March 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2017:0746-1: Initial update for python-configparser
by maintenance＠opensuse.org 20 Mar '17

20 Mar '17

openSUSE Optional Update: Initial update for python-configparser ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:0746-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds python-configparser to openSUSE Leap 42.2. The ConfigParser module backports functionality from Python 3.x to make it available for Python 2.7. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-365=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): python-configparser-3.5.0-2.1 References:

1 0

openSUSE-RU-2017:0745-1: Recommended update for calibre
by maintenance＠opensuse.org 20 Mar '17

20 Mar '17

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0745-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for calibre provides version 2.81.0 and fixes the following issues: - New Features + Amazon metadata download: Allow downloading amazon metadata from multiple sources. You can now configure the Amazon plugin via Preferences->Metadata download to use either the amazon servers, or various search engine caches to get the metadata. Should help with the recent CAPTCHA problems when downloading metadata from amazon. + Kobo driver: Add support for new firmware. + Edit Book: Spell Check dialog: Always add the original word as one of the spelling corrections, so that small edits to the word can be made easily. + Edit Book: Saved searched Dialog: Allow re-arranging the saved searches using drag and drop. + Implement auto update of builtin metadata download plugins, just as for recipes and Get Books plugins. Needed as the websites they get data from often change. + Edit Book: When inserting full screen images, use the actual image dimensions in the generated SVG code, when available. + Linux installer: Check that the umask is suitable before running the installer. Should fix breakage on systems where users have changed the user umask but neglected to also alter it for sudo. + Bulk metadata edit: Remove the control to delete specific formats as it is redundant. This functionality is already present by right clicking the Remove books button. + Add support for sideloading of KFX files created with the third-party KFX calibre plugin. + Edit book: Allow drag and drop of image files, stylesheets and html files into the editor to insert the appropriate and tags and add the files to the book automatically. + Edit Book: Spell Check: If there are no suggestions fill the suggested word box with the original word. + Viewer: Add a shortcut (Ctrl+F11) to show/hide toolbars. + OS X/Linux: Show an informational popup message when an Android device is plugged in that needs the user to tap Allow for the connection to work. + Conversion: Log options that are different from the defaults separately, for easy reference. - Bug Fixes + TXT Input: When detecting the encoding of txt files only use the first four kilobytes of text. Fixes excessively slow conversion of very large text files. + Get Books: Fix price not being displayed for books from Amazon dues to website changes. + GetBooks: Update Google Books plugin for website changes. + E-book viewer: Fix slow startup when recently opened files are on a slow/malfunctioning networked filesystem. + Google metadata download: Fix metadata not being found when the title of the book includes a sub-title. + Improve downloading of covers from the google books metadata source. + News download: Fix a bug that could cause a crash when downloading an SVG image. + Edit book: Fix a regression that caused pasting copied text from programs that generate both HTML and plain text when copying to paste the HTML in preference to the plain text. + E-mail delivery: Add a Message-ID header when sending emails. Reduces probability of mails sent from calibre being marked as spam. + Save to disk: Fix path shortening being applied to entire save template even when saving to singe directory. + Get Books: Update the Virualo and Publi store plugins for website changes. + Viewer: Fix regression that caused slow opening of some books with missing font/css/image files. + Viewer: Pressing Ctrl+F in fullscreen mode should show the controls. + Edit book: Do not allow creating multiple new files whose names differ only by case. + Viewer: Use heuristics to try to detect comics encoded as fixed layout EPUBs to ensure they are displayed as intended. + Conversion: Fix regression that broke conversion of some epub files when using the 'Remove first image' option. + Get Books: Update Kobo plugin for website changes. + Windows MTP driver: Fix error when enumerating device storage not being reported during debug device detection. + Tag Browser: When dragging and dropping a book onto a series increment the series number. + Fix crash when generating covers with Qt 5.8 on linux. + Fix Get Books result list and jobs list not being populated on Qt 5.8. + Fix importing rules in the coloring/icon rules dialog not enabling the apply button. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-357=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): calibre-2.81.0-10.1 calibre-debuginfo-2.81.0-10.1 calibre-debugsource-2.81.0-10.1 References:

