April 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1115-1: Recommended update for ruby-common, rubygem-gem2rpm
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for ruby-common, rubygem-gem2rpm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1115-1 Rating: low References: #963710 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ruby-common, rubygem-gem2rpm fixes the following issues: ruby-common: - Since rubygems 2.5.0 the default version in the gem bin stub changed from '>= 0' to '>= 0.a'. This was done to allow pre-release versions. Our patching script didn't take the '.a' into account and generated version fields like '= 0.10.1.a' instead of the expected '= 0.10.1'. This fix accounts for the '.a'. Changes in rubygem-gem2rpm: - Fix 'gem2rpm --fetch': prefer https for accessing rubygems.org. (bsc#963710) - Add support for Ruby 2.3.0 and 2.4.0. - Add :post_patch hook to run commands before we rebuild the gem used by libv8. - Add support for rubinius 2.5 and remove support for 2.2. - No longer require the Ruby version inside the sub-package. With BuildRequires we already make sure that the package is only built if we find a recent enough ABI. Then the normal $interpreter(abi) requires generated by rpm is enough. - Move to new packaging templates by default. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-519=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-519=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ruby2.1-rubygem-gem2rpm-0.10.1-5.3.1 ruby2.1-rubygem-gem2rpm-doc-0.10.1-5.3.1 - openSUSE Leap 42.2 (noarch): ruby-common-2.1-6.3.1 - openSUSE Leap 42.1 (i586 x86_64): ruby2.1-rubygem-gem2rpm-0.10.1-5.1 ruby2.1-rubygem-gem2rpm-doc-0.10.1-5.1 - openSUSE Leap 42.1 (noarch): ruby-common-2.1-8.1 References: https://bugzilla.suse.com/963710

1 0

openSUSE-RU-2017:1114-1: Recommended update for tomcat
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1114-1 Rating: low References: #1022034 #1023412 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tomcat provides the following fixes: - Fix file conflicts when upgrading from SLES 12 to SLES 12 SP1 (bsc#1023412) - Fix jasper init failure with SecurityManager (bsc#1022034) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-523=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): tomcat-8.0.36-6.3.1 tomcat-admin-webapps-8.0.36-6.3.1 tomcat-docs-webapp-8.0.36-6.3.1 tomcat-el-3_0-api-8.0.36-6.3.1 tomcat-embed-8.0.36-6.3.1 tomcat-javadoc-8.0.36-6.3.1 tomcat-jsp-2_3-api-8.0.36-6.3.1 tomcat-jsvc-8.0.36-6.3.1 tomcat-lib-8.0.36-6.3.1 tomcat-servlet-3_1-api-8.0.36-6.3.1 tomcat-webapps-8.0.36-6.3.1 References: https://bugzilla.suse.com/1022034 https://bugzilla.suse.com/1023412

