.1 - openSUSE Leap 42.1 (x86_64): expat-debuginfo-32bit-2.1.0-20.1 libexpat-devel-32bit-2.1.0-20.1 libexpat1-32bit-2.1.0-20.1 libexpat1-debuginfo-32bit-2.1.0-20.1 References: https://www.suse.com/security/cve/CVE-2012-6702.html https://www.suse.com/security/cve/CVE-2016-5300.html https://bugzilla.suse.com/983215 https://bugzilla.suse.com/983216

1 0