February 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:0414-1: Recommended update for gnome-todo
by maintenance＠opensuse.org 07 Feb '17

07 Feb '17

openSUSE Recommended Update: Recommended update for gnome-todo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0414-1 Rating: low References: #1021815 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-todo fixes the following issues: - Avoid a crash when closing a task's detailed view. (bgo#768319, boo#1021815) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-225=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): gnome-todo-lang-3.20.2-3.1 - openSUSE Leap 42.2 (x86_64): gnome-todo-3.20.2-3.1 gnome-todo-debuginfo-3.20.2-3.1 gnome-todo-debugsource-3.20.2-3.1 gnome-todo-devel-3.20.2-3.1 typelib-1_0-Gtd-1_0-3.20.2-3.1 References: https://bugzilla.suse.com/1021815

1 0

openSUSE-SU-2017:0413-1: Security update for irssi
by opensuse-security＠opensuse.org 07 Feb '17

07 Feb '17

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0413-1 Rating: low References: #1023637 #1023638 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The IRC textmode client irssi was updated to version 1.0.1 to fix bugs and security issues. irssi 1.0.1: * Fix Perl compilation in object dir * Fix incorrect HELP SERVER example * Correct memory leak in /OP and /VOICE * Fix regression that broke second level completion * Correct missing NULL termination in perl_parse boo#1023638 * Sync broken mail.pl script * Prevent a memory leak during the processing of the SASL response boo#1023637 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-223=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.0.1-18.1 irssi-devel-1.0.1-18.1 References: https://bugzilla.suse.com/1023637 https://bugzilla.suse.com/1023638

1 0

openSUSE-SU-2017:0409-1: moderate: Security update for libressl
by opensuse-security＠opensuse.org 07 Feb '17

07 Feb '17

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0409-1 Rating: moderate References: #1019334 Cross-References: CVE-2016-7056 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libressl fixes the following issues: - CVE-2016-7056: Difficult to execute cache timing attack that may have allowed a local user to recover the private part from ECDSA P-256 keys (boo#1019334) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-222=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-222=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libcrypto37-2.3.4-3.1 libcrypto37-debuginfo-2.3.4-3.1 libressl-2.3.4-3.1 libressl-debuginfo-2.3.4-3.1 libressl-debugsource-2.3.4-3.1 libressl-devel-2.3.4-3.1 libssl38-2.3.4-3.1 libssl38-debuginfo-2.3.4-3.1 libtls10-2.3.4-3.1 libtls10-debuginfo-2.3.4-3.1 - openSUSE Leap 42.2 (x86_64): libcrypto37-32bit-2.3.4-3.1 libcrypto37-debuginfo-32bit-2.3.4-3.1 libressl-devel-32bit-2.3.4-3.1 libssl38-32bit-2.3.4-3.1 libssl38-debuginfo-32bit-2.3.4-3.1 libtls10-32bit-2.3.4-3.1 libtls10-debuginfo-32bit-2.3.4-3.1 - openSUSE Leap 42.2 (noarch): libressl-devel-doc-2.3.4-3.1 - openSUSE Leap 42.1 (i586 x86_64): libcrypto36-2.3.0-10.1 libcrypto36-debuginfo-2.3.0-10.1 libressl-2.3.0-10.1 libressl-debuginfo-2.3.0-10.1 libressl-debugsource-2.3.0-10.1 libressl-devel-2.3.0-10.1 libssl37-2.3.0-10.1 libssl37-debuginfo-2.3.0-10.1 libtls9-2.3.0-10.1 libtls9-debuginfo-2.3.0-10.1 - openSUSE Leap 42.1 (noarch): libressl-devel-doc-2.3.0-10.1 - openSUSE Leap 42.1 (x86_64): libcrypto36-32bit-2.3.0-10.1 libcrypto36-debuginfo-32bit-2.3.0-10.1 libressl-devel-32bit-2.3.0-10.1 libssl37-32bit-2.3.0-10.1 libssl37-debuginfo-32bit-2.3.0-10.1 libtls9-32bit-2.3.0-10.1 libtls9-debuginfo-32bit-2.3.0-10.1 References: https://www.suse.com/security/cve/CVE-2016-7056.html https://bugzilla.suse.com/1019334

1 0

openSUSE-OU-2017:0406-1: moderate: Add rubygem-httpclient to the SUSE Package Hub
by maintenance＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Optional Update: Add rubygem-httpclient to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0406-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds rubygem-httpclient to the SUSE Package Hub. It adds HTTP client functionality to Ruby. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-220=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ruby2.1-rubygem-httpclient-2.8.3-2.1 ruby2.1-rubygem-httpclient-doc-2.8.3-2.1 ruby2.1-rubygem-httpclient-testsuite-2.8.3-2.1 References:

