February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:0439-1: Recommended update for python3-requests
by maintenance＠opensuse.org 09 Feb '17

09 Feb '17

openSUSE Recommended Update: Recommended update for python3-requests ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0439-1 Rating: low References: #912903 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-requests fixes the following issues: - Make https requests use verification based on openSUSE's default CA bundle. (boo#912903) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-234=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-234=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): python3-requests-2.7.0-6.1 - openSUSE Leap 42.1 (noarch): python3-requests-2.7.0-5.1 References: https://bugzilla.suse.com/912903

1 0

openSUSE-RU-2017:0435-1: moderate: Recommended update for python3-xattr
by maintenance＠opensuse.org 09 Feb '17

09 Feb '17

openSUSE Recommended Update: Recommended update for python3-xattr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0435-1 Rating: moderate References: #990225 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-xattr resolves the following issues: boo#990225: python3-xattr not available for the installation of python3-kiki Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-233=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): python3-xattr-0.7.8-2.1 python3-xattr-debuginfo-0.7.8-2.1 python3-xattr-debugsource-0.7.8-2.1 References: https://bugzilla.suse.com/990225

1 0

openSUSE-SU-2017:0434-1: moderate: Recommended update for opera
by opensuse-security＠opensuse.org 09 Feb '17

09 Feb '17

openSUSE Security Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0434-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for opera fixes the following issues: Changes in opera: - Update to version 43.0.2442.806: * See https://opera.com/blogs/desktop/changelog-for-43 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-232=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2017-232=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-43.0.2442.806-21.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-43.0.2442.806-58.1 References:

1 0

openSUSE-SU-2017:0429-1: moderate: Security update for rubygem-minitar
by opensuse-security＠opensuse.org 09 Feb '17

09 Feb '17

openSUSE Security Update: Security update for rubygem-minitar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0429-1 Rating: moderate References: #1021740 Cross-References: CVE-2016-10173 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-minitar fixes the following issues: - CVE-2016-10173: Fixed a directory traversal vulnerability in rubygem-minitar, rubygem-archive-tar-minitar. (boo#1021740) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-231=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ruby2.1-rubygem-minitar-0.5.4-3.1 ruby2.1-rubygem-minitar-doc-0.5.4-3.1 References: https://www.suse.com/security/cve/CVE-2016-10173.html https://bugzilla.suse.com/1021740

1 0

openSUSE-SU-2017:0428-1: Security update for libplist
by opensuse-security＠opensuse.org 09 Feb '17

09 Feb '17

openSUSE Security Update: Security update for libplist ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0428-1 Rating: low References: #1019531 #1021610 Cross-References: CVE-2017-5209 CVE-2017-5545 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libplist addresses the following vulnerabilities: - CVE-2017-5545: OOB heap buffer read which could allow attackers to obtain sensitive information from process memory or cause a DoS (bsc#1021610) - CVE-2017-5209: base64decode function could have allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-230=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-230=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libplist++-devel-1.12-5.1 libplist++3-1.12-5.1 libplist++3-debuginfo-1.12-5.1 libplist-debugsource-1.12-5.1 libplist-devel-1.12-5.1 libplist3-1.12-5.1 libplist3-debuginfo-1.12-5.1 plistutil-1.12-5.1 plistutil-debuginfo-1.12-5.1 python-plist-1.12-5.1 python-plist-debuginfo-1.12-5.1 - openSUSE Leap 42.2 (x86_64): libplist++3-32bit-1.12-5.1 libplist++3-debuginfo-32bit-1.12-5.1 libplist3-32bit-1.12-5.1 libplist3-debuginfo-32bit-1.12-5.1 - openSUSE Leap 42.1 (i586 x86_64): libplist++-devel-1.12-4.1 libplist++3-1.12-4.1 libplist++3-debuginfo-1.12-4.1 libplist-debugsource-1.12-4.1 libplist-devel-1.12-4.1 libplist3-1.12-4.1 libplist3-debuginfo-1.12-4.1 plistutil-1.12-4.1 plistutil-debuginfo-1.12-4.1 python-plist-1.12-4.1 python-plist-debuginfo-1.12-4.1 - openSUSE Leap 42.1 (x86_64): libplist++3-32bit-1.12-4.1 libplist++3-debuginfo-32bit-1.12-4.1 libplist3-32bit-1.12-4.1 libplist3-debuginfo-32bit-1.12-4.1 References: https://www.suse.com/security/cve/CVE-2017-5209.html https://www.suse.com/security/cve/CVE-2017-5545.html https://bugzilla.suse.com/1019531 https://bugzilla.suse.com/1021610