1 0

openSUSE-RU-2017:1113-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1113-1 Rating: moderate References: #1009710 #1017070 #1024836 #983938 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for sssd fixes the following issues: - Resolve a performance regression in user login and fix several memory leaks. (bsc#1017070) - Introduce mandatory runtime requirement "cyrus-sasl-gssapi" to krb5-common sub-package. (bsc#1024836) - In addition to sudoRunAsUser and sudoRunAsGroup, fetch also sudoRunAs attribute from LDAP to be compatible with older versions of sudo. (bsc#1009710) - Remove invalid definition "After=syslog.target" from systemd service file. (bsc#983938) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-520=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libipa_hbac-devel-1.11.5.1-19.1 libipa_hbac0-1.11.5.1-19.1 libipa_hbac0-debuginfo-1.11.5.1-19.1 libsss_idmap-devel-1.11.5.1-19.1 libsss_idmap0-1.11.5.1-19.1 libsss_idmap0-debuginfo-1.11.5.1-19.1 libsss_nss_idmap-devel-1.11.5.1-19.1 libsss_nss_idmap0-1.11.5.1-19.1 libsss_nss_idmap0-debuginfo-1.11.5.1-19.1 libsss_sudo-1.11.5.1-19.1 libsss_sudo-debuginfo-1.11.5.1-19.1 python-ipa_hbac-1.11.5.1-19.1 python-ipa_hbac-debuginfo-1.11.5.1-19.1 python-sss_nss_idmap-1.11.5.1-19.1 python-sss_nss_idmap-debuginfo-1.11.5.1-19.1 python-sssd-config-1.11.5.1-19.1 python-sssd-config-debuginfo-1.11.5.1-19.1 sssd-1.11.5.1-19.1 sssd-ad-1.11.5.1-19.1 sssd-ad-debuginfo-1.11.5.1-19.1 sssd-debuginfo-1.11.5.1-19.1 sssd-debugsource-1.11.5.1-19.1 sssd-ipa-1.11.5.1-19.1 sssd-ipa-debuginfo-1.11.5.1-19.1 sssd-krb5-1.11.5.1-19.1 sssd-krb5-common-1.11.5.1-19.1 sssd-krb5-common-debuginfo-1.11.5.1-19.1 sssd-krb5-debuginfo-1.11.5.1-19.1 sssd-ldap-1.11.5.1-19.1 sssd-ldap-debuginfo-1.11.5.1-19.1 sssd-proxy-1.11.5.1-19.1 sssd-proxy-debuginfo-1.11.5.1-19.1 sssd-tools-1.11.5.1-19.1 sssd-tools-debuginfo-1.11.5.1-19.1 - openSUSE Leap 42.1 (x86_64): sssd-32bit-1.11.5.1-19.1 sssd-debuginfo-32bit-1.11.5.1-19.1 References: https://bugzilla.suse.com/1009710 https://bugzilla.suse.com/1017070 https://bugzilla.suse.com/1024836 https://bugzilla.suse.com/983938

1 0

openSUSE-RU-2017:1112-1: moderate: Recommended update for libtool
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for libtool ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1112-1 Rating: moderate References: #1010802 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libtool prevents a segmentation fault caused by insufficient error handling on out-of-memory situations. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-517=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-517=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libltdl7-2.4.2-18.3.1 libltdl7-debuginfo-2.4.2-18.3.1 libtool-2.4.2-18.3.1 libtool-debugsource-2.4.2-18.3.1 - openSUSE Leap 42.2 (x86_64): libltdl7-32bit-2.4.2-18.3.1 libltdl7-debuginfo-32bit-2.4.2-18.3.1 libtool-32bit-2.4.2-18.3.1 - openSUSE Leap 42.1 (i586 x86_64): libltdl7-2.4.2-18.1 libltdl7-debuginfo-2.4.2-18.1 libtool-2.4.2-18.1 libtool-debugsource-2.4.2-18.1 - openSUSE Leap 42.1 (x86_64): libltdl7-32bit-2.4.2-18.1 libltdl7-debuginfo-32bit-2.4.2-18.1 libtool-32bit-2.4.2-18.1 References: https://bugzilla.suse.com/1010802

1 0

openSUSE-RU-2017:1111-1: Recommended update for python-kiwi
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1111-1 Rating: low References: #1030038 #1032118 #1032119 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update provides python-kiwi 8.30.1, which provides the following fixes: - Fix PXE builder. Filesystem image rootfs was not in toplevel. - Refactor ip link detection. There is no reliable way to check if a link is unplugged, thus the system has to be changed. - Ensure grub.cfg exists in EFI path for iso images. - Delete no longer needed btrfs bootpath setup. (bsc#1030038) - Fix bootloader menu title setup. (bsc#1032118) - Avoid GRUB_DISTRIBUTOR setup in etc/default/grub. (bsc#1032119) - Added "oem-nic-filter" element. - Fix grub2 setup and tool calls. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-516=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kiwi-boot-requires-8.30.1-5.1 kiwi-man-pages-8.30.1-5.1 kiwi-pxeboot-8.30.1-5.1 kiwi-tools-8.30.1-5.1 kiwi-tools-debuginfo-8.30.1-5.1 python-kiwi-debugsource-8.30.1-5.1 python2-kiwi-8.30.1-5.1 python3-kiwi-8.30.1-5.1 References: https://bugzilla.suse.com/1030038 https://bugzilla.suse.com/1032118 https://bugzilla.suse.com/1032119

