March 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:0654-1: important: Recommended update for docker
by maintenance＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0654-1 Rating: important References: #1016992 #1020806 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for docker fixes the following issues: - fix "Unknown runtime specified oci" errors with containers using an old runtime option boo#1020806 boo#1016992 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-321=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-321=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): docker-bash-completion-1.12.6-28.2 docker-zsh-completion-1.12.6-28.2 - openSUSE Leap 42.2 (x86_64): docker-1.12.6-28.2 docker-debuginfo-1.12.6-28.2 docker-debugsource-1.12.6-28.2 docker-test-1.12.6-28.2 docker-test-debuginfo-1.12.6-28.2 - openSUSE Leap 42.1 (x86_64): docker-1.12.6-30.2 docker-debuginfo-1.12.6-30.2 docker-debugsource-1.12.6-30.2 docker-test-1.12.6-30.2 docker-test-debuginfo-1.12.6-30.2 - openSUSE Leap 42.1 (noarch): docker-bash-completion-1.12.6-30.2 docker-zsh-completion-1.12.6-30.2 References: https://bugzilla.suse.com/1016992 https://bugzilla.suse.com/1020806

1 0

openSUSE-RU-2017:0653-1: moderate: Recommended update for spectacle
by maintenance＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Recommended Update: Recommended update for spectacle ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0653-1 Rating: moderate References: #1026635 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spectacle fixes the following issues: - use the desktop's native file dialog for the Save As option instead of the generic Qt dialog (boo#1026635) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-324=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): spectacle-16.08.2-3.1 spectacle-debuginfo-16.08.2-3.1 spectacle-debugsource-16.08.2-3.1 spectacle-doc-16.08.2-3.1 References: https://bugzilla.suse.com/1026635

1 0

openSUSE-RU-2017:0652-1: important: Recommended update for thunar
by maintenance＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Recommended Update: Recommended update for thunar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0652-1 Rating: important References: #1011518 #1012237 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for thunar fixes the following issues: - crash for on cut/pasting of multiple files (boo#1012237) - crash when renaming files (boo #1011518) - history deleted after view change - crashes when reloading target file after move Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-323=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-323=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): thunar-lang-1.6.10-6.1 - openSUSE Leap 42.2 (x86_64): libthunarx-2-0-1.6.10-6.1 libthunarx-2-0-debuginfo-1.6.10-6.1 thunar-1.6.10-6.1 thunar-debuginfo-1.6.10-6.1 thunar-debugsource-1.6.10-6.1 thunar-devel-1.6.10-6.1 - openSUSE Leap 42.1 (i586 x86_64): libthunarx-2-0-1.6.10-7.1 libthunarx-2-0-debuginfo-1.6.10-7.1 thunar-1.6.10-7.1 thunar-debuginfo-1.6.10-7.1 thunar-debugsource-1.6.10-7.1 thunar-devel-1.6.10-7.1 - openSUSE Leap 42.1 (noarch): thunar-lang-1.6.10-7.1 References: https://bugzilla.suse.com/1011518 https://bugzilla.suse.com/1012237

1 0

openSUSE-RU-2017:0650-1: Recommended update for timezone
by maintenance＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0650-1 Rating: low References: #1024676 #1024677 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides the latest timezone information (2017a) for your system, including the following changes: - Mongolia no longer observes DST. (bsc#1024676) - Chile's Region of Magallanes moves from -04/-03 to -03 year-round starting 2017-05-13 23:00. Split from America/Santiago creating a new zone America/Punta_Arenas. Also affects Antarctica/Palmer. (bsc#1024677) - Fixes to historical time stamps: Spain, Ecuador, Atyrau, Oral. - Switch to numeric, or commonly used time zone abbreviations. - zic(8) no longer mishandles some transitions in January 2038. - date and strftime now cause %z to generate "-0000" instead of "+0000" when the UT offset is zero and the time zone abbreviation begins with "-". This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-320=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-320=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): timezone-2017a-37.1 timezone-debuginfo-2017a-37.1 timezone-debugsource-2017a-37.1 - openSUSE Leap 42.2 (noarch): timezone-java-2017a-0.37.1 - openSUSE Leap 42.1 (i586 x86_64): timezone-2017a-37.1 timezone-debuginfo-2017a-37.1 timezone-debugsource-2017a-37.1 - openSUSE Leap 42.1 (noarch): timezone-java-2017a-0.37.1 References: https://bugzilla.suse.com/1024676 https://bugzilla.suse.com/1024677

1 0

openSUSE-SU-2017:0649-1: moderate: Security update for sane-backends
by opensuse-security＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Security Update: Security update for sane-backends ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0649-1 Rating: moderate References: #1027197 Cross-References: CVE-2017-6318 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sane-backends fixes the following issues: - saned could have leaked uninitialized memory back to its requesters for some opcodes, allowing for information disclosure of saned memory (CVE-2017-6318, bsc#1027197). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-318=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): sane-backends-1.0.24-5.1 sane-backends-autoconfig-1.0.24-5.1 sane-backends-debuginfo-1.0.24-5.1 sane-backends-debugsource-1.0.24-5.1 sane-backends-devel-1.0.24-5.1 - openSUSE Leap 42.1 (x86_64): sane-backends-32bit-1.0.24-5.1 sane-backends-debuginfo-32bit-1.0.24-5.1 References: https://www.suse.com/security/cve/CVE-2017-6318.html https://bugzilla.suse.com/1027197

1 0

openSUSE-SU-2017:0648-1: moderate: Security update for potrace
by opensuse-security＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Security Update: Security update for potrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0648-1 Rating: moderate References: #1005026 Cross-References: CVE-2016-8685 CVE-2016-8686 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for potrace to version 1.14 fixes the following issues: Security issues fixed: - CVE-2016-8685, CVE-2016-8686: Bugs triggered by malformed BMP files have been fixed (boo#1005026). Bugfixes: - Error reporting has been improved. - The image size is now truncated when the bitmap data ends prematurely. - It is now possible to use negative dy in bitmap data. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-319=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-319=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libpotrace0-1.14-8.1 libpotrace0-debuginfo-1.14-8.1 potrace-1.14-8.1 potrace-debuginfo-1.14-8.1 potrace-debugsource-1.14-8.1 potrace-devel-1.14-8.1 - openSUSE Leap 42.1 (i586 x86_64): libpotrace0-1.14-8.1 libpotrace0-debuginfo-1.14-8.1 potrace-1.14-8.1 potrace-debuginfo-1.14-8.1 potrace-debugsource-1.14-8.1 potrace-devel-1.14-8.1 References: https://www.suse.com/security/cve/CVE-2016-8685.html https://www.suse.com/security/cve/CVE-2016-8686.html https://bugzilla.suse.com/1005026