1 0

openSUSE-RU-2017:0744-1: Recommended update for fate
by maintenance＠opensuse.org 19 Mar '17

19 Mar '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0744-1 Rating: low References: #1028004 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fate fixes the following issues: - Fix error when generating a query that uses milestones. (boo#1028004) - Remember DeltaDialog size over restart. - Make diffs in 'Changes' dialog colored. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-356=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-356=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): fate-1.5.5.8.1-24.1 fate-debuginfo-1.5.5.8.1-24.1 - openSUSE Leap 42.1 (i586 x86_64): fate-1.5.5.8.1-24.1 fate-debuginfo-1.5.5.8.1-24.1 References: https://bugzilla.suse.com/1028004

1 0

openSUSE-RU-2017:0743-1: Recommended update for fate
by maintenance＠opensuse.org 19 Mar '17

19 Mar '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:0743-1 Rating: low References: #1028004 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fate fixes the following issues: - Fix error when generating a query that uses milestones. (boo#1028004) - Remember DeltaDialog size over restart. - Make diffs in 'Changes' dialog colored. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-356=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): fate-1.5.5.8.1-10.1 References: https://bugzilla.suse.com/1028004

1 0

openSUSE-SU-2017:0742-1: moderate: Security update for roundcubemail
by opensuse-security＠opensuse.org 19 Mar '17

19 Mar '17

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0742-1 Rating: moderate References: #1029035 Cross-References: CVE-2017-6820 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to roundcubemail 1.1.8 fixes security issues and bugs. The following vulnerability was fixed: - CVE-2017-6820: XSS issue in handling of a style tag inside of an svg element (boo#1029035) The following bugs were fixed: * bug where mail content frame couldn't be reset in some corner cases * regression where groups with email address were resolved to its members' addresses * group/addressbook selection is retained on page refresh * signature couldn't be added above the quote in Firefox 51 * microseconds macro (u) in log_date_format works Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-355=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-355=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): roundcubemail-1.1.8-18.1 - openSUSE Leap 42.1 (noarch): roundcubemail-1.1.8-18.1 References: https://www.suse.com/security/cve/CVE-2017-6820.html https://bugzilla.suse.com/1029035

1 0

openSUSE-SU-2017:0741-1: moderate: Security update for putty
by opensuse-security＠opensuse.org 19 Mar '17

19 Mar '17

openSUSE Security Update: Security update for putty ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0741-1 Rating: moderate References: #1029256 Cross-References: CVE-2017-6542 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to putty 0.68 fixes the following security issue: - CVE-2017-6542: If SSH agent forwarding is enabled, local attackers that are also able to connect to the UNIX domain socket could have overwritten heap data (boo#1029256) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-354=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-354=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): putty-0.68-12.1 putty-debuginfo-0.68-12.1 putty-debugsource-0.68-12.1 - openSUSE Leap 42.1 (i586 x86_64): putty-0.68-12.1 putty-debuginfo-0.68-12.1 putty-debugsource-0.68-12.1 References: https://www.suse.com/security/cve/CVE-2017-6542.html https://bugzilla.suse.com/1029256

1 0

openSUSE-SU-2017:0740-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 17 Mar '17