1 0

openSUSE-SU-2017:1108-1: important: Security update for tiff
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1108-1 Rating: important References: #1031247 #1031249 #1031250 #1031254 #1031255 #1031262 #1031263 Cross-References: CVE-2016-10266 CVE-2016-10267 CVE-2016-10268 CVE-2016-10269 CVE-2016-10270 CVE-2016-10271 CVE-2016-10272 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for tiff fixes the following issues: Security issues fixed: - CVE-2016-10272: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "WRITE of size 2048" and libtiff/tif_next.c:64:9 (bsc#1031247). - CVE-2016-10271: tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read and buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 1" and libtiff/tif_fax3.c:413:13 (bsc#1031249). - CVE-2016-10270: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22 (bsc#1031250). - CVE-2016-10269: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2 (bsc#1031254). - CVE-2016-10268: tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23 (bsc#1031255). - CVE-2016-10267: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8 (bsc#1031262). - CVE-2016-10266: LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22. (bsc#1031263). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-515=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-515=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libtiff-devel-4.0.7-17.3.1 libtiff5-4.0.7-17.3.1 libtiff5-debuginfo-4.0.7-17.3.1 tiff-4.0.7-17.3.1 tiff-debuginfo-4.0.7-17.3.1 tiff-debugsource-4.0.7-17.3.1 - openSUSE Leap 42.2 (x86_64): libtiff-devel-32bit-4.0.7-17.3.1 libtiff5-32bit-4.0.7-17.3.1 libtiff5-debuginfo-32bit-4.0.7-17.3.1 - openSUSE Leap 42.1 (i586 x86_64): libtiff-devel-4.0.7-18.1 libtiff5-4.0.7-18.1 libtiff5-debuginfo-4.0.7-18.1 tiff-4.0.7-18.1 tiff-debuginfo-4.0.7-18.1 tiff-debugsource-4.0.7-18.1 - openSUSE Leap 42.1 (x86_64): libtiff-devel-32bit-4.0.7-18.1 libtiff5-32bit-4.0.7-18.1 libtiff5-debuginfo-32bit-4.0.7-18.1 References: https://www.suse.com/security/cve/CVE-2016-10266.html https://www.suse.com/security/cve/CVE-2016-10267.html https://www.suse.com/security/cve/CVE-2016-10268.html https://www.suse.com/security/cve/CVE-2016-10269.html https://www.suse.com/security/cve/CVE-2016-10270.html https://www.suse.com/security/cve/CVE-2016-10271.html https://www.suse.com/security/cve/CVE-2016-10272.html https://bugzilla.suse.com/1031247 https://bugzilla.suse.com/1031249 https://bugzilla.suse.com/1031250 https://bugzilla.suse.com/1031254 https://bugzilla.suse.com/1031255 https://bugzilla.suse.com/1031262 https://bugzilla.suse.com/1031263

1 0

openSUSE-SU-2017:1107-1: moderate: Security update for libsndfile
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for libsndfile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1107-1 Rating: moderate References: #1033053 #1033054 #1033914 #1033915 Cross-References: CVE-2017-7585 CVE-2017-7586 CVE-2017-7741 CVE-2017-7742 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for libsndfile fixes the following security issues: - CVE-2017-7586: A stack-based buffer overflow via a specially crafted FLAC file was fixed (error in the "header_read()" function) (bsc#1033053) - CVE-2017-7585,CVE-2017-7741, CVE-2017-7742: Several stack-based buffer overflows via a specially crafted FLAC file (error in the "flac_buffer_copy()" function) were fixed (bsc#1033054,bsc#1033915,bsc#1033914). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-514=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-514=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsndfile-debugsource-1.0.25-26.3.1 libsndfile-devel-1.0.25-26.3.1 libsndfile-progs-1.0.25-26.3.1 libsndfile-progs-debuginfo-1.0.25-26.3.1 libsndfile-progs-debugsource-1.0.25-26.3.1 libsndfile1-1.0.25-26.3.1 libsndfile1-debuginfo-1.0.25-26.3.1 - openSUSE Leap 42.2 (x86_64): libsndfile1-32bit-1.0.25-26.3.1 libsndfile1-debuginfo-32bit-1.0.25-26.3.1 - openSUSE Leap 42.1 (i586 x86_64): libsndfile-debugsource-1.0.25-27.1 libsndfile-devel-1.0.25-27.1 libsndfile-progs-1.0.25-27.1 libsndfile-progs-debuginfo-1.0.25-27.1 libsndfile-progs-debugsource-1.0.25-27.1 libsndfile1-1.0.25-27.1 libsndfile1-debuginfo-1.0.25-27.1 - openSUSE Leap 42.1 (x86_64): libsndfile1-32bit-1.0.25-27.1 libsndfile1-debuginfo-32bit-1.0.25-27.1 References: https://www.suse.com/security/cve/CVE-2017-7585.html https://www.suse.com/security/cve/CVE-2017-7586.html https://www.suse.com/security/cve/CVE-2017-7741.html https://www.suse.com/security/cve/CVE-2017-7742.html https://bugzilla.suse.com/1033053 https://bugzilla.suse.com/1033054 https://bugzilla.suse.com/1033914 https://bugzilla.suse.com/1033915

