March 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:0671-1: moderate: Recommended update for tor
by maintenance＠opensuse.org 13 Mar '17

13 Mar '17

openSUSE Recommended Update: Recommended update for tor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0671-1 Rating: moderate References: #1027594 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Tor was updated to the long-term supported release series 0.2.9.x. The update contains a number of privacy and performance improvements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-338=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-338=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): tor-0.2.9.10-6.1 tor-debuginfo-0.2.9.10-6.1 tor-debugsource-0.2.9.10-6.1 - openSUSE Leap 42.1 (i586 x86_64): tor-0.2.9.10-19.1 tor-debuginfo-0.2.9.10-19.1 tor-debugsource-0.2.9.10-19.1 References: https://bugzilla.suse.com/1027594

1 0

openSUSE-RU-2017:0670-1: moderate: Recommended update for haproxy
by maintenance＠opensuse.org 13 Mar '17

13 Mar '17

openSUSE Recommended Update: Recommended update for haproxy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0670-1 Rating: moderate References: #1023141 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides haproxy 1.6.11, which brings several fixes and enhancements: - systemd-wrapper: Return correct exit codes. - srv-state: Properly restore the DRAIN state. - srv-state: Allow to have both CMAINT and FDRAIN flags. - servers: Properly propagate the maintenance states during startup. - vars: Fix 'set-var' converter because of a typo. - channel: Fix bad unlikely macro. - doc/ssl: Use correct wording for ca-sign-pass. - stick-table: Handle out-of-memory condition gracefully. - connection: Check the control layer before stopping polling. - stick-table: Fix regression caused by recent fix for out-of-memory. - cli: Properly decrement ref count on tables during failed dumps. - lua: In some case, the return of sample-fetches is ignored. - cli: Fix pointer size when reporting data/transport layer name. - cli: Dequeue from the proxy when changing a maxconn. - cli: Wake up the CLI's task after a timeout update. - freq-ctr: Make swrate_add() support larger values. - proxy: Return "none" and "unknown" for unknown LB algos. - stream: Fix session abort on resource shortage. - http: Don't send an extra CRLF after a Set-Cookie in a redirect. - variables: Some variable name can hide another ones. - cli: Be sure to always warn the cli applet when input buffer is full. - applet: Count number of (active) applets. - task: Rename run_queue and run_queue_cur counters. - stream: Save unprocessed events for a stream. - Fix how the list of entities waiting for a buffer is handled. - stream-int: Automatically release SI_FL_WAIT_DATA on SHUTW_NOW. - doc/lua: Section declared twice. - doc: Fix small typo in fe_id (backend instead of frontend). - lua: Fix memory leak executing tasks. - ssl: Properly reset the reused_sess during a forced handshake. - ssl: Avoid double free when releasing bind_confs. - backend: nbsrv() should return 0 if backend is disabled. - ssl: For a handshake when server-side SNI changes. - systemd: Prevent potential zombie processes. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-337=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): haproxy-1.6.11-6.1 haproxy-debuginfo-1.6.11-6.1 haproxy-debugsource-1.6.11-6.1 References: https://bugzilla.suse.com/1023141

1 0

openSUSE-SU-2017:0669-1: moderate: Security update for bitlbee
by opensuse-security＠opensuse.org 11 Mar '17

11 Mar '17

openSUSE Security Update: Security update for bitlbee ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0669-1 Rating: moderate References: #1022498 Cross-References: CVE-2016-10189 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bitlbee fixes the following security issues: - A file transfer request from a contact not in the contact list could have resulted in a null pointer dereference, causing remote DoS by malicious remote clients (CVE-2016-10189, bnc#1022498). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-328=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-328=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): bitlbee-3.4.2-3.1 bitlbee-debuginfo-3.4.2-3.1 bitlbee-devel-3.4.2-3.1 bitlbee-doc-3.4.2-3.1 - openSUSE Leap 42.1 (i586 x86_64): bitlbee-3.4.1-5.1 bitlbee-debuginfo-3.4.1-5.1 bitlbee-debugsource-3.4.1-5.1 bitlbee-doc-3.4.1-5.1 References: https://www.suse.com/security/cve/CVE-2016-10189.html https://bugzilla.suse.com/1022498

