March 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:0903-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 31 Mar '17

31 Mar '17

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0903-1 Rating: moderate References: #1016712 #1016714 #1016715 #980663 Cross-References: CVE-2016-0736 CVE-2016-2161 CVE-2016-8743 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for apache2 provides the following fixes: Security issues fixed: - CVE-2016-0736: Protect mod_session_crypto data with a MAC to prevent padding oracle attacks (bsc#1016712). - CVE-2016-2161: Malicious input to mod_auth_digest could have caused the server to crash, resulting in DoS (bsc#1016714). - CVE-2016-8743: Added new directive "HttpProtocolOptions Strict" to avoid proxy chain misinterpretation (bsc#1016715). Bugfixes: - Add NotifyAccess=all to systemd service files to prevent warnings in the log when using mod_systemd (bsc#980663). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-417=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): apache2-2.4.16-18.1 apache2-debuginfo-2.4.16-18.1 apache2-debugsource-2.4.16-18.1 apache2-devel-2.4.16-18.1 apache2-event-2.4.16-18.1 apache2-event-debuginfo-2.4.16-18.1 apache2-example-pages-2.4.16-18.1 apache2-prefork-2.4.16-18.1 apache2-prefork-debuginfo-2.4.16-18.1 apache2-utils-2.4.16-18.1 apache2-utils-debuginfo-2.4.16-18.1 apache2-worker-2.4.16-18.1 apache2-worker-debuginfo-2.4.16-18.1 - openSUSE Leap 42.1 (noarch): apache2-doc-2.4.16-18.1 References: https://www.suse.com/security/cve/CVE-2016-0736.html https://www.suse.com/security/cve/CVE-2016-2161.html https://www.suse.com/security/cve/CVE-2016-8743.html https://bugzilla.suse.com/1016712 https://bugzilla.suse.com/1016714 https://bugzilla.suse.com/1016715 https://bugzilla.suse.com/980663

1 0

openSUSE-SU-2017:0902-1: moderate: Security update for virglrenderer
by opensuse-security＠opensuse.org 31 Mar '17

31 Mar '17

openSUSE Security Update: Security update for virglrenderer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0902-1 Rating: moderate References: #1021616 #1021627 #1024232 #1024244 #1024992 #1024993 #1025505 #1025507 #1026723 #1026725 #1026922 #1027108 #1027376 Cross-References: CVE-2016-10163 CVE-2016-10214 CVE-2017-5580 CVE-2017-5937 CVE-2017-5956 CVE-2017-5957 CVE-2017-5993 CVE-2017-5994 CVE-2017-6209 CVE-2017-6210 CVE-2017-6317 CVE-2017-6355 CVE-2017-6386 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for virglrenderer fixes the following issues: Security issues fixed: - CVE-2017-6386: memory leakage while in vrend_create_vertex_elements_state (bsc#1027376) - CVE-2017-6355: integer overflow while creating shader object (bsc#1027108) - CVE-2017-6317: fix memory leak in add shader program (bsc#1026922) - CVE-2017-6210: null pointer dereference in vrend_decode_reset (bsc#1026725) - CVE-2017-6209: stack buffer oveflow in parse_identifier (bsc#1026723) - CVE-2017-5994: out-of-bounds access in vrend_create_vertex_elements_state (bsc#1025507) - CVE-2017-5993: host memory leakage when initialising blitter context (bsc#1025505) - CVE-2017-5957: stack overflow in vrend_decode_set_framebuffer_state (bsc#1024993) - CVE-2017-5956: OOB access while in vrend_draw_vbo (bsc#1024992) - CVE-2017-5937: null pointer dereference in vrend_clear (bsc#1024232) - CVE-2017-5580: OOB access while parsing texture instruction (bsc#1021627) - CVE-2016-10214: host memory leak issue in virgl_resource_attach_backing (bsc#1024244) - CVE-2016-10163: host memory leakage when creating decode context (bsc#1021616) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-415=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libvirglrenderer0-0.5.0-3.3.1 libvirglrenderer0-debuginfo-0.5.0-3.3.1 virglrenderer-debugsource-0.5.0-3.3.1 virglrenderer-devel-0.5.0-3.3.1 virglrenderer-test-server-0.5.0-3.3.1 virglrenderer-test-server-debuginfo-0.5.0-3.3.1 References: https://www.suse.com/security/cve/CVE-2016-10163.html https://www.suse.com/security/cve/CVE-2016-10214.html https://www.suse.com/security/cve/CVE-2017-5580.html https://www.suse.com/security/cve/CVE-2017-5937.html https://www.suse.com/security/cve/CVE-2017-5956.html https://www.suse.com/security/cve/CVE-2017-5957.html https://www.suse.com/security/cve/CVE-2017-5993.html https://www.suse.com/security/cve/CVE-2017-5994.html https://www.suse.com/security/cve/CVE-2017-6209.html https://www.suse.com/security/cve/CVE-2017-6210.html https://www.suse.com/security/cve/CVE-2017-6317.html https://www.suse.com/security/cve/CVE-2017-6355.html https://www.suse.com/security/cve/CVE-2017-6386.html https://bugzilla.suse.com/1021616 https://bugzilla.suse.com/1021627 https://bugzilla.suse.com/1024232 https://bugzilla.suse.com/1024244 https://bugzilla.suse.com/1024992 https://bugzilla.suse.com/1024993 https://bugzilla.suse.com/1025505 https://bugzilla.suse.com/1025507 https://bugzilla.suse.com/1026723 https://bugzilla.suse.com/1026725 https://bugzilla.suse.com/1026922 https://bugzilla.suse.com/1027108 https://bugzilla.suse.com/1027376