1 0

openSUSE-SU-2017:1106-1: Security update for gstreamer-plugins-base
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for gstreamer-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1106-1 Rating: low References: #1024041 #1024047 #1024076 #1024079 Cross-References: CVE-2017-5837 CVE-2017-5839 CVE-2017-5842 CVE-2017-5844 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for gstreamer-plugins-base fixes the following security issues: - A crafted AVI file could have caused a floating point exception leading to DoS (bsc#1024076, CVE-2017-5837, bsc#1024079, CVE-2017-5844) - A crafted AVI file could have caused a stack overflow leading to DoS (bsc#1024047, CVE-2017-5839) - A crafted SAMI subtitle file could have caused an invalid memory access possibly leading to DoS or corruption (bsc#1024041, CVE-2017-5842) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-512=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gstreamer-plugins-base-1.8.3-5.3.2 gstreamer-plugins-base-debuginfo-1.8.3-5.3.2 gstreamer-plugins-base-debugsource-1.8.3-5.3.2 gstreamer-plugins-base-devel-1.8.3-5.3.2 gstreamer-plugins-base-doc-1.8.3-5.3.2 libgstallocators-1_0-0-1.8.3-5.3.2 libgstallocators-1_0-0-debuginfo-1.8.3-5.3.2 libgstapp-1_0-0-1.8.3-5.3.2 libgstapp-1_0-0-debuginfo-1.8.3-5.3.2 libgstaudio-1_0-0-1.8.3-5.3.2 libgstaudio-1_0-0-debuginfo-1.8.3-5.3.2 libgstfft-1_0-0-1.8.3-5.3.2 libgstfft-1_0-0-debuginfo-1.8.3-5.3.2 libgstpbutils-1_0-0-1.8.3-5.3.2 libgstpbutils-1_0-0-debuginfo-1.8.3-5.3.2 libgstriff-1_0-0-1.8.3-5.3.2 libgstriff-1_0-0-debuginfo-1.8.3-5.3.2 libgstrtp-1_0-0-1.8.3-5.3.2 libgstrtp-1_0-0-debuginfo-1.8.3-5.3.2 libgstrtsp-1_0-0-1.8.3-5.3.2 libgstrtsp-1_0-0-debuginfo-1.8.3-5.3.2 libgstsdp-1_0-0-1.8.3-5.3.2 libgstsdp-1_0-0-debuginfo-1.8.3-5.3.2 libgsttag-1_0-0-1.8.3-5.3.2 libgsttag-1_0-0-debuginfo-1.8.3-5.3.2 libgstvideo-1_0-0-1.8.3-5.3.2 libgstvideo-1_0-0-debuginfo-1.8.3-5.3.2 typelib-1_0-GstAllocators-1_0-1.8.3-5.3.2 typelib-1_0-GstApp-1_0-1.8.3-5.3.2 typelib-1_0-GstAudio-1_0-1.8.3-5.3.2 typelib-1_0-GstFft-1_0-1.8.3-5.3.2 typelib-1_0-GstPbutils-1_0-1.8.3-5.3.2 typelib-1_0-GstRtp-1_0-1.8.3-5.3.2 typelib-1_0-GstRtsp-1_0-1.8.3-5.3.2 typelib-1_0-GstSdp-1_0-1.8.3-5.3.2 typelib-1_0-GstTag-1_0-1.8.3-5.3.2 typelib-1_0-GstVideo-1_0-1.8.3-5.3.2 - openSUSE Leap 42.2 (noarch): gstreamer-plugins-base-lang-1.8.3-5.3.2 - openSUSE Leap 42.2 (x86_64): gstreamer-plugins-base-32bit-1.8.3-5.3.2 gstreamer-plugins-base-debuginfo-32bit-1.8.3-5.3.2 gstreamer-plugins-base-devel-32bit-1.8.3-5.3.2 libgstallocators-1_0-0-32bit-1.8.3-5.3.2 libgstallocators-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstapp-1_0-0-32bit-1.8.3-5.3.2 libgstapp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstaudio-1_0-0-32bit-1.8.3-5.3.2 libgstaudio-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstfft-1_0-0-32bit-1.8.3-5.3.2 libgstfft-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstpbutils-1_0-0-32bit-1.8.3-5.3.2 libgstpbutils-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstriff-1_0-0-32bit-1.8.3-5.3.2 libgstriff-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstrtp-1_0-0-32bit-1.8.3-5.3.2 libgstrtp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstrtsp-1_0-0-32bit-1.8.3-5.3.2 libgstrtsp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstsdp-1_0-0-32bit-1.8.3-5.3.2 libgstsdp-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgsttag-1_0-0-32bit-1.8.3-5.3.2 libgsttag-1_0-0-debuginfo-32bit-1.8.3-5.3.2 libgstvideo-1_0-0-32bit-1.8.3-5.3.2 libgstvideo-1_0-0-debuginfo-32bit-1.8.3-5.3.2 References: https://www.suse.com/security/cve/CVE-2017-5837.html https://www.suse.com/security/cve/CVE-2017-5839.html https://www.suse.com/security/cve/CVE-2017-5842.html https://www.suse.com/security/cve/CVE-2017-5844.html https://bugzilla.suse.com/1024041 https://bugzilla.suse.com/1024047 https://bugzilla.suse.com/1024076 https://bugzilla.suse.com/1024079

