April 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1131-1: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 28 Apr '17

28 Apr '17

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1131-1 Rating: low References: #1032509 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Add IndirectGLX ServerFlags option to re-enable indirect GLX. (boo#1032509) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-529=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-529=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xorg-x11-server-7.6_1.18.3-12.12.1 xorg-x11-server-debuginfo-7.6_1.18.3-12.12.1 xorg-x11-server-debugsource-7.6_1.18.3-12.12.1 xorg-x11-server-extra-7.6_1.18.3-12.12.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-12.12.1 xorg-x11-server-sdk-7.6_1.18.3-12.12.1 xorg-x11-server-source-7.6_1.18.3-12.12.1 - openSUSE Leap 42.1 (i586 x86_64): xorg-x11-server-7.6_1.17.2-30.1 xorg-x11-server-debuginfo-7.6_1.17.2-30.1 xorg-x11-server-debugsource-7.6_1.17.2-30.1 xorg-x11-server-extra-7.6_1.17.2-30.1 xorg-x11-server-extra-debuginfo-7.6_1.17.2-30.1 xorg-x11-server-sdk-7.6_1.17.2-30.1 xorg-x11-server-source-7.6_1.17.2-30.1 References: https://bugzilla.suse.com/1032509

1 0

openSUSE-RU-2017:1129-1: Recommended update for tomcat
by maintenance＠opensuse.org 28 Apr '17

28 Apr '17

openSUSE Recommended Update: Recommended update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1129-1 Rating: low References: #1022034 #1023412 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tomcat fixes the following issues: - File conflicts when upgrading from SLES 12 to SLES 12 SP1 (bsc#1023412) - Jasper init failure with SecurityManager (bsc#1022034) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-530=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): tomcat-8.0.32-14.1 tomcat-admin-webapps-8.0.32-14.1 tomcat-docs-webapp-8.0.32-14.1 tomcat-el-3_0-api-8.0.32-14.1 tomcat-embed-8.0.32-14.1 tomcat-javadoc-8.0.32-14.1 tomcat-jsp-2_3-api-8.0.32-14.1 tomcat-jsvc-8.0.32-14.1 tomcat-lib-8.0.32-14.1 tomcat-servlet-3_1-api-8.0.32-14.1 tomcat-webapps-8.0.32-14.1 References: https://bugzilla.suse.com/1022034 https://bugzilla.suse.com/1023412

1 0

openSUSE-SU-2017:1128-1: important: Security update for ruby2.1
by opensuse-security＠opensuse.org 28 Apr '17

28 Apr '17

openSUSE Security Update: Security update for ruby2.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1128-1 Rating: important References: #1014863 #1018808 #887877 #909695 #926974 #936032 #959495 #986630 Cross-References: CVE-2014-4975 CVE-2015-1855 CVE-2015-3900 CVE-2015-7551 CVE-2016-2339 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This ruby2.1 update to version 2.1.9 fixes the following issues: Security issues fixed: - CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new"initialize" (bsc#1018808) - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495) - CVE-2015-3900: hostname validation does not work when fetching gems or making API requests (bsc#936032) - CVE-2015-1855: Ruby'a OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames (bsc#926974) - CVE-2014-4975: off-by-one stack-based buffer overflow in the encodes() function (bsc#887877) Bugfixes: - SUSEconnect doesn't handle domain wildcards in no_proxy environment variable properly (bsc#1014863) - Segmentation fault after pack & ioctl & unpack (bsc#909695) - Ruby:HTTP Header injection in 'net/http' (bsc#986630) ChangeLog: - http://svn.ruby-lang.org/repos/ruby/tags/v2_1_9/ChangeLog This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-527=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-527=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libruby2_1-2_1-2.1.9-8.3.2 libruby2_1-2_1-debuginfo-2.1.9-8.3.2 ruby2.1-2.1.9-8.3.2 ruby2.1-debuginfo-2.1.9-8.3.2 ruby2.1-debugsource-2.1.9-8.3.2 ruby2.1-devel-2.1.9-8.3.2 ruby2.1-devel-extra-2.1.9-8.3.2 ruby2.1-doc-2.1.9-8.3.2 ruby2.1-stdlib-2.1.9-8.3.2 ruby2.1-stdlib-debuginfo-2.1.9-8.3.2 - openSUSE Leap 42.2 (noarch): ruby2.1-doc-ri-2.1.9-8.3.2 - openSUSE Leap 42.1 (i586 x86_64): libruby2_1-2_1-2.1.9-10.2 libruby2_1-2_1-debuginfo-2.1.9-10.2 ruby2.1-2.1.9-10.2 ruby2.1-debuginfo-2.1.9-10.2 ruby2.1-debugsource-2.1.9-10.2 ruby2.1-devel-2.1.9-10.2 ruby2.1-devel-extra-2.1.9-10.2 ruby2.1-doc-2.1.9-10.2 ruby2.1-stdlib-2.1.9-10.2 ruby2.1-stdlib-debuginfo-2.1.9-10.2 - openSUSE Leap 42.1 (noarch): ruby2.1-doc-ri-2.1.9-10.2 References: https://www.suse.com/security/cve/CVE-2014-4975.html https://www.suse.com/security/cve/CVE-2015-1855.html https://www.suse.com/security/cve/CVE-2015-3900.html https://www.suse.com/security/cve/CVE-2015-7551.html https://www.suse.com/security/cve/CVE-2016-2339.html https://bugzilla.suse.com/1014863 https://bugzilla.suse.com/1018808 https://bugzilla.suse.com/887877 https://bugzilla.suse.com/909695 https://bugzilla.suse.com/926974 https://bugzilla.suse.com/936032 https://bugzilla.suse.com/959495 https://bugzilla.suse.com/986630

1 0

openSUSE-SU-2017:1127-1: important: Security update for libosip2
by opensuse-security＠opensuse.org 28 Apr '17

28 Apr '17

openSUSE Security Update: Security update for libosip2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1127-1 Rating: important References: #1034570 #1034571 #1034572 #1034574 Cross-References: CVE-2016-10324 CVE-2016-10325 CVE-2016-10326 CVE-2017-7853 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libosip2 fixes the following issues: Changes in libosip2: - CVE-2017-7853: In libosip2 in GNU 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS. (boo#1034570) - CVE-2016-10326: In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c, resulting in a remote DoS. (boo#1034571) - CVE-2016-10325: In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in osipparser2/osip_message_to_str.c, resulting in a remote DoS. (boo#1034572) - CVE-2016-10324: In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c. (boo#1034574) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-526=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-526=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): libosip2-4.1.0-5.3.1 libosip2-debuginfo-4.1.0-5.3.1 libosip2-debugsource-4.1.0-5.3.1 libosip2-devel-4.1.0-5.3.1 - openSUSE Leap 42.1 (i586 x86_64): libosip2-4.1.0-5.1 libosip2-debuginfo-4.1.0-5.1 libosip2-debugsource-4.1.0-5.1 libosip2-devel-4.1.0-5.1 References: https://www.suse.com/security/cve/CVE-2016-10324.html https://www.suse.com/security/cve/CVE-2016-10325.html https://www.suse.com/security/cve/CVE-2016-10326.html https://www.suse.com/security/cve/CVE-2017-7853.html https://bugzilla.suse.com/1034570 https://bugzilla.suse.com/1034571 https://bugzilla.suse.com/1034572 https://bugzilla.suse.com/1034574