1 0

openSUSE-RU-2017:0628-1: moderate: Recommended update for opera
by maintenance＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Recommended Update: Recommended update for opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0628-1 Rating: moderate References: #1028011 Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for Opera fixes the following issues: - Update Opera to 43.0.2442.1144, full changelog at https://www.opera.com/blogs/desktop/changelog-for-43/#b2442.1144 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-317=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2017-317=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-43.0.2442.1144-27.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-43.0.2442.1144-64.1 References: https://bugzilla.suse.com/1028011

1 0

openSUSE-SU-2017:0621-1: important: Security update for munin
by opensuse-security＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Security Update: Security update for munin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0621-1 Rating: important References: #1026539 Cross-References: CVE-2017-6188 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for munin fixes the following issues: - An attacker has been able to write arbitrary local files with the permissions of the web server, by using parameter injection (boo#1026539, CVE-2017-6188) - The MySQL plugin has been fixed to work correctly against MySQL 5.5 on Leap 42.1 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-310=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-310=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): munin-2.0.25-9.1 munin-node-2.0.25-9.1 - openSUSE Leap 42.1 (noarch): munin-2.0.25-7.1 munin-node-2.0.25-7.1 References: https://www.suse.com/security/cve/CVE-2017-6188.html https://bugzilla.suse.com/1026539

1 0

openSUSE-SU-2017:0620-1: moderate: Security update for bind
by opensuse-security＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0620-1 Rating: moderate References: #1024130 Cross-References: CVE-2017-3135 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - Fixed a possible denial of service vulnerability (affected only configurations using both DNS64 and RPZ, CVE-2017-3135, bsc#1024130) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-314=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-314=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): bind-9.9.9P1-46.1 bind-chrootenv-9.9.9P1-46.1 bind-debuginfo-9.9.9P1-46.1 bind-debugsource-9.9.9P1-46.1 bind-devel-9.9.9P1-46.1 bind-libs-9.9.9P1-46.1 bind-libs-debuginfo-9.9.9P1-46.1 bind-lwresd-9.9.9P1-46.1 bind-lwresd-debuginfo-9.9.9P1-46.1 bind-utils-9.9.9P1-46.1 bind-utils-debuginfo-9.9.9P1-46.1 - openSUSE Leap 42.2 (noarch): bind-doc-9.9.9P1-46.1 - openSUSE Leap 42.2 (x86_64): bind-libs-32bit-9.9.9P1-46.1 bind-libs-debuginfo-32bit-9.9.9P1-46.1 - openSUSE Leap 42.1 (i586 x86_64): bind-9.9.9P1-48.1 bind-chrootenv-9.9.9P1-48.1 bind-debuginfo-9.9.9P1-48.1 bind-debugsource-9.9.9P1-48.1 bind-devel-9.9.9P1-48.1 bind-libs-9.9.9P1-48.1 bind-libs-debuginfo-9.9.9P1-48.1 bind-lwresd-9.9.9P1-48.1 bind-lwresd-debuginfo-9.9.9P1-48.1 bind-utils-9.9.9P1-48.1 bind-utils-debuginfo-9.9.9P1-48.1 - openSUSE Leap 42.1 (noarch): bind-doc-9.9.9P1-48.1 - openSUSE Leap 42.1 (x86_64): bind-libs-32bit-9.9.9P1-48.1 bind-libs-debuginfo-32bit-9.9.9P1-48.1 References: https://www.suse.com/security/cve/CVE-2017-3135.html https://bugzilla.suse.com/1024130

1 0

openSUSE-RU-2017:0619-1: moderate: Recommended update for vinagre
by maintenance＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Recommended Update: Recommended update for vinagre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0619-1 Rating: moderate References: #1002350 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for vinagre fixes certificate validation incompatibilities with FreeRDP 1.2 that could lead to failure to establish RDP connections. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-316=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): vinagre-3.20.2-5.1 vinagre-debuginfo-3.20.2-5.1 vinagre-debugsource-3.20.2-5.1 - openSUSE Leap 42.2 (noarch): vinagre-lang-3.20.2-5.1 References: https://bugzilla.suse.com/1002350

1 0

openSUSE-SU-2017:0618-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0618-1 Rating: important References: #1020872 #1020873 #1020875 #1020876 #1020877 #1020878 #1020882 #1020884 #1020885 #1020890 #1020893 #1020894 #1020896 Cross-References: CVE-2016-8318 CVE-2016-8327 CVE-2017-3238 CVE-2017-3244 CVE-2017-3257 CVE-2017-3258 CVE-2017-3265 CVE-2017-3273 CVE-2017-3291 CVE-2017-3312 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: mysql-community-server was updated to version 5.6.35 to fix bugs and security issues: * Changes http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-35.html * Fixed CVEs: CVE-2016-8318 [boo#1020872], CVE-2017-3312 [boo#1020873], CVE-2017-3258 [boo#1020875], CVE-2017-3273 [boo#1020876], CVE-2017-3244 [boo#1020877], CVE-2017-3257 [boo#1020878], CVE-2017-3238 [boo#1020882], CVE-2017-3291 [boo#1020884], CVE-2017-3265 [boo#1020885], CVE-2017-3313 [boo#1020890], CVE-2016-8327 [boo#1020893], CVE-2017-3317 [boo#1020894], CVE-2017-3318 [boo#1020896] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-315=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libmysql56client18-5.6.35-22.1 libmysql56client18-debuginfo-5.6.35-22.1 libmysql56client_r18-5.6.35-22.1 mysql-community-server-5.6.35-22.1 mysql-community-server-bench-5.6.35-22.1 mysql-community-server-bench-debuginfo-5.6.35-22.1 mysql-community-server-client-5.6.35-22.1 mysql-community-server-client-debuginfo-5.6.35-22.1 mysql-community-server-debuginfo-5.6.35-22.1 mysql-community-server-debugsource-5.6.35-22.1 mysql-community-server-errormessages-5.6.35-22.1 mysql-community-server-test-5.6.35-22.1 mysql-community-server-test-debuginfo-5.6.35-22.1 mysql-community-server-tools-5.6.35-22.1 mysql-community-server-tools-debuginfo-5.6.35-22.1 - openSUSE Leap 42.2 (x86_64): libmysql56client18-32bit-5.6.35-22.1 libmysql56client18-debuginfo-32bit-5.6.35-22.1 libmysql56client_r18-32bit-5.6.35-22.1 References: https://www.suse.com/security/cve/CVE-2016-8318.html https://www.suse.com/security/cve/CVE-2016-8327.html https://www.suse.com/security/cve/CVE-2017-3238.html https://www.suse.com/security/cve/CVE-2017-3244.html https://www.suse.com/security/cve/CVE-2017-3257.html https://www.suse.com/security/cve/CVE-2017-3258.html https://www.suse.com/security/cve/CVE-2017-3265.html https://www.suse.com/security/cve/CVE-2017-3273.html https://www.suse.com/security/cve/CVE-2017-3291.html https://www.suse.com/security/cve/CVE-2017-3312.html https://www.suse.com/security/cve/CVE-2017-3313.html https://www.suse.com/security/cve/CVE-2017-3317.html https://www.suse.com/security/cve/CVE-2017-3318.html https://bugzilla.suse.com/1020872 https://bugzilla.suse.com/1020873 https://bugzilla.suse.com/1020875 https://bugzilla.suse.com/1020876 https://bugzilla.suse.com/1020877 https://bugzilla.suse.com/1020878 https://bugzilla.suse.com/1020882 https://bugzilla.suse.com/1020884 https://bugzilla.suse.com/1020885 https://bugzilla.suse.com/1020890 https://bugzilla.suse.com/1020893 https://bugzilla.suse.com/1020894 https://bugzilla.suse.com/1020896