1 0

openSUSE-SU-2017:0405-1: moderate: Security update for libgit2
by opensuse-security＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Security Update: Security update for libgit2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0405-1 Rating: moderate References: #1019036 #1019037 Cross-References: CVE-2016-10128 CVE-2016-10129 CVE-2016-10130 CVE-2017-5338 CVE-2017-5339 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgit2 to version 0.24.6 fixes the following issues: - CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037). - CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). - CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-216=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 s390x x86_64): libgit2-24-0.24.6-10.1 libgit2-devel-0.24.6-10.1 References: https://www.suse.com/security/cve/CVE-2016-10128.html https://www.suse.com/security/cve/CVE-2016-10129.html https://www.suse.com/security/cve/CVE-2016-10130.html https://www.suse.com/security/cve/CVE-2017-5338.html https://www.suse.com/security/cve/CVE-2017-5339.html https://bugzilla.suse.com/1019036 https://bugzilla.suse.com/1019037

1 0

openSUSE-OU-2017:0404-1: moderate: Add FATE to the SUSE Package Hub
by maintenance＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Optional Update: Add FATE to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0404-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update make FATE available in the SUSE Package Hub. FATE is the SUSE Feature Management Tool. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-221=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (s390x x86_64): fate-1.5.5.7.1-2.1 fate-debuginfo-1.5.5.7.1-2.1 References:

1 0

openSUSE-OU-2017:0403-1: moderate: Add Regina-REXX to the SUSE Package Hub.
by maintenance＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Optional Update: Add Regina-REXX to the SUSE Package Hub. ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0403-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds Regina-REXX to the SUSE Package Hub. Regina-REXX is a REXX interpreter. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-218=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): Regina-REXX-3.9.1-2.1 Regina-REXX-devel-3.9.1-2.1 Regina-REXX-doc-3.9.1-2.1 libregina3-3.9.1-2.1 References:

1 0

openSUSE-OU-2017:0402-1: moderate: Add waffle to the SUSE Package Hub
by maintenance＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Optional Update: Add waffle to the SUSE Package Hub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0402-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update make waffle available in the SUSE Package Hub. Waffle is a cross-platform C library that allows one to defer selection of an OpenGL API and window system until runtime. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-219=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libwaffle-1-0-1.5.2-2.1 waffle-1.5.2-2.1 waffle-devel-1.5.2-2.1 References:

1 0

openSUSE-RU-2017:0401-1: moderate: Recommended update for nano
by maintenance＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Recommended Update: Recommended update for nano ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0401-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for nano to version 2.7.4 delivers the latest version of the editor to the SUSE Package Hub. * syntax highlighting improvements and fixes * new feature: trim end-of-line whitespace when justifying * Go To Line takes negative numbers, relative to bottom of text * new feature: select text by Shift+cursor * add ability to display line numbers * file browser improvements * many bug fixes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-217=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): nano-2.7.4-6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nano-lang-2.7.4-6.1 References:

1 0

openSUSE-SU-2017:0399-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 06 Feb '17

06 Feb '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0399-1 Rating: moderate References: #1017310 #1017312 #1017313 #1017314 #1017324 #1017326 #1020443 #1020448 Cross-References: CVE-2016-10048 CVE-2016-10050 CVE-2016-10051 CVE-2016-10052 CVE-2016-10068 CVE-2016-10070 CVE-2016-10146 CVE-2017-5511 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for GraphicsMagick fixes several issues. These security issues were fixed: - CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310) - CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312) - CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313) - CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314) - CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324) - CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326) - CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443) - CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-212=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-9.1 GraphicsMagick-debuginfo-1.3.25-9.1 GraphicsMagick-debugsource-1.3.25-9.1 GraphicsMagick-devel-1.3.25-9.1 libGraphicsMagick++-Q16-12-1.3.25-9.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-9.1 libGraphicsMagick++-devel-1.3.25-9.1 libGraphicsMagick-Q16-3-1.3.25-9.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-9.1 libGraphicsMagick3-config-1.3.25-9.1 libGraphicsMagickWand-Q16-2-1.3.25-9.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-9.1 perl-GraphicsMagick-1.3.25-9.1 perl-GraphicsMagick-debuginfo-1.3.25-9.1 References: https://www.suse.com/security/cve/CVE-2016-10048.html https://www.suse.com/security/cve/CVE-2016-10050.html https://www.suse.com/security/cve/CVE-2016-10051.html https://www.suse.com/security/cve/CVE-2016-10052.html https://www.suse.com/security/cve/CVE-2016-10068.html https://www.suse.com/security/cve/CVE-2016-10070.html https://www.suse.com/security/cve/CVE-2016-10146.html https://www.suse.com/security/cve/CVE-2017-5511.html https://bugzilla.suse.com/1017310 https://bugzilla.suse.com/1017312 https://bugzilla.suse.com/1017313 https://bugzilla.suse.com/1017314 https://bugzilla.suse.com/1017324 https://bugzilla.suse.com/1017326 https://bugzilla.suse.com/1020443 https://bugzilla.suse.com/1020448

1 0