1 0

openSUSE-RU-2017:0900-1: moderate: Recommended update for plasma5-SLE, sddm
by maintenance＠opensuse.org 31 Mar '17

31 Mar '17

openSUSE Recommended Update: Recommended update for plasma5-SLE, sddm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0900-1 Rating: moderate References: #1025387 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-SLE, sddm fixes the following issues: - dependency issue with sddm branding (bsc#1025387) The following cosmetic change was included: - Make the sddm theme (breeze-SLE) more similar to the gdm SLE branding Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-414=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): sddm-0.13.0-5.1 sddm-branding-SLE-0.13.0-5.1 sddm-branding-upstream-0.13.0-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): plasma5-SLE-42.1.1-8.1 plasma5-defaults-SLE-42.1.1-8.1 plasma5-theme-SLE-42.1.1-8.1 plasma5-workspace-branding-SLE-42.1.1-8.1 sddm-theme-SLE-42.1.1-8.1 References: https://bugzilla.suse.com/1025387

1 0

openSUSE-SU-2017:0897-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 31 Mar '17

31 Mar '17

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0897-1 Rating: moderate References: #1016712 #1016714 #1016715 #1019380 Cross-References: CVE-2016-0736 CVE-2016-2161 CVE-2016-8743 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for apache2 fixes the following security issues: Security issues fixed: - CVE-2016-0736: Protect mod_session_crypto data with a MAC to prevent padding oracle attacks (bsc#1016712). - CVE-2016-2161: Malicious input to mod_auth_digest could have caused the server to crash, resulting in DoS (bsc#1016714). - CVE-2016-8743: Added new directive "HttpProtocolOptions Strict" to avoid proxy chain misinterpretation (bsc#1016715). Bugfixes: - Add missing copy of hcuri and hcexpr from the worker to the health check worker (bsc#1019380). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-416=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-2.4.23-8.3.1 apache2-debuginfo-2.4.23-8.3.1 apache2-debugsource-2.4.23-8.3.1 apache2-devel-2.4.23-8.3.1 apache2-event-2.4.23-8.3.1 apache2-event-debuginfo-2.4.23-8.3.1 apache2-example-pages-2.4.23-8.3.1 apache2-prefork-2.4.23-8.3.1 apache2-prefork-debuginfo-2.4.23-8.3.1 apache2-utils-2.4.23-8.3.1 apache2-utils-debuginfo-2.4.23-8.3.1 apache2-worker-2.4.23-8.3.1 apache2-worker-debuginfo-2.4.23-8.3.1 - openSUSE Leap 42.2 (noarch): apache2-doc-2.4.23-8.3.1 References: https://www.suse.com/security/cve/CVE-2016-0736.html https://www.suse.com/security/cve/CVE-2016-2161.html https://www.suse.com/security/cve/CVE-2016-8743.html https://bugzilla.suse.com/1016712 https://bugzilla.suse.com/1016714 https://bugzilla.suse.com/1016715 https://bugzilla.suse.com/1019380