1 0

openSUSE-OU-2017:0616-1: moderate: Optional update for png++
by maintenance＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Optional Update: Optional update for png++ ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0616-1 Rating: moderate References: #1026666 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update introduces png++ to the distribution. png++ is a C++ wrapper for the libpng library. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-311=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-311=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): png++-devel-0.2.9-2.1 - openSUSE Leap 42.1 (noarch): png++-devel-0.2.9-2.1 References: https://bugzilla.suse.com/1026666

1 0

openSUSE-OU-2017:0615-1: moderate: Optional update for waffle
by maintenance＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Optional Update: Optional update for waffle ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0615-1 Rating: moderate References: #1025632 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update introduces waffle into the distribution. Waffle is a C library defering selection of GL API and window system until runtime. It is used by the piglit testsuite. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-312=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-312=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libwaffle-1-0-1.5.2-2.1 libwaffle-1-0-debuginfo-1.5.2-2.1 waffle-1.5.2-2.1 waffle-debuginfo-1.5.2-2.1 waffle-debugsource-1.5.2-2.1 waffle-devel-1.5.2-2.1 - openSUSE Leap 42.1 (i586 x86_64): libwaffle-1-0-1.5.2-2.1 libwaffle-1-0-debuginfo-1.5.2-2.1 waffle-1.5.2-2.1 waffle-debuginfo-1.5.2-2.1 waffle-debugsource-1.5.2-2.1 waffle-devel-1.5.2-2.1 References: https://bugzilla.suse.com/1025632

1 0

openSUSE-RU-2017:0614-1: moderate: Recommended update for gnuhealth
by maintenance＠opensuse.org 07 Mar '17

07 Mar '17

openSUSE Recommended Update: Recommended update for gnuhealth ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0614-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gnuhealth fixes the following issues: - updated documentation - renamed gnuhealth_control to gnuhealth-control - added DB-role to gnuhealth-control Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-313=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): gnuhealth-3.0.6-9.1 References:

1 0

openSUSE-RU-2017:0613-1: Recommended update for clamav-database
by maintenance＠opensuse.org 06 Mar '17

06 Mar '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0613-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh March 6th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-309=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-309=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201703060005-49.1 - openSUSE Leap 42.1 (noarch): clamav-database-201703060005-228.1 References:

1 0

openSUSE-SU-2017:0598-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 03 Mar '17