1 0

openSUSE-RU-2017:1126-1: moderate: Recommended update for yast2, yast2-http-server
by maintenance＠opensuse.org 28 Apr '17

28 Apr '17

openSUSE Recommended Update: Recommended update for yast2, yast2-http-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1126-1 Rating: moderate References: #1012047 #1017716 #1027582 #1028721 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2 and yast2-http-server provides the following fixes: yast2: - Ensure plain text release notes are shown properly in RichText mode. (bsc#1028721) - UnitFileState will be used for evaluating enable state of services. If it has an invalid value "systemctl is-enabled" has to be called instead. (bsc#1012047) - Do not cache ifcfg files with empty device name part (ifcfg-). Such file cannot be mapped to any existing device and providing empty device name could lead to crashes in other parts of YaST. (bsc#1017716) yast2-http-server: - Create a backup of the vhost configuration files to be potentially merged during execution. (bsc#1027582) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-528=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-3.1.215-5.3.1 - openSUSE Leap 42.2 (noarch): yast2-http-server-3.1.8-2.3.1 References: https://bugzilla.suse.com/1012047 https://bugzilla.suse.com/1017716 https://bugzilla.suse.com/1027582 https://bugzilla.suse.com/1028721

1 0

openSUSE-SU-2017:1124-1: moderate: Security update for backintime
by opensuse-security＠opensuse.org 28 Apr '17

28 Apr '17

openSUSE Security Update: Security update for backintime ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1124-1 Rating: moderate References: #1007723 #1032717 Cross-References: CVE-2017-7572 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for backintime to version 1.1.20 fixes several issues. These security issues were fixed: - CVE-2017-7572: The _checkPolkitPrivilege function in serviceHelper.py in backintime used a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use) (bsc#1032717). - Don't store passwords given to polkit helper - boo#1007723: General security hardening measures These non-security issues were fixed: - Delete udev configuration files on uninstall - Merge doc subpackage into main package Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-525=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-525=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): backintime-1.1.20-3.3.1 backintime-lang-1.1.20-3.3.1 backintime-qt4-1.1.20-3.3.1 - openSUSE Leap 42.1 (noarch): backintime-1.1.20-3.1 backintime-lang-1.1.20-3.1 backintime-qt4-1.1.20-3.1 References: https://www.suse.com/security/cve/CVE-2017-7572.html https://bugzilla.suse.com/1007723 https://bugzilla.suse.com/1032717

1 0

openSUSE-SU-2017:1121-1: moderate: Security update for ffmpeg
by opensuse-security＠opensuse.org 28 Apr '17

28 Apr '17

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1121-1 Rating: moderate References: #1022920 #1022921 #1022922 #1034176 #1034177 #1034179 #1034181 #1034183 Cross-References: CVE-2016-10190 CVE-2016-10191 CVE-2016-10192 CVE-2017-7859 CVE-2017-7862 CVE-2017-7863 CVE-2017-7865 CVE-2017-7866 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for ffmpeg to version 3.3 fixes several issues. These security issues were fixed: - CVE-2016-10190: Heap-based buffer overflow in libavformat/http.c in FFmpeg allowed remote web servers to execute arbitrary code via a negative chunk size in an HTTP response (boo#1022920) - CVE-2016-10191: Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg allowed remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches (boo#1022921) - CVE-2016-10192: Heap-based buffer overflow in ffserver.c in FFmpeg allowed remote attackers to execute arbitrary code by leveraging failure to check chunk size (boo#1022922) - CVE-2017-7859: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the ff_h264_slice_context_init function in libavcodec/h264dec.c (bsc#1034183). - CVE-2017-7862: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c (bsc#1034181). - CVE-2017-7863: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame_common function in libavcodec/pngdec.c (boo#1034179) - CVE-2017-7865: FFmpeg had an out-of-bounds write caused by a heap-based buffer overflow related to the ipvideo_decode_block_opcode_0xA function in libavcodec/interplayvideo.c and the avcodec_align_dimensions2 function in libavcodec/utils.c (boo#1034177) - CVE-2017-7866: FFmpeg had an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c (boo#1034176) These non-security issues were fixed: - Enable ac3 - Enable mp3 decoding - EBU R128 implementation now within ffmpeg, not relying on external library anymore - New video filters "premultiply", "readeia608", "threshold", "midequalizer" - Support for spherical videos - New decoders: 16.8 and 24.0 floating point PCM, XPM - New demuxers: MIDI Sample Dump Standard, Sample Dump eXchange demuxer - MJPEG encoding uses Optimal Huffman tables now - Native Opus encoder - Support .mov with multiple sample description tables - Removed the legacy X11 screen grabber, use XCB instead - Removed asyncts filter (use af_aresample instead) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-524=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ffmpeg-3.3-6.6.1 ffmpeg-debuginfo-3.3-6.6.1 ffmpeg-debugsource-3.3-6.6.1 libavcodec-devel-3.3-6.6.1 libavcodec57-3.3-6.6.1 libavcodec57-debuginfo-3.3-6.6.1 libavdevice-devel-3.3-6.6.1 libavdevice57-3.3-6.6.1 libavdevice57-debuginfo-3.3-6.6.1 libavfilter-devel-3.3-6.6.1 libavfilter6-3.3-6.6.1 libavfilter6-debuginfo-3.3-6.6.1 libavformat-devel-3.3-6.6.1 libavformat57-3.3-6.6.1 libavformat57-debuginfo-3.3-6.6.1 libavresample-devel-3.3-6.6.1 libavresample3-3.3-6.6.1 libavresample3-debuginfo-3.3-6.6.1 libavutil-devel-3.3-6.6.1 libavutil55-3.3-6.6.1 libavutil55-debuginfo-3.3-6.6.1 libpostproc-devel-3.3-6.6.1 libpostproc54-3.3-6.6.1 libpostproc54-debuginfo-3.3-6.6.1 libswresample-devel-3.3-6.6.1 libswresample2-3.3-6.6.1 libswresample2-debuginfo-3.3-6.6.1 libswscale-devel-3.3-6.6.1 libswscale4-3.3-6.6.1 libswscale4-debuginfo-3.3-6.6.1 - openSUSE Leap 42.2 (x86_64): libavcodec57-32bit-3.3-6.6.1 libavcodec57-debuginfo-32bit-3.3-6.6.1 libavdevice57-32bit-3.3-6.6.1 libavdevice57-debuginfo-32bit-3.3-6.6.1 libavfilter6-32bit-3.3-6.6.1 libavfilter6-debuginfo-32bit-3.3-6.6.1 libavformat57-32bit-3.3-6.6.1 libavformat57-debuginfo-32bit-3.3-6.6.1 libavresample3-32bit-3.3-6.6.1 libavresample3-debuginfo-32bit-3.3-6.6.1 libavutil55-32bit-3.3-6.6.1 libavutil55-debuginfo-32bit-3.3-6.6.1 libpostproc54-32bit-3.3-6.6.1 libpostproc54-debuginfo-32bit-3.3-6.6.1 libswresample2-32bit-3.3-6.6.1 libswresample2-debuginfo-32bit-3.3-6.6.1 libswscale4-32bit-3.3-6.6.1 libswscale4-debuginfo-32bit-3.3-6.6.1 References: https://www.suse.com/security/cve/CVE-2016-10190.html https://www.suse.com/security/cve/CVE-2016-10191.html https://www.suse.com/security/cve/CVE-2016-10192.html https://www.suse.com/security/cve/CVE-2017-7859.html https://www.suse.com/security/cve/CVE-2017-7862.html https://www.suse.com/security/cve/CVE-2017-7863.html https://www.suse.com/security/cve/CVE-2017-7865.html https://www.suse.com/security/cve/CVE-2017-7866.html https://bugzilla.suse.com/1022920 https://bugzilla.suse.com/1022921 https://bugzilla.suse.com/1022922 https://bugzilla.suse.com/1034176 https://bugzilla.suse.com/1034177 https://bugzilla.suse.com/1034179 https://bugzilla.suse.com/1034181 https://bugzilla.suse.com/1034183