1 0

openSUSE-SU-2017:0668-1: moderate: Security update for lynx
by opensuse-security＠opensuse.org 11 Mar '17

11 Mar '17

openSUSE Security Update: Security update for lynx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0668-1 Rating: moderate References: #1008642 Cross-References: CVE-2016-9179 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lynx fixes the following issues: - CVE-2016-9179: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. (bsc#1008642) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-330=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-330=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): lynx-2.8.7-6.1 lynx-debuginfo-2.8.7-6.1 lynx-debugsource-2.8.7-6.1 - openSUSE Leap 42.1 (i586 x86_64): lynx-2.8.7-5.1 lynx-debuginfo-2.8.7-5.1 lynx-debugsource-2.8.7-5.1 References: https://www.suse.com/security/cve/CVE-2016-9179.html https://bugzilla.suse.com/1008642

1 0

openSUSE-SU-2017:0667-1: moderate: Security update for perl-Image-Info
by opensuse-security＠opensuse.org 11 Mar '17

11 Mar '17

openSUSE Security Update: Security update for perl-Image-Info ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0667-1 Rating: moderate References: #1008647 Cross-References: CVE-2016-9181 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-Image-Info fixes the following issues: - update to version 1.39 to fix a potential security issue. A crafted SVG file could have caused information disclosure or denial of service by using external entitity expansion (XXE). This is a potentially incompatible change; however usually SVG files do not rely on XXE. (boo#1008647, CVE-2016-9181) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-327=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-327=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): perl-Image-Info-1.39-5.1 - openSUSE Leap 42.1 (noarch): perl-Image-Info-1.39-4.1 References: https://www.suse.com/security/cve/CVE-2016-9181.html https://bugzilla.suse.com/1008647

1 0

openSUSE-SU-2017:0665-1: important: Security update for xen
by opensuse-security＠opensuse.org 11 Mar '17

11 Mar '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0665-1 Rating: important References: #1000195 #1002496 #1005028 #1012651 #1014298 #1014300 #1015169 #1016340 #1022871 #1023004 #1024834 Cross-References: CVE-2016-9921 CVE-2016-9922 CVE-2017-2615 CVE-2017-2620 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 7 fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834). - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004). - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169 These non-security issues were fixed: - bsc#1000195: Prevent panic on CPU0 while booting on SLES 11 SP3 - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd - bsc#1005028: Fixed building Xen RPMs from Sources This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-329=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xen-debugsource-4.7.1_06-9.2 xen-devel-4.7.1_06-9.2 xen-libs-4.7.1_06-9.2 xen-libs-debuginfo-4.7.1_06-9.2 xen-tools-domU-4.7.1_06-9.2 xen-tools-domU-debuginfo-4.7.1_06-9.2 - openSUSE Leap 42.2 (x86_64): xen-4.7.1_06-9.2 xen-doc-html-4.7.1_06-9.2 xen-libs-32bit-4.7.1_06-9.2 xen-libs-debuginfo-32bit-4.7.1_06-9.2 xen-tools-4.7.1_06-9.2 xen-tools-debuginfo-4.7.1_06-9.2 References: https://www.suse.com/security/cve/CVE-2016-9921.html https://www.suse.com/security/cve/CVE-2016-9922.html https://www.suse.com/security/cve/CVE-2017-2615.html https://www.suse.com/security/cve/CVE-2017-2620.html https://bugzilla.suse.com/1000195 https://bugzilla.suse.com/1002496 https://bugzilla.suse.com/1005028 https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1014300 https://bugzilla.suse.com/1015169 https://bugzilla.suse.com/1016340 https://bugzilla.suse.com/1022871 https://bugzilla.suse.com/1023004 https://bugzilla.suse.com/1024834

1 0

openSUSE-SU-2017:0664-1: Security update for Wireshark
by opensuse-security＠opensuse.org 11 Mar '17