03 Mar '17

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0598-1 Rating: moderate References: #1015187 #1015188 #1015189 Cross-References: CVE-2016-9933 CVE-2016-9934 CVE-2016-9935 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php5 fixes the following issues: * CVE-2016-9933 Possible stack overflow on truecolor images handling [bsc#1015187] * CVE-2016-9934 Dereference from NULL pointer could lead to crash [bsc#1015188] * CVE-2016-9935 Invalid read could lead to crash [bsc#1015189] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-308=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-308=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_php5-5.5.14-75.2 apache2-mod_php5-debuginfo-5.5.14-75.2 php5-5.5.14-75.2 php5-bcmath-5.5.14-75.2 php5-bcmath-debuginfo-5.5.14-75.2 php5-bz2-5.5.14-75.2 php5-bz2-debuginfo-5.5.14-75.2 php5-calendar-5.5.14-75.2 php5-calendar-debuginfo-5.5.14-75.2 php5-ctype-5.5.14-75.2 php5-ctype-debuginfo-5.5.14-75.2 php5-curl-5.5.14-75.2 php5-curl-debuginfo-5.5.14-75.2 php5-dba-5.5.14-75.2 php5-dba-debuginfo-5.5.14-75.2 php5-debuginfo-5.5.14-75.2 php5-debugsource-5.5.14-75.2 php5-devel-5.5.14-75.2 php5-dom-5.5.14-75.2 php5-dom-debuginfo-5.5.14-75.2 php5-enchant-5.5.14-75.2 php5-enchant-debuginfo-5.5.14-75.2 php5-exif-5.5.14-75.2 php5-exif-debuginfo-5.5.14-75.2 php5-fastcgi-5.5.14-75.2 php5-fastcgi-debuginfo-5.5.14-75.2 php5-fileinfo-5.5.14-75.2 php5-fileinfo-debuginfo-5.5.14-75.2 php5-firebird-5.5.14-75.2 php5-firebird-debuginfo-5.5.14-75.2 php5-fpm-5.5.14-75.2 php5-fpm-debuginfo-5.5.14-75.2 php5-ftp-5.5.14-75.2 php5-ftp-debuginfo-5.5.14-75.2 php5-gd-5.5.14-75.2 php5-gd-debuginfo-5.5.14-75.2 php5-gettext-5.5.14-75.2 php5-gettext-debuginfo-5.5.14-75.2 php5-gmp-5.5.14-75.2 php5-gmp-debuginfo-5.5.14-75.2 php5-iconv-5.5.14-75.2 php5-iconv-debuginfo-5.5.14-75.2 php5-imap-5.5.14-75.2 php5-imap-debuginfo-5.5.14-75.2 php5-intl-5.5.14-75.2 php5-intl-debuginfo-5.5.14-75.2 php5-json-5.5.14-75.2 php5-json-debuginfo-5.5.14-75.2 php5-ldap-5.5.14-75.2 php5-ldap-debuginfo-5.5.14-75.2 php5-mbstring-5.5.14-75.2 php5-mbstring-debuginfo-5.5.14-75.2 php5-mcrypt-5.5.14-75.2 php5-mcrypt-debuginfo-5.5.14-75.2 php5-mssql-5.5.14-75.2 php5-mssql-debuginfo-5.5.14-75.2 php5-mysql-5.5.14-75.2 php5-mysql-debuginfo-5.5.14-75.2 php5-odbc-5.5.14-75.2 php5-odbc-debuginfo-5.5.14-75.2 php5-opcache-5.5.14-75.2 php5-opcache-debuginfo-5.5.14-75.2 php5-openssl-5.5.14-75.2 php5-openssl-debuginfo-5.5.14-75.2 php5-pcntl-5.5.14-75.2 php5-pcntl-debuginfo-5.5.14-75.2 php5-pdo-5.5.14-75.2 php5-pdo-debuginfo-5.5.14-75.2 php5-pgsql-5.5.14-75.2 php5-pgsql-debuginfo-5.5.14-75.2 php5-phar-5.5.14-75.2 php5-phar-debuginfo-5.5.14-75.2 php5-posix-5.5.14-75.2 php5-posix-debuginfo-5.5.14-75.2 php5-pspell-5.5.14-75.2 php5-pspell-debuginfo-5.5.14-75.2 php5-readline-5.5.14-75.2 php5-readline-debuginfo-5.5.14-75.2 php5-shmop-5.5.14-75.2 php5-shmop-debuginfo-5.5.14-75.2 php5-snmp-5.5.14-75.2 php5-snmp-debuginfo-5.5.14-75.2 php5-soap-5.5.14-75.2 php5-soap-debuginfo-5.5.14-75.2 php5-sockets-5.5.14-75.2 php5-sockets-debuginfo-5.5.14-75.2 php5-sqlite-5.5.14-75.2 php5-sqlite-debuginfo-5.5.14-75.2 php5-suhosin-5.5.14-75.2 php5-suhosin-debuginfo-5.5.14-75.2 php5-sysvmsg-5.5.14-75.2 php5-sysvmsg-debuginfo-5.5.14-75.2 php5-sysvsem-5.5.14-75.2 php5-sysvsem-debuginfo-5.5.14-75.2 php5-sysvshm-5.5.14-75.2 php5-sysvshm-debuginfo-5.5.14-75.2 php5-tidy-5.5.14-75.2 php5-tidy-debuginfo-5.5.14-75.2 php5-tokenizer-5.5.14-75.2 php5-tokenizer-debuginfo-5.5.14-75.2 php5-wddx-5.5.14-75.2 php5-wddx-debuginfo-5.5.14-75.2 php5-xmlreader-5.5.14-75.2 php5-xmlreader-debuginfo-5.5.14-75.2 php5-xmlrpc-5.5.14-75.2 php5-xmlrpc-debuginfo-5.5.14-75.2 php5-xmlwriter-5.5.14-75.2 php5-xmlwriter-debuginfo-5.5.14-75.2 php5-xsl-5.5.14-75.2 php5-xsl-debuginfo-5.5.14-75.2 php5-zip-5.5.14-75.2 php5-zip-debuginfo-5.5.14-75.2 php5-zlib-5.5.14-75.2 php5-zlib-debuginfo-5.5.14-75.2 - openSUSE Leap 42.2 (noarch): php5-pear-5.5.14-75.2 - openSUSE Leap 42.1 (i586 x86_64): apache2-mod_php5-5.5.14-75.1 apache2-mod_php5-debuginfo-5.5.14-75.1 php5-5.5.14-75.1 php5-bcmath-5.5.14-75.1 php5-bcmath-debuginfo-5.5.14-75.1 php5-bz2-5.5.14-75.1 php5-bz2-debuginfo-5.5.14-75.1 php5-calendar-5.5.14-75.1 php5-calendar-debuginfo-5.5.14-75.1 php5-ctype-5.5.14-75.1 php5-ctype-debuginfo-5.5.14-75.1 php5-curl-5.5.14-75.1 php5-curl-debuginfo-5.5.14-75.1 php5-dba-5.5.14-75.1 php5-dba-debuginfo-5.5.14-75.1 php5-debuginfo-5.5.14-75.1 php5-debugsource-5.5.14-75.1 php5-devel-5.5.14-75.1 php5-dom-5.5.14-75.1 php5-dom-debuginfo-5.5.14-75.1 php5-enchant-5.5.14-75.1 php5-enchant-debuginfo-5.5.14-75.1 php5-exif-5.5.14-75.1 php5-exif-debuginfo-5.5.14-75.1 php5-fastcgi-5.5.14-75.1 php5-fastcgi-debuginfo-5.5.14-75.1 php5-fileinfo-5.5.14-75.1 php5-fileinfo-debuginfo-5.5.14-75.1 php5-firebird-5.5.14-75.1 php5-firebird-debuginfo-5.5.14-75.1 php5-fpm-5.5.14-75.1 php5-fpm-debuginfo-5.5.14-75.1 php5-ftp-5.5.14-75.1 php5-ftp-debuginfo-5.5.14-75.1 php5-gd-5.5.14-75.1 php5-gd-debuginfo-5.5.14-75.1 php5-gettext-5.5.14-75.1 php5-gettext-debuginfo-5.5.14-75.1 php5-gmp-5.5.14-75.1 php5-gmp-debuginfo-5.5.14-75.1 php5-iconv-5.5.14-75.1 php5-iconv-debuginfo-5.5.14-75.1 php5-imap-5.5.14-75.1 php5-imap-debuginfo-5.5.14-75.1 php5-intl-5.5.14-75.1 php5-intl-debuginfo-5.5.14-75.1 php5-json-5.5.14-75.1 php5-json-debuginfo-5.5.14-75.1 php5-ldap-5.5.14-75.1 php5-ldap-debuginfo-5.5.14-75.1 php5-mbstring-5.5.14-75.1 php5-mbstring-debuginfo-5.5.14-75.1 php5-mcrypt-5.5.14-75.1 php5-mcrypt-debuginfo-5.5.14-75.1 php5-mssql-5.5.14-75.1 php5-mssql-debuginfo-5.5.14-75.1 php5-mysql-5.5.14-75.1 php5-mysql-debuginfo-5.5.14-75.1 php5-odbc-5.5.14-75.1 php5-odbc-debuginfo-5.5.14-75.1 php5-opcache-5.5.14-75.1 php5-opcache-debuginfo-5.5.14-75.1 php5-openssl-5.5.14-75.1 php5-openssl-debuginfo-5.5.14-75.1 php5-pcntl-5.5.14-75.1 php5-pcntl-debuginfo-5.5.14-75.1 php5-pdo-5.5.14-75.1 php5-pdo-debuginfo-5.5.14-75.1 php5-pgsql-5.5.14-75.1 php5-pgsql-debuginfo-5.5.14-75.1 php5-phar-5.5.14-75.1 php5-phar-debuginfo-5.5.14-75.1 php5-posix-5.5.14-75.1 php5-posix-debuginfo-5.5.14-75.1 php5-pspell-5.5.14-75.1 php5-pspell-debuginfo-5.5.14-75.1 php5-readline-5.5.14-75.1 php5-readline-debuginfo-5.5.14-75.1 php5-shmop-5.5.14-75.1 php5-shmop-debuginfo-5.5.14-75.1 php5-snmp-5.5.14-75.1 php5-snmp-debuginfo-5.5.14-75.1 php5-soap-5.5.14-75.1 php5-soap-debuginfo-5.5.14-75.1 php5-sockets-5.5.14-75.1 php5-sockets-debuginfo-5.5.14-75.1 php5-sqlite-5.5.14-75.1 php5-sqlite-debuginfo-5.5.14-75.1 php5-suhosin-5.5.14-75.1 php5-suhosin-debuginfo-5.5.14-75.1 php5-sysvmsg-5.5.14-75.1 php5-sysvmsg-debuginfo-5.5.14-75.1 php5-sysvsem-5.5.14-75.1 php5-sysvsem-debuginfo-5.5.14-75.1 php5-sysvshm-5.5.14-75.1 php5-sysvshm-debuginfo-5.5.14-75.1 php5-tidy-5.5.14-75.1 php5-tidy-debuginfo-5.5.14-75.1 php5-tokenizer-5.5.14-75.1 php5-tokenizer-debuginfo-5.5.14-75.1 php5-wddx-5.5.14-75.1 php5-wddx-debuginfo-5.5.14-75.1 php5-xmlreader-5.5.14-75.1 php5-xmlreader-debuginfo-5.5.14-75.1 php5-xmlrpc-5.5.14-75.1 php5-xmlrpc-debuginfo-5.5.14-75.1 php5-xmlwriter-5.5.14-75.1 php5-xmlwriter-debuginfo-5.5.14-75.1 php5-xsl-5.5.14-75.1 php5-xsl-debuginfo-5.5.14-75.1 php5-zip-5.5.14-75.1 php5-zip-debuginfo-5.5.14-75.1 php5-zlib-5.5.14-75.1 php5-zlib-debuginfo-5.5.14-75.1 - openSUSE Leap 42.1 (noarch): php5-pear-5.5.14-75.1 References: https://www.suse.com/security/cve/CVE-2016-9933.html https://www.suse.com/security/cve/CVE-2016-9934.html https://www.suse.com/security/cve/CVE-2016-9935.html https://bugzilla.suse.com/1015187 https://bugzilla.suse.com/1015188 https://bugzilla.suse.com/1015189