1 0

openSUSE-RU-2017:0422-1: moderate: Recommended update for calibre
by maintenance＠opensuse.org 08 Feb '17

08 Feb '17

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0422-1 Rating: moderate References: #1011610 #1022710 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for calibre fixes the following issues: - boo#1022710: when upgrading from openSUSE 13.2, the package install may fail - boo#1011610: calibre could crash upon opening In addition, calibre was updated to 2.78.0 to deliver the following features and improvements: - Kobo driver: Update to support the newest firmware from Kobo - Amazon metadata download: Add support for downloading from amazon.ca Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-229=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-229=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): calibre-2.78.0-7.1 calibre-debuginfo-2.78.0-7.1 calibre-debugsource-2.78.0-7.1 - openSUSE Leap 42.1 (i586 x86_64): calibre-2.78.0-30.1 calibre-debuginfo-2.78.0-30.1 calibre-debugsource-2.78.0-30.1 References: https://bugzilla.suse.com/1011610 https://bugzilla.suse.com/1022710

1 0

openSUSE-SU-2017:0421-1: important: Security update for spice
by opensuse-security＠opensuse.org 08 Feb '17

08 Feb '17

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0421-1 Rating: important References: #1023078 #1023079 Cross-References: CVE-2016-9577 CVE-2016-9578 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This security update for spice fixes the following issues: CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. (bsc#1023078) CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-227=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libspice-server-devel-0.12.5-11.1 libspice-server1-0.12.5-11.1 libspice-server1-debuginfo-0.12.5-11.1 spice-client-0.12.5-11.1 spice-client-debuginfo-0.12.5-11.1 spice-debugsource-0.12.5-11.1 References: https://www.suse.com/security/cve/CVE-2016-9577.html https://www.suse.com/security/cve/CVE-2016-9578.html https://bugzilla.suse.com/1023078 https://bugzilla.suse.com/1023079

1 0

openSUSE-RU-2017:0420-1: moderate: Recommended update for clamav-database
by maintenance＠opensuse.org 08 Feb '17

08 Feb '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0420-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh on February 6th 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-226=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-226=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201702060005-37.1 - openSUSE Leap 42.1 (noarch): clamav-database-201702060005-216.1 References:

1 0

openSUSE-SU-2017:0419-1: important: Security update for spice
by opensuse-security＠opensuse.org 08 Feb '17

08 Feb '17

openSUSE Security Update: Security update for spice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0419-1 Rating: important References: #1023078 #1023079 Cross-References: CVE-2016-9577 CVE-2016-9578 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This security update for spice fixes the following issues: - CVE-2016-9577: A buffer overflow in the spice server could have potentially been used by unauthenticated attackers to execute arbitrary code. (bsc#1023078) - CVE-2016-9578: Unauthenticated attackers could have caused a denial of service via a crafted message. (bsc#1023079) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-228=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libspice-server-devel-0.12.7-3.1 libspice-server1-0.12.7-3.1 libspice-server1-debuginfo-0.12.7-3.1 spice-client-0.12.7-3.1 spice-debugsource-0.12.7-3.1 References: https://www.suse.com/security/cve/CVE-2016-9577.html https://www.suse.com/security/cve/CVE-2016-9578.html https://bugzilla.suse.com/1023078 https://bugzilla.suse.com/1023079

1 0

openSUSE-RU-2017:0416-1: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 07 Feb '17

07 Feb '17

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0416-1 Rating: low References: #1022050 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Fix unpainted areas when glamor is being used. (boo#1022050) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-224=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xorg-x11-server-7.6_1.18.3-10.1 xorg-x11-server-debuginfo-7.6_1.18.3-10.1 xorg-x11-server-debugsource-7.6_1.18.3-10.1 xorg-x11-server-extra-7.6_1.18.3-10.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-10.1 xorg-x11-server-sdk-7.6_1.18.3-10.1 xorg-x11-server-source-7.6_1.18.3-10.1 References: https://bugzilla.suse.com/1022050

1 0