1 0

openSUSE-RU-2017:1119-1: Recommended update for ding-libs and sssd
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for ding-libs and sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1119-1 Rating: low References: #1021441 #1024836 #1030473 #983938 #993582 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for ding-libs and sssd provides the following fixes: - Fix IO error triggered by processing non-ordinary GPO values such as remote registry settings. (bsc#1030473) - Introduce mandatory runtime requirement "cyrus-sasl-gssapi" to krb5-common sub-package. (bsc#1024836) - The IPA provider depends on AD provider's PAC executable. Add the dependency to the package. (bsc#1021441) - Remove invalid definition "After=syslog.target" from systemd service file. (bsc#983938) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-521=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ding-libs-debugsource-0.5.0-25.3.1 libbasicobjects-devel-0.1.1-25.3.1 libbasicobjects0-0.1.1-25.3.1 libbasicobjects0-debuginfo-0.1.1-25.3.1 libcollection-devel-0.7.0-25.3.1 libcollection4-0.7.0-25.3.1 libcollection4-debuginfo-0.7.0-25.3.1 libdhash-devel-0.4.3-25.3.1 libdhash1-0.4.3-25.3.1 libdhash1-debuginfo-0.4.3-25.3.1 libini_config-devel-1.2.0-25.3.1 libini_config5-1.2.0-25.3.1 libini_config5-debuginfo-1.2.0-25.3.1 libipa_hbac-devel-1.13.4-5.3.1 libipa_hbac0-1.13.4-5.3.1 libipa_hbac0-debuginfo-1.13.4-5.3.1 libpath_utils-devel-0.2.1-25.3.1 libpath_utils1-0.2.1-25.3.1 libpath_utils1-debuginfo-0.2.1-25.3.1 libref_array-devel-0.1.5-25.3.1 libref_array1-0.1.5-25.3.1 libref_array1-debuginfo-0.1.5-25.3.1 libsss_idmap-devel-1.13.4-5.3.1 libsss_idmap0-1.13.4-5.3.1 libsss_idmap0-debuginfo-1.13.4-5.3.1 libsss_nss_idmap-devel-1.13.4-5.3.1 libsss_nss_idmap0-1.13.4-5.3.1 libsss_nss_idmap0-debuginfo-1.13.4-5.3.1 libsss_sudo-1.13.4-5.3.1 libsss_sudo-debuginfo-1.13.4-5.3.1 python-ipa_hbac-1.13.4-5.3.1 python-ipa_hbac-debuginfo-1.13.4-5.3.1 python-sss_nss_idmap-1.13.4-5.3.1 python-sss_nss_idmap-debuginfo-1.13.4-5.3.1 python-sssd-config-1.13.4-5.3.1 python-sssd-config-debuginfo-1.13.4-5.3.1 sssd-1.13.4-5.3.1 sssd-ad-1.13.4-5.3.1 sssd-ad-debuginfo-1.13.4-5.3.1 sssd-debuginfo-1.13.4-5.3.1 sssd-debugsource-1.13.4-5.3.1 sssd-ipa-1.13.4-5.3.1 sssd-ipa-debuginfo-1.13.4-5.3.1 sssd-krb5-1.13.4-5.3.1 sssd-krb5-common-1.13.4-5.3.1 sssd-krb5-common-debuginfo-1.13.4-5.3.1 sssd-krb5-debuginfo-1.13.4-5.3.1 sssd-ldap-1.13.4-5.3.1 sssd-ldap-debuginfo-1.13.4-5.3.1 sssd-proxy-1.13.4-5.3.1 sssd-proxy-debuginfo-1.13.4-5.3.1 sssd-tools-1.13.4-5.3.1 sssd-tools-debuginfo-1.13.4-5.3.1 - openSUSE Leap 42.2 (x86_64): libbasicobjects-devel-32bit-0.1.1-25.3.1 libbasicobjects0-32bit-0.1.1-25.3.1 libbasicobjects0-debuginfo-32bit-0.1.1-25.3.1 libcollection-devel-32bit-0.7.0-25.3.1 libcollection4-32bit-0.7.0-25.3.1 libcollection4-debuginfo-32bit-0.7.0-25.3.1 libdhash-devel-32bit-0.4.3-25.3.1 libdhash1-32bit-0.4.3-25.3.1 libdhash1-debuginfo-32bit-0.4.3-25.3.1 libini_config-devel-32bit-1.2.0-25.3.1 libini_config5-32bit-1.2.0-25.3.1 libini_config5-debuginfo-32bit-1.2.0-25.3.1 libpath_utils-devel-32bit-0.2.1-25.3.1 libpath_utils1-32bit-0.2.1-25.3.1 libpath_utils1-debuginfo-32bit-0.2.1-25.3.1 libref_array-devel-32bit-0.1.5-25.3.1 libref_array1-32bit-0.1.5-25.3.1 libref_array1-debuginfo-32bit-0.1.5-25.3.1 sssd-32bit-1.13.4-5.3.1 sssd-debuginfo-32bit-1.13.4-5.3.1 References: https://bugzilla.suse.com/1021441 https://bugzilla.suse.com/1024836 https://bugzilla.suse.com/1030473 https://bugzilla.suse.com/983938 https://bugzilla.suse.com/993582

1 0

openSUSE-RU-2017:1118-1: Recommended update for yast2-kdump
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for yast2-kdump ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1118-1 Rating: low References: #1014136 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-kdump provides the following fix: - Fix dumping kernel with Xen hypervisor (bsc#1014136) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-522=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-kdump-3.1.43-2.3.1 References: https://bugzilla.suse.com/1014136