1 0

openSUSE-RU-2017:0597-1: Recommended update for clamav-database
by maintenance＠opensuse.org 03 Mar '17

03 Mar '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0597-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh Feb 27th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-307=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-307=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201702270005-46.1 - openSUSE Leap 42.1 (noarch): clamav-database-201702270005-225.1 References:

1 0

openSUSE-SU-2017:0590-1: important: Security update for util-linux
by opensuse-security＠opensuse.org 02 Mar '17

02 Mar '17

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0590-1 Rating: important References: #1008965 #1012504 #1012632 #1019332 #1020077 #1023041 Cross-References: CVE-2017-2616 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update for util-linux fixes the following issues: This security issue was fixed: - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041). This non-security issues were fixed: - lscpu: Implement WSL detection and work around crash (bsc#1019332) - fstrim: De-duplicate btrfs sub-volumes for "fstrim -a" and bind mounts (bsc#1020077) - Fix regressions in safe loop re-use patch set for libmount (bsc#1012504) - Disable ro checks for mtab (bsc#1012632) - Ensure that the option "users,exec,dev,suid" work as expected on NFS mounts (bsc#1008965) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-305=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libblkid-devel-2.25-21.1 libblkid1-2.25-21.1 libblkid1-debuginfo-2.25-21.1 libmount-devel-2.25-21.1 libmount1-2.25-21.1 libmount1-debuginfo-2.25-21.1 libsmartcols-devel-2.25-21.1 libsmartcols1-2.25-21.1 libsmartcols1-debuginfo-2.25-21.1 libuuid-devel-2.25-21.1 libuuid1-2.25-21.1 libuuid1-debuginfo-2.25-21.1 python-libmount-2.25-21.1 python-libmount-debuginfo-2.25-21.1 python-libmount-debugsource-2.25-21.1 util-linux-2.25-21.1 util-linux-debuginfo-2.25-21.1 util-linux-debugsource-2.25-21.1 util-linux-systemd-2.25-21.1 util-linux-systemd-debuginfo-2.25-21.1 util-linux-systemd-debugsource-2.25-21.1 uuidd-2.25-21.1 uuidd-debuginfo-2.25-21.1 - openSUSE Leap 42.1 (noarch): util-linux-lang-2.25-21.1 - openSUSE Leap 42.1 (x86_64): libblkid-devel-32bit-2.25-21.1 libblkid1-32bit-2.25-21.1 libblkid1-debuginfo-32bit-2.25-21.1 libmount-devel-32bit-2.25-21.1 libmount1-32bit-2.25-21.1 libmount1-debuginfo-32bit-2.25-21.1 libuuid-devel-32bit-2.25-21.1 libuuid1-32bit-2.25-21.1 libuuid1-debuginfo-32bit-2.25-21.1 References: https://www.suse.com/security/cve/CVE-2017-2616.html https://bugzilla.suse.com/1008965 https://bugzilla.suse.com/1012504 https://bugzilla.suse.com/1012632 https://bugzilla.suse.com/1019332 https://bugzilla.suse.com/1020077 https://bugzilla.suse.com/1023041

1 0

openSUSE-SU-2017:0589-1: important: Security update for util-linux
by opensuse-security＠opensuse.org 02 Mar '17