1 0

openSUSE-SU-2017:0894-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 30 Mar '17

30 Mar '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0894-1 Rating: moderate References: #1027255 Cross-References: CVE-2017-6335 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2017-6335: Fixed heap out of bounds write issue (boo#1027255). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-411=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.3.1 GraphicsMagick-debuginfo-1.3.25-11.3.1 GraphicsMagick-debugsource-1.3.25-11.3.1 GraphicsMagick-devel-1.3.25-11.3.1 libGraphicsMagick++-Q16-12-1.3.25-11.3.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.3.1 libGraphicsMagick++-devel-1.3.25-11.3.1 libGraphicsMagick-Q16-3-1.3.25-11.3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.3.1 libGraphicsMagick3-config-1.3.25-11.3.1 libGraphicsMagickWand-Q16-2-1.3.25-11.3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.3.1 perl-GraphicsMagick-1.3.25-11.3.1 perl-GraphicsMagick-debuginfo-1.3.25-11.3.1 References: https://www.suse.com/security/cve/CVE-2017-6335.html https://bugzilla.suse.com/1027255

1 0

openSUSE-SU-2017:0892-1: moderate: Security update for pidgin
by opensuse-security＠opensuse.org 30 Mar '17

30 Mar '17

openSUSE Security Update: Security update for pidgin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0892-1 Rating: moderate References: #1009974 #1028835 Cross-References: CVE-2017-2640 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for pidgin fixes the following issues: Feature update: - Update to GNOME 3.20.2 (fate#318572). Security issues fixed: - CVE-2017-2640: Fix an out of bounds memory read in purple_markup_unescape_entity. (boo#1028835) Bugfixes - Correctly remove *.so files for plugins (fixes devel-file-in-non-devel-package). - Remove generation of a plugin list to package, simply add it all in %files with exclusions. - Fix SASL EXTERNAL fingerprint authentication (boo#1009974). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-410=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): finch-2.10.11-8.3.1 finch-debuginfo-2.10.11-8.3.1 finch-devel-2.10.11-8.3.1 libpurple-2.10.11-8.3.1 libpurple-debuginfo-2.10.11-8.3.1 libpurple-devel-2.10.11-8.3.1 libpurple-meanwhile-2.10.11-8.3.1 libpurple-meanwhile-debuginfo-2.10.11-8.3.1 libpurple-tcl-2.10.11-8.3.1 libpurple-tcl-debuginfo-2.10.11-8.3.1 pidgin-2.10.11-8.3.1 pidgin-debuginfo-2.10.11-8.3.1 pidgin-debugsource-2.10.11-8.3.1 pidgin-devel-2.10.11-8.3.1 - openSUSE Leap 42.2 (noarch): libpurple-branding-upstream-2.10.11-8.3.1 libpurple-lang-2.10.11-8.3.1 References: https://www.suse.com/security/cve/CVE-2017-2640.html https://bugzilla.suse.com/1009974 https://bugzilla.suse.com/1028835

1 0

openSUSE-SU-2017:0891-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 30 Mar '17