11 Mar '17

openSUSE Security Update: Security update for Wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0664-1 Rating: low References: #1027998 Cross-References: CVE-2017-6467 CVE-2017-6468 CVE-2017-6469 CVE-2017-6470 CVE-2017-6471 CVE-2017-6472 CVE-2017-6473 CVE-2017-6474 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for Wireshark fixes minor vulnerabilities that could be used to trigger a dissector crash or infinite loops by sending specially crafted packages over the network or into a capture file: - CVE-2017-6467: NetScaler file parser infinite loop (wnpa-sec-2017-11) - CVE-2017-6468: NetScaler file parser crash (wnpa-sec-2017-08) - CVE-2017-6469: LDSS dissector crash (wnpa-sec-2017-03) - CVE-2017-6470: IAX2 dissector infinite loop (wnpa-sec-2017-10) - CVE-2017-6471: WSP dissector infinite loop (wnpa-sec-2017-05) - CVE-2017-6472: RTMTP dissector infinite loop (wnpa-sec-2017-04) - CVE-2017-6473: K12 file parser crash (wnpa-sec-2017-09) - CVE-2017-6474: NetScaler file parser infinite loop (wnpa-sec-2017-07) - wnpa-sec-2017-06: STANAG 4607 file parser infinite loop Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-326=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): wireshark-2.2.5-12.1 wireshark-debuginfo-2.2.5-12.1 wireshark-debugsource-2.2.5-12.1 wireshark-devel-2.2.5-12.1 wireshark-ui-gtk-2.2.5-12.1 wireshark-ui-gtk-debuginfo-2.2.5-12.1 wireshark-ui-qt-2.2.5-12.1 wireshark-ui-qt-debuginfo-2.2.5-12.1 References: https://www.suse.com/security/cve/CVE-2017-6467.html https://www.suse.com/security/cve/CVE-2017-6468.html https://www.suse.com/security/cve/CVE-2017-6469.html https://www.suse.com/security/cve/CVE-2017-6470.html https://www.suse.com/security/cve/CVE-2017-6471.html https://www.suse.com/security/cve/CVE-2017-6472.html https://www.suse.com/security/cve/CVE-2017-6473.html https://www.suse.com/security/cve/CVE-2017-6474.html https://bugzilla.suse.com/1027998

1 0

openSUSE-SU-2017:0663-1: Security update for cacti
by opensuse-security＠opensuse.org 11 Mar '17

11 Mar '17

openSUSE Security Update: Security update for cacti ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0663-1 Rating: low References: #1022564 Cross-References: CVE-2014-4000 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti fixes the following vulnerabilities: - CVE-2014-4000: PHP Object Injection Vulnerabilities (boo#1022564) It also updates cacti to version 1.0.4 to include the latest upstream bugfixes and improvements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-325=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-325=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): cacti-1.0.4-14.1 cacti-doc-1.0.4-14.1 - openSUSE Leap 42.1 (noarch): cacti-1.0.4-14.1 cacti-doc-1.0.4-14.1 References: https://www.suse.com/security/cve/CVE-2014-4000.html https://bugzilla.suse.com/1022564

1 0

openSUSE-RU-2017:0657-1: moderate: Recommended update for spectacle
by maintenance＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Recommended Update: Recommended update for spectacle ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0657-1 Rating: moderate References: #1026635 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spectacle fixes the following issues: - use the desktop's native file dialog for the Save As option instead of the generic Qt dialog (boo#1026635) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-324=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): spectacle-16.08.2-5.1 spectacle-doc-16.08.2-5.1 References: https://bugzilla.suse.com/1026635

1 0

openSUSE-RU-2017:0655-1: moderate: Recommended update for greybird-theme
by maintenance＠opensuse.org 10 Mar '17

10 Mar '17

openSUSE Recommended Update: Recommended update for greybird-theme ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0655-1 Rating: moderate References: #1004225 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for greybird-theme fixes the following issues: - greybird-theme not working with GTK3 3.20, update to 3.22.0 (boo#1004225) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-322=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): gtk2-metatheme-greybird-3.22.0-8.1 gtk3-metatheme-greybird-3.22.0-8.1 metatheme-greybird-common-3.22.0-8.1 References: https://bugzilla.suse.com/1004225

1 0