02 Mar '17

openSUSE Security Update: Security update for util-linux ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0589-1 Rating: important References: #1008965 #1012504 #1012632 #1019332 #1020077 #1020985 #1023041 Cross-References: CVE-2017-2616 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for util-linux fixes the following issues: This security issue was fixed: - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges (bsc#1023041). This non-security issues were fixed: - lscpu: Implement WSL detection and work around crash (bsc#1019332) - fstrim: De-duplicate btrfs sub-volumes for "fstrim -a" and bind mounts (bsc#1020077) - Fix regressions in safe loop re-use patch set for libmount (bsc#1012504) - Disable ro checks for mtab (bsc#1012632) - Ensure that the option "users,exec,dev,suid" work as expected on NFS mounts (bsc#1008965) - Fix empty slave detection to prevent 100% CPU load in some cases (bsc#1020985) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-306=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libblkid-devel-2.28-10.1 libblkid-devel-static-2.28-10.1 libblkid1-2.28-10.1 libblkid1-debuginfo-2.28-10.1 libfdisk-devel-2.28-10.1 libfdisk-devel-static-2.28-10.1 libfdisk1-2.28-10.1 libfdisk1-debuginfo-2.28-10.1 libmount-devel-2.28-10.1 libmount-devel-static-2.28-10.1 libmount1-2.28-10.1 libmount1-debuginfo-2.28-10.1 libsmartcols-devel-2.28-10.1 libsmartcols-devel-static-2.28-10.1 libsmartcols1-2.28-10.1 libsmartcols1-debuginfo-2.28-10.1 libuuid-devel-2.28-10.1 libuuid-devel-static-2.28-10.1 libuuid1-2.28-10.1 libuuid1-debuginfo-2.28-10.1 python-libmount-2.28-10.2 python-libmount-debuginfo-2.28-10.2 python-libmount-debugsource-2.28-10.2 util-linux-2.28-10.1 util-linux-debuginfo-2.28-10.1 util-linux-debugsource-2.28-10.1 util-linux-systemd-2.28-10.1 util-linux-systemd-debuginfo-2.28-10.1 util-linux-systemd-debugsource-2.28-10.1 uuidd-2.28-10.1 uuidd-debuginfo-2.28-10.1 - openSUSE Leap 42.2 (x86_64): libblkid-devel-32bit-2.28-10.1 libblkid1-32bit-2.28-10.1 libblkid1-debuginfo-32bit-2.28-10.1 libmount-devel-32bit-2.28-10.1 libmount1-32bit-2.28-10.1 libmount1-debuginfo-32bit-2.28-10.1 libuuid-devel-32bit-2.28-10.1 libuuid1-32bit-2.28-10.1 libuuid1-debuginfo-32bit-2.28-10.1 - openSUSE Leap 42.2 (noarch): util-linux-lang-2.28-10.1 References: https://www.suse.com/security/cve/CVE-2017-2616.html https://bugzilla.suse.com/1008965 https://bugzilla.suse.com/1012504 https://bugzilla.suse.com/1012632 https://bugzilla.suse.com/1019332 https://bugzilla.suse.com/1020077 https://bugzilla.suse.com/1020985 https://bugzilla.suse.com/1023041

1 0

openSUSE-SU-2017:0588-1: important: Security update for php7
by opensuse-security＠opensuse.org 02 Mar '17