30 Mar '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0891-1 Rating: moderate References: #1027255 Cross-References: CVE-2017-6335 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: Security issue fixed: - CVE-2017-6335: Fixed heap out of bounds write issue (boo#1027255). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-413=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): GraphicsMagick-1.3.21-29.1 GraphicsMagick-debuginfo-1.3.21-29.1 GraphicsMagick-debugsource-1.3.21-29.1 GraphicsMagick-devel-1.3.21-29.1 libGraphicsMagick++-Q16-11-1.3.21-29.1 libGraphicsMagick++-Q16-11-debuginfo-1.3.21-29.1 libGraphicsMagick++-devel-1.3.21-29.1 libGraphicsMagick-Q16-3-1.3.21-29.1 libGraphicsMagick-Q16-3-debuginfo-1.3.21-29.1 libGraphicsMagick3-config-1.3.21-29.1 libGraphicsMagickWand-Q16-2-1.3.21-29.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.21-29.1 perl-GraphicsMagick-1.3.21-29.1 perl-GraphicsMagick-debuginfo-1.3.21-29.1 References: https://www.suse.com/security/cve/CVE-2017-6335.html https://bugzilla.suse.com/1027255

1 0

openSUSE-SU-2017:0890-1: moderate: Security update for wget
by opensuse-security＠opensuse.org 30 Mar '17

30 Mar '17

openSUSE Security Update: Security update for wget ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0890-1 Rating: moderate References: #1028301 Cross-References: CVE-2017-6508 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for wget fixes the following issues: Security issue fixed: - CVE-2017-6508: (url_parse): Reject control characters in host part of URL (bsc#1028301). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-412=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-412=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): wget-1.14-8.3.1 wget-debuginfo-1.14-8.3.1 wget-debugsource-1.14-8.3.1 - openSUSE Leap 42.1 (i586 x86_64): wget-1.14-11.1 wget-debuginfo-1.14-11.1 wget-debugsource-1.14-11.1 References: https://www.suse.com/security/cve/CVE-2017-6508.html https://bugzilla.suse.com/1028301

1 0

openSUSE-RU-2017:0857-1: Recommended update for aaa_base
by maintenance＠opensuse.org 29 Mar '17

29 Mar '17

openSUSE Recommended Update: Recommended update for aaa_base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0857-1 Rating: low References: #1022105 #1025673 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for aaa_base fixes the following issues: - Fix issue in lang.csh's /etc/sysconfig/language parser that could result in incorrect locale settings for csh users. (bsc#1025673) - Fix spurious assignment to unknown variable TERM from /etc/inputrc. (bsc#1022105) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-407=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): aaa_base-13.2+git20140911.61c1681-24.3.1 aaa_base-debuginfo-13.2+git20140911.61c1681-24.3.1 aaa_base-debugsource-13.2+git20140911.61c1681-24.3.1 aaa_base-extras-13.2+git20140911.61c1681-24.3.1 aaa_base-malloccheck-13.2+git20140911.61c1681-24.3.1 References: https://bugzilla.suse.com/1022105 https://bugzilla.suse.com/1025673

1 0

openSUSE-RU-2017:0856-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 29 Mar '17

29 Mar '17

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0856-1 Rating: moderate References: #1021803 #1025985 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for xorg-x11-server fixes the following issues: - X server crash on drawing dashed lines (boo#1025985). - Wrong line endings would be drawn (boo#1021803). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-409=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-409=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xorg-x11-server-7.6_1.18.3-12.9.1 xorg-x11-server-debuginfo-7.6_1.18.3-12.9.1 xorg-x11-server-debugsource-7.6_1.18.3-12.9.1 xorg-x11-server-extra-7.6_1.18.3-12.9.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-12.9.1 xorg-x11-server-sdk-7.6_1.18.3-12.9.1 xorg-x11-server-source-7.6_1.18.3-12.9.1 - openSUSE Leap 42.1 (i586 x86_64): xorg-x11-server-7.6_1.17.2-27.1 xorg-x11-server-debuginfo-7.6_1.17.2-27.1 xorg-x11-server-debugsource-7.6_1.17.2-27.1 xorg-x11-server-extra-7.6_1.17.2-27.1 xorg-x11-server-extra-debuginfo-7.6_1.17.2-27.1 xorg-x11-server-sdk-7.6_1.17.2-27.1 xorg-x11-server-source-7.6_1.17.2-27.1 References: https://bugzilla.suse.com/1021803 https://bugzilla.suse.com/1025985

1 0