1 0

openSUSE-RU-2017:1116-1: Recommended update for llvm
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for llvm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1116-1 Rating: low References: #1023614 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for llvm fixes the following issue: - libllvm shader compiler creates invalid code (bsc#1023614) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-518=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libLLVM-3.8.0-2.3.1 libLLVM-debuginfo-3.8.0-2.3.1 libclang-3.8.0-2.3.1 libclang-debuginfo-3.8.0-2.3.1 llvm-3.8.0-2.3.1 llvm-clang-3.8.0-2.3.1 llvm-clang-debuginfo-3.8.0-2.3.1 llvm-clang-devel-3.8.0-2.3.1 llvm-debuginfo-3.8.0-2.3.1 llvm-debugsource-3.8.0-2.3.1 llvm-devel-3.8.0-2.3.1 llvm-devel-debuginfo-3.8.0-2.3.1 llvm-vim-plugins-3.8.0-2.3.1 python-clang-3.8.0-2.3.1 - openSUSE Leap 42.2 (x86_64): libLLVM-32bit-3.8.0-2.3.1 libLLVM-debuginfo-32bit-3.8.0-2.3.1 libclang-32bit-3.8.0-2.3.1 libclang-debuginfo-32bit-3.8.0-2.3.1 lldb-3.8.0-2.3.1 lldb-debuginfo-3.8.0-2.3.1 References: https://bugzilla.suse.com/1023614

1 0

openSUSE-RU-2017:1115-1: Recommended update for ruby-common, rubygem-gem2rpm
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for ruby-common, rubygem-gem2rpm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1115-1 Rating: low References: #963710 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ruby-common, rubygem-gem2rpm fixes the following issues: ruby-common: - Since rubygems 2.5.0 the default version in the gem bin stub changed from '>= 0' to '>= 0.a'. This was done to allow pre-release versions. Our patching script didn't take the '.a' into account and generated version fields like '= 0.10.1.a' instead of the expected '= 0.10.1'. This fix accounts for the '.a'. Changes in rubygem-gem2rpm: - Fix 'gem2rpm --fetch': prefer https for accessing rubygems.org. (bsc#963710) - Add support for Ruby 2.3.0 and 2.4.0. - Add :post_patch hook to run commands before we rebuild the gem used by libv8. - Add support for rubinius 2.5 and remove support for 2.2. - No longer require the Ruby version inside the sub-package. With BuildRequires we already make sure that the package is only built if we find a recent enough ABI. Then the normal $interpreter(abi) requires generated by rpm is enough. - Move to new packaging templates by default. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-519=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-519=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ruby2.1-rubygem-gem2rpm-0.10.1-5.3.1 ruby2.1-rubygem-gem2rpm-doc-0.10.1-5.3.1 - openSUSE Leap 42.2 (noarch): ruby-common-2.1-6.3.1 - openSUSE Leap 42.1 (i586 x86_64): ruby2.1-rubygem-gem2rpm-0.10.1-5.1 ruby2.1-rubygem-gem2rpm-doc-0.10.1-5.1 - openSUSE Leap 42.1 (noarch): ruby-common-2.1-8.1 References: https://bugzilla.suse.com/963710

1 0

openSUSE-RU-2017:1114-1: Recommended update for tomcat
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1114-1 Rating: low References: #1022034 #1023412 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tomcat provides the following fixes: - Fix file conflicts when upgrading from SLES 12 to SLES 12 SP1 (bsc#1023412) - Fix jasper init failure with SecurityManager (bsc#1022034) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-523=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): tomcat-8.0.36-6.3.1 tomcat-admin-webapps-8.0.36-6.3.1 tomcat-docs-webapp-8.0.36-6.3.1 tomcat-el-3_0-api-8.0.36-6.3.1 tomcat-embed-8.0.36-6.3.1 tomcat-javadoc-8.0.36-6.3.1 tomcat-jsp-2_3-api-8.0.36-6.3.1 tomcat-jsvc-8.0.36-6.3.1 tomcat-lib-8.0.36-6.3.1 tomcat-servlet-3_1-api-8.0.36-6.3.1 tomcat-webapps-8.0.36-6.3.1 References: https://bugzilla.suse.com/1022034 https://bugzilla.suse.com/1023412

1 0

openSUSE-RU-2017:1113-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1113-1 Rating: moderate References: #1009710 #1017070 #1024836 #983938 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for sssd fixes the following issues: - Resolve a performance regression in user login and fix several memory leaks. (bsc#1017070) - Introduce mandatory runtime requirement "cyrus-sasl-gssapi" to krb5-common sub-package. (bsc#1024836) - In addition to sudoRunAsUser and sudoRunAsGroup, fetch also sudoRunAs attribute from LDAP to be compatible with older versions of sudo. (bsc#1009710) - Remove invalid definition "After=syslog.target" from systemd service file. (bsc#983938) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-520=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libipa_hbac-devel-1.11.5.1-19.1 libipa_hbac0-1.11.5.1-19.1 libipa_hbac0-debuginfo-1.11.5.1-19.1 libsss_idmap-devel-1.11.5.1-19.1 libsss_idmap0-1.11.5.1-19.1 libsss_idmap0-debuginfo-1.11.5.1-19.1 libsss_nss_idmap-devel-1.11.5.1-19.1 libsss_nss_idmap0-1.11.5.1-19.1 libsss_nss_idmap0-debuginfo-1.11.5.1-19.1 libsss_sudo-1.11.5.1-19.1 libsss_sudo-debuginfo-1.11.5.1-19.1 python-ipa_hbac-1.11.5.1-19.1 python-ipa_hbac-debuginfo-1.11.5.1-19.1 python-sss_nss_idmap-1.11.5.1-19.1 python-sss_nss_idmap-debuginfo-1.11.5.1-19.1 python-sssd-config-1.11.5.1-19.1 python-sssd-config-debuginfo-1.11.5.1-19.1 sssd-1.11.5.1-19.1 sssd-ad-1.11.5.1-19.1 sssd-ad-debuginfo-1.11.5.1-19.1 sssd-debuginfo-1.11.5.1-19.1 sssd-debugsource-1.11.5.1-19.1 sssd-ipa-1.11.5.1-19.1 sssd-ipa-debuginfo-1.11.5.1-19.1 sssd-krb5-1.11.5.1-19.1 sssd-krb5-common-1.11.5.1-19.1 sssd-krb5-common-debuginfo-1.11.5.1-19.1 sssd-krb5-debuginfo-1.11.5.1-19.1 sssd-ldap-1.11.5.1-19.1 sssd-ldap-debuginfo-1.11.5.1-19.1 sssd-proxy-1.11.5.1-19.1 sssd-proxy-debuginfo-1.11.5.1-19.1 sssd-tools-1.11.5.1-19.1 sssd-tools-debuginfo-1.11.5.1-19.1 - openSUSE Leap 42.1 (x86_64): sssd-32bit-1.11.5.1-19.1 sssd-debuginfo-32bit-1.11.5.1-19.1 References: https://bugzilla.suse.com/1009710 https://bugzilla.suse.com/1017070 https://bugzilla.suse.com/1024836 https://bugzilla.suse.com/983938

1 0

openSUSE-RU-2017:1112-1: moderate: Recommended update for libtool
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for libtool ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1112-1 Rating: moderate References: #1010802 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libtool prevents a segmentation fault caused by insufficient error handling on out-of-memory situations. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-517=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-517=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libltdl7-2.4.2-18.3.1 libltdl7-debuginfo-2.4.2-18.3.1 libtool-2.4.2-18.3.1 libtool-debugsource-2.4.2-18.3.1 - openSUSE Leap 42.2 (x86_64): libltdl7-32bit-2.4.2-18.3.1 libltdl7-debuginfo-32bit-2.4.2-18.3.1 libtool-32bit-2.4.2-18.3.1 - openSUSE Leap 42.1 (i586 x86_64): libltdl7-2.4.2-18.1 libltdl7-debuginfo-2.4.2-18.1 libtool-2.4.2-18.1 libtool-debugsource-2.4.2-18.1 - openSUSE Leap 42.1 (x86_64): libltdl7-32bit-2.4.2-18.1 libltdl7-debuginfo-32bit-2.4.2-18.1 libtool-32bit-2.4.2-18.1 References: https://bugzilla.suse.com/1010802