17 Mar '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0740-1 Rating: important References: #1028848 Cross-References: CVE-2017-5029 CVE-2017-5030 CVE-2017-5031 CVE-2017-5032 CVE-2017-5033 CVE-2017-5034 CVE-2017-5035 CVE-2017-5036 CVE-2017-5037 CVE-2017-5038 CVE-2017-5039 CVE-2017-5040 CVE-2017-5041 CVE-2017-5042 CVE-2017-5043 CVE-2017-5044 CVE-2017-5045 CVE-2017-5046 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 57.0.2987.98 to fix security issues and bugs. The following vulnerabilities were fixed (bsc#1028848): - CVE-2017-5030: Memory corruption in V8 - CVE-2017-5031: Use after free in ANGLE - CVE-2017-5032: Out of bounds write in PDFium - CVE-2017-5029: Integer overflow in libxslt - CVE-2017-5034: Use after free in PDFium - CVE-2017-5035: Incorrect security UI in Omnibox - CVE-2017-5036: Use after free in PDFium - CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer - CVE-2017-5039: Use after free in PDFium - CVE-2017-5040: Information disclosure in V8 - CVE-2017-5041: Address spoofing in Omnibox - CVE-2017-5033: Bypass of Content Security Policy in Blink - CVE-2017-5042: Incorrect handling of cookies in Cast - CVE-2017-5038: Use after free in GuestView - CVE-2017-5043: Use after free in GuestView - CVE-2017-5044: Heap overflow in Skia - CVE-2017-5045: Information disclosure in XSS Auditor - CVE-2017-5046: Information disclosure in Blink The following non-security changes are included: - Address broken rendering on non-intel cards Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-353=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-57.0.2987.98-8.1 chromedriver-debuginfo-57.0.2987.98-8.1 chromium-57.0.2987.98-8.1 chromium-debuginfo-57.0.2987.98-8.1 chromium-debugsource-57.0.2987.98-8.1 References: https://www.suse.com/security/cve/CVE-2017-5029.html https://www.suse.com/security/cve/CVE-2017-5030.html https://www.suse.com/security/cve/CVE-2017-5031.html https://www.suse.com/security/cve/CVE-2017-5032.html https://www.suse.com/security/cve/CVE-2017-5033.html https://www.suse.com/security/cve/CVE-2017-5034.html https://www.suse.com/security/cve/CVE-2017-5035.html https://www.suse.com/security/cve/CVE-2017-5036.html https://www.suse.com/security/cve/CVE-2017-5037.html https://www.suse.com/security/cve/CVE-2017-5038.html https://www.suse.com/security/cve/CVE-2017-5039.html https://www.suse.com/security/cve/CVE-2017-5040.html https://www.suse.com/security/cve/CVE-2017-5041.html https://www.suse.com/security/cve/CVE-2017-5042.html https://www.suse.com/security/cve/CVE-2017-5043.html https://www.suse.com/security/cve/CVE-2017-5044.html https://www.suse.com/security/cve/CVE-2017-5045.html https://www.suse.com/security/cve/CVE-2017-5046.html https://bugzilla.suse.com/1028848

1 0

openSUSE-SU-2017:0739-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 17 Mar '17

17 Mar '17

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0739-1 Rating: moderate References: #1029020 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update to irssi 1.0.2 fixes security issues and bugs. The following vulnerabilities were fixed: boo#1029020: Use after free while producing list of netjoins The following non-security changes are included: - Fix in command arg parser to detect missing arguments in tail place - Fix regression that broke incoming DCC file transfers - Fix issue with escaping \ in evaluated strings - improve UTF8 support in GRegex Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-352=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.0.2-21.1 irssi-devel-1.0.2-21.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le x86_64): irssi-debuginfo-1.0.2-21.1 irssi-debugsource-1.0.2-21.1 References: https://bugzilla.suse.com/1029020

1 0

openSUSE-SU-2017:0738-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 17 Mar '17