1 0

openSUSE-SU-2017:1105-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1105-1 Rating: moderate References: #1015332 #1027712 #1032309 Cross-References: CVE-2016-9586 CVE-2017-7407 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for curl fixes the following issues: Security issue fixed: - CVE-2016-9586: libcurl printf floating point buffer overflow (bsc#1015332) - CVE-2017-7407: The ourWriteOut function in tool_writeout.c in curl might have allowed physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which lead to a heap-based buffer over-read (bsc#1032309). With this release new default ciphers are active (SUSE_DEFAULT, bsc#1027712). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-513=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-513=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): curl-7.37.0-16.3.1 curl-debuginfo-7.37.0-16.3.1 curl-debugsource-7.37.0-16.3.1 libcurl-devel-7.37.0-16.3.1 libcurl4-7.37.0-16.3.1 libcurl4-debuginfo-7.37.0-16.3.1 - openSUSE Leap 42.2 (x86_64): libcurl-devel-32bit-7.37.0-16.3.1 libcurl4-32bit-7.37.0-16.3.1 libcurl4-debuginfo-32bit-7.37.0-16.3.1 - openSUSE Leap 42.1 (i586 x86_64): curl-7.37.0-19.1 curl-debuginfo-7.37.0-19.1 curl-debugsource-7.37.0-19.1 libcurl-devel-7.37.0-19.1 libcurl4-7.37.0-19.1 libcurl4-debuginfo-7.37.0-19.1 - openSUSE Leap 42.1 (x86_64): libcurl-devel-32bit-7.37.0-19.1 libcurl4-32bit-7.37.0-19.1 libcurl4-debuginfo-32bit-7.37.0-19.1 References: https://www.suse.com/security/cve/CVE-2016-9586.html https://www.suse.com/security/cve/CVE-2017-7407.html https://bugzilla.suse.com/1015332 https://bugzilla.suse.com/1027712 https://bugzilla.suse.com/1032309

1 0

openSUSE-RU-2017:1104-1: Recommended update for clamav-database
by maintenance＠opensuse.org 26 Apr '17

26 Apr '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1104-1 Rating: low References: Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh April 23rd 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-510=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-510=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201704240006-54.18.1 - openSUSE Leap 42.1 (noarch): clamav-database-201704240006-249.1 References:

1 0