1 0

openSUSE-RU-2017:1111-1: Recommended update for python-kiwi
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1111-1 Rating: low References: #1030038 #1032118 #1032119 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update provides python-kiwi 8.30.1, which provides the following fixes: - Fix PXE builder. Filesystem image rootfs was not in toplevel. - Refactor ip link detection. There is no reliable way to check if a link is unplugged, thus the system has to be changed. - Ensure grub.cfg exists in EFI path for iso images. - Delete no longer needed btrfs bootpath setup. (bsc#1030038) - Fix bootloader menu title setup. (bsc#1032118) - Avoid GRUB_DISTRIBUTOR setup in etc/default/grub. (bsc#1032119) - Added "oem-nic-filter" element. - Fix grub2 setup and tool calls. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-516=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kiwi-boot-requires-8.30.1-5.1 kiwi-man-pages-8.30.1-5.1 kiwi-pxeboot-8.30.1-5.1 kiwi-tools-8.30.1-5.1 kiwi-tools-debuginfo-8.30.1-5.1 python-kiwi-debugsource-8.30.1-5.1 python2-kiwi-8.30.1-5.1 python3-kiwi-8.30.1-5.1 References: https://bugzilla.suse.com/1030038 https://bugzilla.suse.com/1032118 https://bugzilla.suse.com/1032119

1 0

openSUSE-SU-2017:1108-1: important: Security update for tiff
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1108-1 Rating: important References: #1031247 #1031249 #1031250 #1031254 #1031255 #1031262 #1031263 Cross-References: CVE-2016-10266 CVE-2016-10267 CVE-2016-10268 CVE-2016-10269 CVE-2016-10270 CVE-2016-10271 CVE-2016-10272 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-10272: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "WRITE of size 2048" and libtiff/tif_next.c:64:9 (bsc#1031247). - CVE-2016-10271: tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read and buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 1" and libtiff/tif_fax3.c:413:13 (bsc#1031249). - CVE-2016-10270: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22 (bsc#1031250). - CVE-2016-10269: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2 (bsc#1031254). - CVE-2016-10268: tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23 (bsc#1031255). - CVE-2016-10267: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8 (bsc#1031262). - CVE-2016-10266: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22. (bsc#1031263). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-515=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-515=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libtiff-devel-4.0.7-17.3.1 libtiff5-4.0.7-17.3.1 libtiff5-debuginfo-4.0.7-17.3.1 tiff-4.0.7-17.3.1 tiff-debuginfo-4.0.7-17.3.1 tiff-debugsource-4.0.7-17.3.1 - openSUSE Leap 42.2 (x86_64): libtiff-devel-32bit-4.0.7-17.3.1 libtiff5-32bit-4.0.7-17.3.1 libtiff5-debuginfo-32bit-4.0.7-17.3.1 - openSUSE Leap 42.1 (i586 x86_64): libtiff-devel-4.0.7-18.1 libtiff5-4.0.7-18.1 libtiff5-debuginfo-4.0.7-18.1 tiff-4.0.7-18.1 tiff-debuginfo-4.0.7-18.1 tiff-debugsource-4.0.7-18.1 - openSUSE Leap 42.1 (x86_64): libtiff-devel-32bit-4.0.7-18.1 libtiff5-32bit-4.0.7-18.1 libtiff5-debuginfo-32bit-4.0.7-18.1 References: https://www.suse.com/security/cve/CVE-2016-10266.html https://www.suse.com/security/cve/CVE-2016-10267.html https://www.suse.com/security/cve/CVE-2016-10268.html https://www.suse.com/security/cve/CVE-2016-10269.html https://www.suse.com/security/cve/CVE-2016-10270.html https://www.suse.com/security/cve/CVE-2016-10271.html https://www.suse.com/security/cve/CVE-2016-10272.html https://bugzilla.suse.com/1031247 https://bugzilla.suse.com/1031249 https://bugzilla.suse.com/1031250 https://bugzilla.suse.com/1031254 https://bugzilla.suse.com/1031255 https://bugzilla.suse.com/1031262 https://bugzilla.suse.com/1031263

1 0

openSUSE-SU-2017:1107-1: moderate: Security update for libsndfile
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for libsndfile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1107-1 Rating: moderate References: #1033053 #1033054 #1033914 #1033915 Cross-References: CVE-2017-7585 CVE-2017-7586 CVE-2017-7741 CVE-2017-7742 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libsndfile fixes the following security issues: - CVE-2017-7586: A stack-based buffer overflow via a specially crafted FLAC file was fixed (error in the "header_read()" function) (bsc#1033053) - CVE-2017-7585,CVE-2017-7741, CVE-2017-7742: Several stack-based buffer overflows via a specially crafted FLAC file (error in the "flac_buffer_copy()" function) were fixed (bsc#1033054,bsc#1033915,bsc#1033914). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-514=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-514=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsndfile-debugsource-1.0.25-26.3.1 libsndfile-devel-1.0.25-26.3.1 libsndfile-progs-1.0.25-26.3.1 libsndfile-progs-debuginfo-1.0.25-26.3.1 libsndfile-progs-debugsource-1.0.25-26.3.1 libsndfile1-1.0.25-26.3.1 libsndfile1-debuginfo-1.0.25-26.3.1 - openSUSE Leap 42.2 (x86_64): libsndfile1-32bit-1.0.25-26.3.1 libsndfile1-debuginfo-32bit-1.0.25-26.3.1 - openSUSE Leap 42.1 (i586 x86_64): libsndfile-debugsource-1.0.25-27.1 libsndfile-devel-1.0.25-27.1 libsndfile-progs-1.0.25-27.1 libsndfile-progs-debuginfo-1.0.25-27.1 libsndfile-progs-debugsource-1.0.25-27.1 libsndfile1-1.0.25-27.1 libsndfile1-debuginfo-1.0.25-27.1 - openSUSE Leap 42.1 (x86_64): libsndfile1-32bit-1.0.25-27.1 libsndfile1-debuginfo-32bit-1.0.25-27.1 References: https://www.suse.com/security/cve/CVE-2017-7585.html https://www.suse.com/security/cve/CVE-2017-7586.html https://www.suse.com/security/cve/CVE-2017-7741.html https://www.suse.com/security/cve/CVE-2017-7742.html https://bugzilla.suse.com/1033053 https://bugzilla.suse.com/1033054 https://bugzilla.suse.com/1033914 https://bugzilla.suse.com/1033915