17 Mar '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0738-1 Rating: important References: #1028848 Cross-References: CVE-2017-5029 CVE-2017-5030 CVE-2017-5031 CVE-2017-5032 CVE-2017-5033 CVE-2017-5034 CVE-2017-5035 CVE-2017-5036 CVE-2017-5037 CVE-2017-5038 CVE-2017-5039 CVE-2017-5040 CVE-2017-5041 CVE-2017-5042 CVE-2017-5043 CVE-2017-5044 CVE-2017-5045 CVE-2017-5046 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 57.0.2987.98 to fix security issues and bugs. The following vulnerabilities were fixed (bsc#1028848): - CVE-2017-5030: Memory corruption in V8 - CVE-2017-5031: Use after free in ANGLE - CVE-2017-5032: Out of bounds write in PDFium - CVE-2017-5029: Integer overflow in libxslt - CVE-2017-5034: Use after free in PDFium - CVE-2017-5035: Incorrect security UI in Omnibox - CVE-2017-5036: Use after free in PDFium - CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer - CVE-2017-5039: Use after free in PDFium - CVE-2017-5040: Information disclosure in V8 - CVE-2017-5041: Address spoofing in Omnibox - CVE-2017-5033: Bypass of Content Security Policy in Blink - CVE-2017-5042: Incorrect handling of cookies in Cast - CVE-2017-5038: Use after free in GuestView - CVE-2017-5043: Use after free in GuestView - CVE-2017-5044: Heap overflow in Skia - CVE-2017-5045: Information disclosure in XSS Auditor - CVE-2017-5046: Information disclosure in Blink The following non-security changes are included: - Address broken rendering on non-intel cards Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-353=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-353=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-57.0.2987.98-105.2 chromedriver-debuginfo-57.0.2987.98-105.2 chromium-57.0.2987.98-105.2 chromium-debuginfo-57.0.2987.98-105.2 chromium-debugsource-57.0.2987.98-105.2 - openSUSE Leap 42.1 (x86_64): chromedriver-57.0.2987.98-105.2 chromedriver-debuginfo-57.0.2987.98-105.2 chromium-57.0.2987.98-105.2 chromium-debuginfo-57.0.2987.98-105.2 chromium-debugsource-57.0.2987.98-105.2 References: https://www.suse.com/security/cve/CVE-2017-5029.html https://www.suse.com/security/cve/CVE-2017-5030.html https://www.suse.com/security/cve/CVE-2017-5031.html https://www.suse.com/security/cve/CVE-2017-5032.html https://www.suse.com/security/cve/CVE-2017-5033.html https://www.suse.com/security/cve/CVE-2017-5034.html https://www.suse.com/security/cve/CVE-2017-5035.html https://www.suse.com/security/cve/CVE-2017-5036.html https://www.suse.com/security/cve/CVE-2017-5037.html https://www.suse.com/security/cve/CVE-2017-5038.html https://www.suse.com/security/cve/CVE-2017-5039.html https://www.suse.com/security/cve/CVE-2017-5040.html https://www.suse.com/security/cve/CVE-2017-5041.html https://www.suse.com/security/cve/CVE-2017-5042.html https://www.suse.com/security/cve/CVE-2017-5043.html https://www.suse.com/security/cve/CVE-2017-5044.html https://www.suse.com/security/cve/CVE-2017-5045.html https://www.suse.com/security/cve/CVE-2017-5046.html https://bugzilla.suse.com/1028848

1 0

openSUSE-SU-2017:0737-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 17 Mar '17

17 Mar '17

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0737-1 Rating: moderate References: #1029020 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update to irssi 1.0.2 fixes security issues and bugs. The following vulnerabilities were fixed: boo#1029020: Use after free while producing list of netjoins The following non-security changes are included: - Fix in command arg parser to detect missing arguments in tail place - Fix regression that broke incoming DCC file transfers - Fix issue with escaping \ in evaluated strings - improve UTF8 support in GRegex Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-352=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-352=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): irssi-1.0.2-15.1 irssi-debuginfo-1.0.2-15.1 irssi-debugsource-1.0.2-15.1 irssi-devel-1.0.2-15.1 - openSUSE Leap 42.1 (i586 x86_64): irssi-1.0.2-15.1 irssi-debuginfo-1.0.2-15.1 irssi-debugsource-1.0.2-15.1 irssi-devel-1.0.2-15.1 References: https://bugzilla.suse.com/1029020

1 0