02 Mar '17

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0588-1 Rating: important References: #1008026 #1019547 #1019550 #1019568 #1019570 #1022219 #1022255 #1022257 #1022260 #1022262 #1022263 #1022264 #1022265 Cross-References: CVE-2016-10158 CVE-2016-10159 CVE-2016-10160 CVE-2016-10161 CVE-2016-10162 CVE-2016-10166 CVE-2016-10167 CVE-2016-10168 CVE-2016-7478 CVE-2016-7479 CVE-2016-7480 CVE-2016-9138 CVE-2017-5340 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for php7 fixes the following security issues: - CVE-2016-7480: The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP did not verify that a key is an object, which allowed remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data. (bsc#1019568) - CVE-2017-5340: Zend/zend_hash.c in PHP mishandled certain cases that require large array allocations, which allowed remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data. (bsc#1019570) - CVE-2016-7479: In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may have lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution. (bsc#1019547) - CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876. (bsc#1019550) - CVE-2016-10159: Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP allowed remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive. (bsc#1022255) - CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP allowed remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch. (bsc#1022257) - CVE-2016-10161: The object_common1 function in ext/standard/var_unserializer.c in PHP allowed remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call. (bsc#1022260) - CVE-2016-10162: The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7 allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call. (bsc#1022262) - CVE-2016-10166: A potential unsigned underflow in gd interpolation functions could lead to memory corruption in the PHP gd module (bsc#1022263) - CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx() could lead to php out of memory even on small files. (bsc#1022264) - CVE-2016-10168: A signed integer overflow in the gd module could lead to memory corruption (bsc#1022265) - CVE-2016-9138: PHP mishandled property modification during __wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::__toString with DateInterval::__wakeup. (bsc#1008026) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-304=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_php7-7.0.7-12.1 apache2-mod_php7-debuginfo-7.0.7-12.1 php7-7.0.7-12.1 php7-bcmath-7.0.7-12.1 php7-bcmath-debuginfo-7.0.7-12.1 php7-bz2-7.0.7-12.1 php7-bz2-debuginfo-7.0.7-12.1 php7-calendar-7.0.7-12.1 php7-calendar-debuginfo-7.0.7-12.1 php7-ctype-7.0.7-12.1 php7-ctype-debuginfo-7.0.7-12.1 php7-curl-7.0.7-12.1 php7-curl-debuginfo-7.0.7-12.1 php7-dba-7.0.7-12.1 php7-dba-debuginfo-7.0.7-12.1 php7-debuginfo-7.0.7-12.1 php7-debugsource-7.0.7-12.1 php7-devel-7.0.7-12.1 php7-dom-7.0.7-12.1 php7-dom-debuginfo-7.0.7-12.1 php7-enchant-7.0.7-12.1 php7-enchant-debuginfo-7.0.7-12.1 php7-exif-7.0.7-12.1 php7-exif-debuginfo-7.0.7-12.1 php7-fastcgi-7.0.7-12.1 php7-fastcgi-debuginfo-7.0.7-12.1 php7-fileinfo-7.0.7-12.1 php7-fileinfo-debuginfo-7.0.7-12.1 php7-firebird-7.0.7-12.1 php7-firebird-debuginfo-7.0.7-12.1 php7-fpm-7.0.7-12.1 php7-fpm-debuginfo-7.0.7-12.1 php7-ftp-7.0.7-12.1 php7-ftp-debuginfo-7.0.7-12.1 php7-gd-7.0.7-12.1 php7-gd-debuginfo-7.0.7-12.1 php7-gettext-7.0.7-12.1 php7-gettext-debuginfo-7.0.7-12.1 php7-gmp-7.0.7-12.1 php7-gmp-debuginfo-7.0.7-12.1 php7-iconv-7.0.7-12.1 php7-iconv-debuginfo-7.0.7-12.1 php7-imap-7.0.7-12.1 php7-imap-debuginfo-7.0.7-12.1 php7-intl-7.0.7-12.1 php7-intl-debuginfo-7.0.7-12.1 php7-json-7.0.7-12.1 php7-json-debuginfo-7.0.7-12.1 php7-ldap-7.0.7-12.1 php7-ldap-debuginfo-7.0.7-12.1 php7-mbstring-7.0.7-12.1 php7-mbstring-debuginfo-7.0.7-12.1 php7-mcrypt-7.0.7-12.1 php7-mcrypt-debuginfo-7.0.7-12.1 php7-mysql-7.0.7-12.1 php7-mysql-debuginfo-7.0.7-12.1 php7-odbc-7.0.7-12.1 php7-odbc-debuginfo-7.0.7-12.1 php7-opcache-7.0.7-12.1 php7-opcache-debuginfo-7.0.7-12.1 php7-openssl-7.0.7-12.1 php7-openssl-debuginfo-7.0.7-12.1 php7-pcntl-7.0.7-12.1 php7-pcntl-debuginfo-7.0.7-12.1 php7-pdo-7.0.7-12.1 php7-pdo-debuginfo-7.0.7-12.1 php7-pgsql-7.0.7-12.1 php7-pgsql-debuginfo-7.0.7-12.1 php7-phar-7.0.7-12.1 php7-phar-debuginfo-7.0.7-12.1 php7-posix-7.0.7-12.1 php7-posix-debuginfo-7.0.7-12.1 php7-pspell-7.0.7-12.1 php7-pspell-debuginfo-7.0.7-12.1 php7-readline-7.0.7-12.1 php7-readline-debuginfo-7.0.7-12.1 php7-shmop-7.0.7-12.1 php7-shmop-debuginfo-7.0.7-12.1 php7-snmp-7.0.7-12.1 php7-snmp-debuginfo-7.0.7-12.1 php7-soap-7.0.7-12.1 php7-soap-debuginfo-7.0.7-12.1 php7-sockets-7.0.7-12.1 php7-sockets-debuginfo-7.0.7-12.1 php7-sqlite-7.0.7-12.1 php7-sqlite-debuginfo-7.0.7-12.1 php7-sysvmsg-7.0.7-12.1 php7-sysvmsg-debuginfo-7.0.7-12.1 php7-sysvsem-7.0.7-12.1 php7-sysvsem-debuginfo-7.0.7-12.1 php7-sysvshm-7.0.7-12.1 php7-sysvshm-debuginfo-7.0.7-12.1 php7-tidy-7.0.7-12.1 php7-tidy-debuginfo-7.0.7-12.1 php7-tokenizer-7.0.7-12.1 php7-tokenizer-debuginfo-7.0.7-12.1 php7-wddx-7.0.7-12.1 php7-wddx-debuginfo-7.0.7-12.1 php7-xmlreader-7.0.7-12.1 php7-xmlreader-debuginfo-7.0.7-12.1 php7-xmlrpc-7.0.7-12.1 php7-xmlrpc-debuginfo-7.0.7-12.1 php7-xmlwriter-7.0.7-12.1 php7-xmlwriter-debuginfo-7.0.7-12.1 php7-xsl-7.0.7-12.1 php7-xsl-debuginfo-7.0.7-12.1 php7-zip-7.0.7-12.1 php7-zip-debuginfo-7.0.7-12.1 php7-zlib-7.0.7-12.1 php7-zlib-debuginfo-7.0.7-12.1 - openSUSE Leap 42.2 (noarch): php7-pear-7.0.7-12.1 php7-pear-Archive_Tar-7.0.7-12.1 References: https://www.suse.com/security/cve/CVE-2016-10158.html https://www.suse.com/security/cve/CVE-2016-10159.html https://www.suse.com/security/cve/CVE-2016-10160.html https://www.suse.com/security/cve/CVE-2016-10161.html https://www.suse.com/security/cve/CVE-2016-10162.html https://www.suse.com/security/cve/CVE-2016-10166.html https://www.suse.com/security/cve/CVE-2016-10167.html https://www.suse.com/security/cve/CVE-2016-10168.html https://www.suse.com/security/cve/CVE-2016-7478.html https://www.suse.com/security/cve/CVE-2016-7479.html https://www.suse.com/security/cve/CVE-2016-7480.html https://www.suse.com/security/cve/CVE-2016-9138.html https://www.suse.com/security/cve/CVE-2017-5340.html https://bugzilla.suse.com/1008026 https://bugzilla.suse.com/1019547 https://bugzilla.suse.com/1019550 https://bugzilla.suse.com/1019568 https://bugzilla.suse.com/1019570 https://bugzilla.suse.com/1022219 https://bugzilla.suse.com/1022255 https://bugzilla.suse.com/1022257 https://bugzilla.suse.com/1022260 https://bugzilla.suse.com/1022262 https://bugzilla.suse.com/1022263 https://bugzilla.suse.com/1022264 https://bugzilla.suse.com/1022265

1 0

openSUSE-SU-2017:0587-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 02 Mar '17