1 0

openSUSE-SU-2017:1106-1: Security update for gstreamer-plugins-base
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for gstreamer-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1106-1 Rating: low References: #1024041 #1024047 #1024076 #1024079 Cross-References: CVE-2017-5837 CVE-2017-5839 CVE-2017-5842 CVE-2017-5844 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for gstreamer-plugins-base fixes the following security issues: - A crafted AVI file could have caused a floating point exception leading to DoS (bsc#1024076, CVE-2017-5837, bsc#1024079, CVE-2017-5844) - A crafted AVI file could have caused a stack overflow leading to DoS (bsc#1024047, CVE-2017-5839) - A crafted SAMI subtitle file could have caused an invalid memory access possibly leading to DoS or corruption (bsc#1024041, CVE-2017-5842) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-512=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gstreamer-plugins-base-1.8.3-5.3.2 gstreamer-plugins-base-debuginfo-1.8.3-5.3.2 gstreamer-plugins-base-debugsource-1.8.3-5.3.2 gstreamer-plugins-base-devel-1.8.3-5.3.2 gstreamer-plugins-base-doc-1.8.3-5.3.2 libgstallocators-1_0-0-1.8.3-5.3.2 libgstallocators-1_0-0-debuginfo-1.8.3-5.3.2 libgstapp-1_0-0-1.8.3-5.3.2 libgstapp-1_0-0-debuginfo-1.8.3-5.3.2 libgstaudio-1_0-0-1.8.3-5.3.2 libgstaudio-1_0-0-debuginfo-1.8.3-5.3.2 libgstfft-1_0-0-1.8.3-5.3.2 libgstfft-1_0-0-debuginfo-1.8.3-5.3.2 libgstpbutils-1_0-0-1.8.3-5.3.2 libgstpbutils-1_0-0-debuginfo-1.8.3-5.3.2 libgstriff-1_0-0-1.8.3-5.3.2 libgstriff-1_0-0-debuginfo-1.8.3-5.3.2 libgstrtp-1_0-0-1.8.3-5.3.2 libgstrtp-1_0-0-debuginfo-1.8.3-5.3.2 libgstrtsp-1_0-0-1.8.3-5.3.2 libgstrtsp-1_0-0-debuginfo-1.8.3-5.3.2 libgstsdp-1_0-0-1.8.3-5.3.2 libgstsdp-1_0-0-debuginfo-1.8.3-5.3.2 libgsttag-1_0-0-1.8.3-5.3.2 libgsttag-1_0-0-debuginfo-1.8.3-5.3.2 libgstvideo-1_0-0-1.8.3-5.3.2 libgstvideo-1_0-0-debuginfo-1.8.3-5.3.2 typelib-1_0-GstAllocators-1_0-1.8.3-5.3.2 typelib-1_0-GstApp-1_0-1.8.3-5.3.2 typelib-1_0-GstAudio-1_0-1.8.3-5.3.2 typelib-1_0-GstFft-1_0-1.8.3-5.3.2 typelib-1_0-GstPbutils-1_0-1.8.3-5.3.2 typelib-1_0-GstRtp-1_0-1.8.3-5.3.2 typelib-1_0-GstRtsp-1_0-1.8.3-5.3.2 typelib-1_0-GstSdp-1_0-1.8.3-5.3.2 typelib-1_0-GstTag-1_0-1.8.3-5.3.2 typelib-1_0-GstVideo-1_0-1.8.3-5.3.2 - openSUSE Leap 42.2 (noarch): gstreamer-plugins-base-lang-1.8.3-5.3.2 - openSUSE Leap 42.2 (x86_64): gstreamer-plugins-base-32bit-1.8.3-5.3.2 gstreamer-plugins-base-debuginfo-32bit-1.8.3-5.3.2 gstreamer-plugins-base-devel-32bit-1.8.3-5.3.2 libgstallocators-1_0-0-32bit-1.8.3-5.3.2 libgstallocators-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstapp-1_0-0-32bit-1.8.3-5.3.2 libgstapp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstaudio-1_0-0-32bit-1.8.3-5.3.2 libgstaudio-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstfft-1_0-0-32bit-1.8.3-5.3.2 libgstfft-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstpbutils-1_0-0-32bit-1.8.3-5.3.2 libgstpbutils-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstriff-1_0-0-32bit-1.8.3-5.3.2 libgstriff-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstrtp-1_0-0-32bit-1.8.3-5.3.2 libgstrtp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstrtsp-1_0-0-32bit-1.8.3-5.3.2 libgstrtsp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstsdp-1_0-0-32bit-1.8.3-5.3.2 libgstsdp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgsttag-1_0-0-32bit-1.8.3-5.3.2 libgsttag-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstvideo-1_0-0-32bit-1.8.3-5.3.2 libgstvideo-1_0-0-debuginfo-32bit-1.8.3-5.3.2 References: https://www.suse.com/security/cve/CVE-2017-5837.html https://www.suse.com/security/cve/CVE-2017-5839.html https://www.suse.com/security/cve/CVE-2017-5842.html https://www.suse.com/security/cve/CVE-2017-5844.html https://bugzilla.suse.com/1024041 https://bugzilla.suse.com/1024047 https://bugzilla.suse.com/1024076 https://bugzilla.suse.com/1024079

1 0

openSUSE-SU-2017:1105-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1105-1 Rating: moderate References: #1015332 #1027712 #1032309 Cross-References: CVE-2016-9586 CVE-2017-7407 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for curl fixes the following issues: Security issue fixed: - CVE-2016-9586: libcurl printf floating point buffer overflow (bsc#1015332) - CVE-2017-7407: The ourWriteOut function in tool_writeout.c in curl might have allowed physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which lead to a heap-based buffer over-read (bsc#1032309). With this release new default ciphers are active (SUSE_DEFAULT, bsc#1027712). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-513=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-513=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): curl-7.37.0-16.3.1 curl-debuginfo-7.37.0-16.3.1 curl-debugsource-7.37.0-16.3.1 libcurl-devel-7.37.0-16.3.1 libcurl4-7.37.0-16.3.1 libcurl4-debuginfo-7.37.0-16.3.1 - openSUSE Leap 42.2 (x86_64): libcurl-devel-32bit-7.37.0-16.3.1 libcurl4-32bit-7.37.0-16.3.1 libcurl4-debuginfo-32bit-7.37.0-16.3.1 - openSUSE Leap 42.1 (i586 x86_64): curl-7.37.0-19.1 curl-debuginfo-7.37.0-19.1 curl-debugsource-7.37.0-19.1 libcurl-devel-7.37.0-19.1 libcurl4-7.37.0-19.1 libcurl4-debuginfo-7.37.0-19.1 - openSUSE Leap 42.1 (x86_64): libcurl-devel-32bit-7.37.0-19.1 libcurl4-32bit-7.37.0-19.1 libcurl4-debuginfo-32bit-7.37.0-19.1 References: https://www.suse.com/security/cve/CVE-2016-9586.html https://www.suse.com/security/cve/CVE-2017-7407.html https://bugzilla.suse.com/1015332 https://bugzilla.suse.com/1027712 https://bugzilla.suse.com/1032309

1 0

openSUSE-RU-2017:1104-1: Recommended update for clamav-database
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1104-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh April 23rd 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-510=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-510=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201704240006-54.18.1 - openSUSE Leap 42.1 (noarch): clamav-database-201704240006-249.1 References:

1 0

openSUSE-SU-2017:1100-1: important: Security update for chromium
by opensuse-security＠opensuse.org 24 Apr '17