02 Mar '17

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0587-1 Rating: moderate References: #1017308 #1017310 #1017311 #1017312 #1017313 #1017314 #1017318 #1017319 #1017320 #1017321 #1017322 #1017324 #1017325 #1017326 #1017421 #1020433 #1020435 #1020436 #1020439 #1020441 #1020443 #1020446 #1020448 Cross-References: CVE-2016-10046 CVE-2016-10048 CVE-2016-10049 CVE-2016-10050 CVE-2016-10051 CVE-2016-10052 CVE-2016-10059 CVE-2016-10060 CVE-2016-10061 CVE-2016-10062 CVE-2016-10063 CVE-2016-10064 CVE-2016-10065 CVE-2016-10068 CVE-2016-10069 CVE-2016-10070 CVE-2016-10071 CVE-2016-10144 CVE-2016-10145 CVE-2016-10146 CVE-2017-5506 CVE-2017-5507 CVE-2017-5508 CVE-2017-5510 CVE-2017-5511 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2016-10046: Prevent buffer overflow in draw.c caused by an incorrect length calculation (bsc#1017308) - CVE-2016-10048: Arbitrary module could have been load because relative path were not escaped (bsc#1017310) - CVE-2016-10049: Corrupt RLE files could have overflowed a buffer due to a incorrect length calculation (bsc#1017311) - CVE-2016-10050: Corrupt RLE files could have overflowed a heap buffer due to a missing offset check (bsc#1017312) - CVE-2016-10051: Fixed use after free when reading PWP files (bsc#1017313) - CVE-2016-10052: Added bound check to exif parsing of JPEG files (bsc#1017314) - CVE-2016-10059: Unchecked calculation when reading TIFF files could have lead to a buffer overflow (bsc#1017318) - CVE-2016-10060: Improved error handling when writing files to not mask errors (bsc#1017319) - CVE-2016-10061: Improved error handling when writing files to not mask errors (bsc#1017319). - CVE-2016-10062: Improved error handling when writing files to not mask errors (bsc#1017319). - CVE-2016-10063: Check validity of extend during TIFF file reading (bsc#1017320) - CVE-2016-10064: Improved checks for buffer overflow when reading TIFF files (bsc#1017321) - CVE-2016-10065: Unchecked calculations when reading VIFF files could have lead to out of bound reads (bsc#1017322) - CVE-2016-10068: Prevent NULL pointer access when using the MSL interpreter (bsc#1017324) - CVE-2016-10069: Add check for invalid mat file (bsc#1017325). - CVE-2016-10070: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326) - CVE-2016-10071: Prevent allocating the wrong amount of memory when reading mat files (bsc#1017326) - CVE-2016-10144: Added a check after allocating memory when parsing IPL files (bsc#1020433) - CVE-2016-10145: Fixed of-by-one in string copy operation when parsing WPG files (bsc#1020435) - CVE-2016-10146: Captions and labels were handled incorrectly, causing a memory leak that could have lead to DoS (bsc#1020443) - CVE-2017-5506: Missing offset check leading to a double-free (bsc#1020436) - CVE-2017-5507: Fixed a memory leak when reading MPC files allowing for DoS (bsc#1020439) - CVE-2017-5508: Increase the amount of memory allocated for TIFF pixels to prevent a heap buffer-overflow (bsc#1020441) - CVE-2017-5510: Prevent out-of-bounds write when reading PSD files (bsc#1020446). - CVE-2017-5511: A missing cast when reading PSD files could have caused memory corruption by a heap overflow (bsc#1020448) This update removes the fix for CVE-2016-9773. ImageMagick-6 was not affected by CVE-2016-9773 and it caused a regression (at least in GraphicsMagick) (bsc#1017421). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-303=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-303=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ImageMagick-6.8.8.1-28.1 ImageMagick-debuginfo-6.8.8.1-28.1 ImageMagick-debugsource-6.8.8.1-28.1 ImageMagick-devel-6.8.8.1-28.1 ImageMagick-extra-6.8.8.1-28.1 ImageMagick-extra-debuginfo-6.8.8.1-28.1 libMagick++-6_Q16-3-6.8.8.1-28.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-28.1 libMagick++-devel-6.8.8.1-28.1 libMagickCore-6_Q16-1-6.8.8.1-28.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-28.1 libMagickWand-6_Q16-1-6.8.8.1-28.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-28.1 perl-PerlMagick-6.8.8.1-28.1 perl-PerlMagick-debuginfo-6.8.8.1-28.1 - openSUSE Leap 42.2 (x86_64): ImageMagick-devel-32bit-6.8.8.1-28.1 libMagick++-6_Q16-3-32bit-6.8.8.1-28.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-28.1 libMagick++-devel-32bit-6.8.8.1-28.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-28.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-28.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-28.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-28.1 - openSUSE Leap 42.2 (noarch): ImageMagick-doc-6.8.8.1-28.1 - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-30.1 ImageMagick-debuginfo-6.8.8.1-30.1 ImageMagick-debugsource-6.8.8.1-30.1 ImageMagick-devel-6.8.8.1-30.1 ImageMagick-extra-6.8.8.1-30.1 ImageMagick-extra-debuginfo-6.8.8.1-30.1 libMagick++-6_Q16-3-6.8.8.1-30.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-30.1 libMagick++-devel-6.8.8.1-30.1 libMagickCore-6_Q16-1-6.8.8.1-30.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-30.1 libMagickWand-6_Q16-1-6.8.8.1-30.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-30.1 perl-PerlMagick-6.8.8.1-30.1 perl-PerlMagick-debuginfo-6.8.8.1-30.1 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-30.1 libMagick++-6_Q16-3-32bit-6.8.8.1-30.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-30.1 libMagick++-devel-32bit-6.8.8.1-30.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-30.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-30.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-30.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-30.1 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-30.1 References: https://www.suse.com/security/cve/CVE-2016-10046.html https://www.suse.com/security/cve/CVE-2016-10048.html https://www.suse.com/security/cve/CVE-2016-10049.html https://www.suse.com/security/cve/CVE-2016-10050.html https://www.suse.com/security/cve/CVE-2016-10051.html https://www.suse.com/security/cve/CVE-2016-10052.html https://www.suse.com/security/cve/CVE-2016-10059.html https://www.suse.com/security/cve/CVE-2016-10060.html https://www.suse.com/security/cve/CVE-2016-10061.html https://www.suse.com/security/cve/CVE-2016-10062.html https://www.suse.com/security/cve/CVE-2016-10063.html https://www.suse.com/security/cve/CVE-2016-10064.html https://www.suse.com/security/cve/CVE-2016-10065.html https://www.suse.com/security/cve/CVE-2016-10068.html https://www.suse.com/security/cve/CVE-2016-10069.html https://www.suse.com/security/cve/CVE-2016-10070.html https://www.suse.com/security/cve/CVE-2016-10071.html https://www.suse.com/security/cve/CVE-2016-10144.html https://www.suse.com/security/cve/CVE-2016-10145.html https://www.suse.com/security/cve/CVE-2016-10146.html https://www.suse.com/security/cve/CVE-2017-5506.html https://www.suse.com/security/cve/CVE-2017-5507.html https://www.suse.com/security/cve/CVE-2017-5508.html https://www.suse.com/security/cve/CVE-2017-5510.html https://www.suse.com/security/cve/CVE-2017-5511.html https://bugzilla.suse.com/1017308 https://bugzilla.suse.com/1017310 https://bugzilla.suse.com/1017311 https://bugzilla.suse.com/1017312 https://bugzilla.suse.com/1017313 https://bugzilla.suse.com/1017314 https://bugzilla.suse.com/1017318 https://bugzilla.suse.com/1017319 https://bugzilla.suse.com/1017320 https://bugzilla.suse.com/1017321 https://bugzilla.suse.com/1017322 https://bugzilla.suse.com/1017324 https://bugzilla.suse.com/1017325 https://bugzilla.suse.com/1017326 https://bugzilla.suse.com/1017421 https://bugzilla.suse.com/1020433 https://bugzilla.suse.com/1020435 https://bugzilla.suse.com/1020436 https://bugzilla.suse.com/1020439 https://bugzilla.suse.com/1020441 https://bugzilla.suse.com/1020443 https://bugzilla.suse.com/1020446 https://bugzilla.suse.com/1020448

1 0