24 Apr '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1100-1 Rating: important References: #1035103 Cross-References: CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update to Chromium 58.0.3029.81 fixes the following security issues (bsc#1035103): - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in Omnibox - CVE-2017-5062: Use after free in Chrome Apps - CVE-2017-5063: Heap overflow in Skia - CVE-2017-5064: Use after free in Blink - CVE-2017-5065: Incorrect UI in Blink - CVE-2017-5066: Incorrect signature handing in Networking - CVE-2017-5067: URL spoofing in Omnibox - CVE-2017-5069: Cross-origin bypass in Blink Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-508=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-58.0.3029.81-14.1 chromedriver-debuginfo-58.0.3029.81-14.1 chromium-58.0.3029.81-14.1 chromium-debuginfo-58.0.3029.81-14.1 chromium-debugsource-58.0.3029.81-14.1 References: https://www.suse.com/security/cve/CVE-2017-5057.html https://www.suse.com/security/cve/CVE-2017-5058.html https://www.suse.com/security/cve/CVE-2017-5059.html https://www.suse.com/security/cve/CVE-2017-5060.html https://www.suse.com/security/cve/CVE-2017-5061.html https://www.suse.com/security/cve/CVE-2017-5062.html https://www.suse.com/security/cve/CVE-2017-5063.html https://www.suse.com/security/cve/CVE-2017-5064.html https://www.suse.com/security/cve/CVE-2017-5065.html https://www.suse.com/security/cve/CVE-2017-5066.html https://www.suse.com/security/cve/CVE-2017-5067.html https://www.suse.com/security/cve/CVE-2017-5069.html https://bugzilla.suse.com/1035103

1 0

openSUSE-SU-2017:1099-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 24 Apr '17

24 Apr '17

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1099-1 Rating: important References: #1035082 Cross-References: CVE-2017-5429 CVE-2017-5443 CVE-2017-5444 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5449 CVE-2017-5460 CVE-2017-5461 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: Mozilla Firefox was updated to Firefox 52.1.0esr. The following vulnerabilities were fixed (bsc#1035082): - CVE-2017-5443: Out-of-bounds write during BinHex decoding - CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 - CVE-2017-5464: Memory corruption with accessibility and DOM manipulation - CVE-2017-5465: Out-of-bounds read in ConvolvePixel - CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL - CVE-2017-5467: Memory corruption when drawing Skia content - CVE-2017-5460: Use-after-free in frame selection - CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS - CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor - CVE-2017-5449: Crash during bidirectional unicode manipulation with animation - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data - CVE-2017-5447: Out-of-bounds read during glyph processing - CVE-2017-5444: Buffer overflow while parsing application/http-index-format content The package is now following the ESR 52 branch: - Enable plugin support by default - service workers are disabled by default - push notifications are disabled by default - WebAssembly (wasm) is disabled - Less use of multiprocess architecture Electrolysis (e10s) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-509=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-509=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-52.1.0-57.6.1 MozillaFirefox-branding-upstream-52.1.0-57.6.1 MozillaFirefox-buildsymbols-52.1.0-57.6.1 MozillaFirefox-debuginfo-52.1.0-57.6.1 MozillaFirefox-debugsource-52.1.0-57.6.1 MozillaFirefox-devel-52.1.0-57.6.1 MozillaFirefox-translations-common-52.1.0-57.6.1 MozillaFirefox-translations-other-52.1.0-57.6.1 - openSUSE Leap 42.1 (x86_64): MozillaFirefox-52.1.0-61.1 MozillaFirefox-branding-upstream-52.1.0-61.1 MozillaFirefox-buildsymbols-52.1.0-61.1 MozillaFirefox-debuginfo-52.1.0-61.1 MozillaFirefox-debugsource-52.1.0-61.1 MozillaFirefox-devel-52.1.0-61.1 MozillaFirefox-translations-common-52.1.0-61.1 MozillaFirefox-translations-other-52.1.0-61.1 References: https://www.suse.com/security/cve/CVE-2017-5429.html https://www.suse.com/security/cve/CVE-2017-5443.html https://www.suse.com/security/cve/CVE-2017-5444.html https://www.suse.com/security/cve/CVE-2017-5446.html https://www.suse.com/security/cve/CVE-2017-5447.html https://www.suse.com/security/cve/CVE-2017-5448.html https://www.suse.com/security/cve/CVE-2017-5449.html https://www.suse.com/security/cve/CVE-2017-5460.html https://www.suse.com/security/cve/CVE-2017-5461.html https://www.suse.com/security/cve/CVE-2017-5464.html https://www.suse.com/security/cve/CVE-2017-5465.html https://www.suse.com/security/cve/CVE-2017-5466.html https://www.suse.com/security/cve/CVE-2017-5467.html https://bugzilla.suse.com/1035082

1 0

openSUSE-SU-2017:1098-1: important: Security update for chromium
by opensuse-security＠opensuse.org 24 Apr '17

24 Apr '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1098-1 Rating: important References: #1035103 Cross-References: CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update to Chromium 58.0.3029.81 fixes the following security issues (bsc#1035103): - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in Omnibox - CVE-2017-5062: Use after free in Chrome Apps - CVE-2017-5063: Heap overflow in Skia - CVE-2017-5064: Use after free in Blink - CVE-2017-5065: Incorrect UI in Blink - CVE-2017-5066: Incorrect signature handing in Networking - CVE-2017-5067: URL spoofing in Omnibox - CVE-2017-5069: Cross-origin bypass in Blink Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-508=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-508=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-58.0.3029.81-104.9.1 chromedriver-debuginfo-58.0.3029.81-104.9.1 chromium-58.0.3029.81-104.9.1 chromium-debuginfo-58.0.3029.81-104.9.1 chromium-debugsource-58.0.3029.81-104.9.1 - openSUSE Leap 42.1 (x86_64): chromedriver-58.0.3029.81-111.1 chromedriver-debuginfo-58.0.3029.81-111.1 chromium-58.0.3029.81-111.1 chromium-debuginfo-58.0.3029.81-111.1 chromium-debugsource-58.0.3029.81-111.1 References: https://www.suse.com/security/cve/CVE-2017-5057.html https://www.suse.com/security/cve/CVE-2017-5058.html https://www.suse.com/security/cve/CVE-2017-5059.html https://www.suse.com/security/cve/CVE-2017-5060.html https://www.suse.com/security/cve/CVE-2017-5061.html https://www.suse.com/security/cve/CVE-2017-5062.html https://www.suse.com/security/cve/CVE-2017-5063.html https://www.suse.com/security/cve/CVE-2017-5064.html https://www.suse.com/security/cve/CVE-2017-5065.html https://www.suse.com/security/cve/CVE-2017-5066.html https://www.suse.com/security/cve/CVE-2017-5067.html https://www.suse.com/security/cve/CVE-2017-5069.html https://bugzilla.suse.com/1035103

1 0

openSUSE-SU-2017:1088-1: moderate: Security update for mozilla-nss
by opensuse-security＠opensuse.org 21 Apr '17

21 Apr '17

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1088-1 Rating: moderate References: #1015499 #1030071 Cross-References: CVE-2016-9574 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Mozilla-nss was updated to 3.28.4 to fix the following issues: Security issues: * CVE-2016-9574: Allow use of session tickets when there is no ticket wrapping key (boo#1015499, bmo#1320695) Non security issues: * A rare crash when initializing an SSL socket fails has been fixed (bmo#1342358) * Rare crashes in the base 64 decoder and encoder were fixed (bmo#1344380) * A carry over bug in the RNG was fixed (bmo#1345089) * Fixed hash computation (boo#1030071, bmo#1348767) This update also contains a rebuild of java-1_8_0-openjdk as the java security provider is very closely tied to the mozilla nss API. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-504=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-504=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-10.2.1 java-1_8_0-openjdk-accessibility-1.8.0.121-10.2.1 java-1_8_0-openjdk-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-debugsource-1.8.0.121-10.2.1 java-1_8_0-openjdk-demo-1.8.0.121-10.2.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-devel-1.8.0.121-10.2.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-headless-1.8.0.121-10.2.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-src-1.8.0.121-10.2.1 libfreebl3-3.28.4-40.3.1 libfreebl3-debuginfo-3.28.4-40.3.1 libsoftokn3-3.28.4-40.3.1 libsoftokn3-debuginfo-3.28.4-40.3.1 mozilla-nss-3.28.4-40.3.1 mozilla-nss-certs-3.28.4-40.3.1 mozilla-nss-certs-debuginfo-3.28.4-40.3.1 mozilla-nss-debuginfo-3.28.4-40.3.1 mozilla-nss-debugsource-3.28.4-40.3.1 mozilla-nss-devel-3.28.4-40.3.1 mozilla-nss-sysinit-3.28.4-40.3.1 mozilla-nss-sysinit-debuginfo-3.28.4-40.3.1 mozilla-nss-tools-3.28.4-40.3.1 mozilla-nss-tools-debuginfo-3.28.4-40.3.1 - openSUSE Leap 42.2 (x86_64): libfreebl3-32bit-3.28.4-40.3.1 libfreebl3-debuginfo-32bit-3.28.4-40.3.1 libsoftokn3-32bit-3.28.4-40.3.1 libsoftokn3-debuginfo-32bit-3.28.4-40.3.1 mozilla-nss-32bit-3.28.4-40.3.1 mozilla-nss-certs-32bit-3.28.4-40.3.1 mozilla-nss-certs-debuginfo-32bit-3.28.4-40.3.1 mozilla-nss-debuginfo-32bit-3.28.4-40.3.1 mozilla-nss-sysinit-32bit-3.28.4-40.3.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.4-40.3.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-10.2.1 - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-25.1 java-1_8_0-openjdk-accessibility-1.8.0.121-25.1 java-1_8_0-openjdk-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-debugsource-1.8.0.121-25.1 java-1_8_0-openjdk-demo-1.8.0.121-25.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-devel-1.8.0.121-25.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-headless-1.8.0.121-25.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-src-1.8.0.121-25.1 libfreebl3-3.28.4-41.1 libfreebl3-debuginfo-3.28.4-41.1 libsoftokn3-3.28.4-41.1 libsoftokn3-debuginfo-3.28.4-41.1 mozilla-nss-3.28.4-41.1 mozilla-nss-certs-3.28.4-41.1 mozilla-nss-certs-debuginfo-3.28.4-41.1 mozilla-nss-debuginfo-3.28.4-41.1 mozilla-nss-debugsource-3.28.4-41.1 mozilla-nss-devel-3.28.4-41.1 mozilla-nss-sysinit-3.28.4-41.1 mozilla-nss-sysinit-debuginfo-3.28.4-41.1 mozilla-nss-tools-3.28.4-41.1 mozilla-nss-tools-debuginfo-3.28.4-41.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-25.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.28.4-41.1 libfreebl3-debuginfo-32bit-3.28.4-41.1 libsoftokn3-32bit-3.28.4-41.1 libsoftokn3-debuginfo-32bit-3.28.4-41.1 mozilla-nss-32bit-3.28.4-41.1 mozilla-nss-certs-32bit-3.28.4-41.1 mozilla-nss-certs-debuginfo-32bit-3.28.4-41.1 mozilla-nss-debuginfo-32bit-3.28.4-41.1 mozilla-nss-sysinit-32bit-3.28.4-41.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.4-41.1 References: https://www.suse.com/security/cve/CVE-2016-9574.html https://bugzilla.suse.com/1015499 https://bugzilla.suse.com/1030071

1 0

openSUSE-SU-2017:1087-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 21 Apr '17

21 Apr '17

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1087-1 Rating: moderate References: #1033936 #1033937 #1033938 #1033939 #1033940 #1033941 #1033942 #1033943 #1033944 #1033945 Cross-References: CVE-2017-7700 CVE-2017-7701 CVE-2017-7702 CVE-2017-7703 CVE-2017-7704 CVE-2017-7705 CVE-2017-7745 CVE-2017-7746 CVE-2017-7747 CVE-2017-7748 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update to Wireshark 2.2.6 fixes minor vulnerabilities that could be used to trigger a dissector crash or infinite loops by sending specially crafted packages over the network or into a capture file: * CVE-2017-7700: NetScaler file parser infinite loop (boo#1033936) * CVE-2017-7701: BGP dissector infinite loop (boo#1033937) * CVE-2017-7702: WBMXL dissector infinite loop (boo#1033938) * CVE-2017-7703: IMAP dissector crash (boo#1033939) * CVE-2017-7704: DOF dissector infinite loop (boo#1033940) * CVE-2017-7705: RPCoRDMA dissector infinite loop (boo#1033941) * CVE-2017-7745: SIGCOMP dissector infinite loop (boo#1033942) * CVE-2017-7746: SLSK dissector long loop (boo#1033943) * CVE-2017-7747: PacketBB dissector crash (boo#1033944) * CVE-2017-7748: WSP dissector infinite loop (boo#1033945) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-503=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): wireshark-2.2.6-14.3.1 wireshark-debuginfo-2.2.6-14.3.1 wireshark-debugsource-2.2.6-14.3.1 wireshark-devel-2.2.6-14.3.1 wireshark-ui-gtk-2.2.6-14.3.1 wireshark-ui-gtk-debuginfo-2.2.6-14.3.1 wireshark-ui-qt-2.2.6-14.3.1 wireshark-ui-qt-debuginfo-2.2.6-14.3.1 References: https://www.suse.com/security/cve/CVE-2017-7700.html https://www.suse.com/security/cve/CVE-2017-7701.html https://www.suse.com/security/cve/CVE-2017-7702.html https://www.suse.com/security/cve/CVE-2017-7703.html https://www.suse.com/security/cve/CVE-2017-7704.html https://www.suse.com/security/cve/CVE-2017-7705.html https://www.suse.com/security/cve/CVE-2017-7745.html https://www.suse.com/security/cve/CVE-2017-7746.html https://www.suse.com/security/cve/CVE-2017-7747.html https://www.suse.com/security/cve/CVE-2017-7748.html https://bugzilla.suse.com/1033936 https://bugzilla.suse.com/1033937 https://bugzilla.suse.com/1033938 https://bugzilla.suse.com/1033939 https://bugzilla.suse.com/1033940 https://bugzilla.suse.com/1033941 https://bugzilla.suse.com/1033942 https://bugzilla.suse.com/1033943 https://bugzilla.suse.com/1033944 https://bugzilla.suse.com/1033945

1 0