April 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:1100-1: important: Security update for chromium
by opensuse-security＠opensuse.org 24 Apr '17

24 Apr '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1100-1 Rating: important References: #1035103 Cross-References: CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update to Chromium 58.0.3029.81 fixes the following security issues (bsc#1035103): - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in Omnibox - CVE-2017-5062: Use after free in Chrome Apps - CVE-2017-5063: Heap overflow in Skia - CVE-2017-5064: Use after free in Blink - CVE-2017-5065: Incorrect UI in Blink - CVE-2017-5066: Incorrect signature handing in Networking - CVE-2017-5067: URL spoofing in Omnibox - CVE-2017-5069: Cross-origin bypass in Blink Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-508=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-58.0.3029.81-14.1 chromedriver-debuginfo-58.0.3029.81-14.1 chromium-58.0.3029.81-14.1 chromium-debuginfo-58.0.3029.81-14.1 chromium-debugsource-58.0.3029.81-14.1 References: https://www.suse.com/security/cve/CVE-2017-5057.html https://www.suse.com/security/cve/CVE-2017-5058.html https://www.suse.com/security/cve/CVE-2017-5059.html https://www.suse.com/security/cve/CVE-2017-5060.html https://www.suse.com/security/cve/CVE-2017-5061.html https://www.suse.com/security/cve/CVE-2017-5062.html https://www.suse.com/security/cve/CVE-2017-5063.html https://www.suse.com/security/cve/CVE-2017-5064.html https://www.suse.com/security/cve/CVE-2017-5065.html https://www.suse.com/security/cve/CVE-2017-5066.html https://www.suse.com/security/cve/CVE-2017-5067.html https://www.suse.com/security/cve/CVE-2017-5069.html https://bugzilla.suse.com/1035103

1 0

openSUSE-SU-2017:1099-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 24 Apr '17

24 Apr '17

openSUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1099-1 Rating: important References: #1035082 Cross-References: CVE-2017-5429 CVE-2017-5443 CVE-2017-5444 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5449 CVE-2017-5460 CVE-2017-5461 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: Mozilla Firefox was updated to Firefox 52.1.0esr. The following vulnerabilities were fixed (bsc#1035082): - CVE-2017-5443: Out-of-bounds write during BinHex decoding - CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 - CVE-2017-5464: Memory corruption with accessibility and DOM manipulation - CVE-2017-5465: Out-of-bounds read in ConvolvePixel - CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL - CVE-2017-5467: Memory corruption when drawing Skia content - CVE-2017-5460: Use-after-free in frame selection - CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS - CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor - CVE-2017-5449: Crash during bidirectional unicode manipulation with animation - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data - CVE-2017-5447: Out-of-bounds read during glyph processing - CVE-2017-5444: Buffer overflow while parsing application/http-index-format content The package is now following the ESR 52 branch: - Enable plugin support by default - service workers are disabled by default - push notifications are disabled by default - WebAssembly (wasm) is disabled - Less use of multiprocess architecture Electrolysis (e10s) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-509=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-509=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-52.1.0-57.6.1 MozillaFirefox-branding-upstream-52.1.0-57.6.1 MozillaFirefox-buildsymbols-52.1.0-57.6.1 MozillaFirefox-debuginfo-52.1.0-57.6.1 MozillaFirefox-debugsource-52.1.0-57.6.1 MozillaFirefox-devel-52.1.0-57.6.1 MozillaFirefox-translations-common-52.1.0-57.6.1 MozillaFirefox-translations-other-52.1.0-57.6.1 - openSUSE Leap 42.1 (x86_64): MozillaFirefox-52.1.0-61.1 MozillaFirefox-branding-upstream-52.1.0-61.1 MozillaFirefox-buildsymbols-52.1.0-61.1 MozillaFirefox-debuginfo-52.1.0-61.1 MozillaFirefox-debugsource-52.1.0-61.1 MozillaFirefox-devel-52.1.0-61.1 MozillaFirefox-translations-common-52.1.0-61.1 MozillaFirefox-translations-other-52.1.0-61.1 References: https://www.suse.com/security/cve/CVE-2017-5429.html https://www.suse.com/security/cve/CVE-2017-5443.html https://www.suse.com/security/cve/CVE-2017-5444.html https://www.suse.com/security/cve/CVE-2017-5446.html https://www.suse.com/security/cve/CVE-2017-5447.html https://www.suse.com/security/cve/CVE-2017-5448.html https://www.suse.com/security/cve/CVE-2017-5449.html https://www.suse.com/security/cve/CVE-2017-5460.html https://www.suse.com/security/cve/CVE-2017-5461.html https://www.suse.com/security/cve/CVE-2017-5464.html https://www.suse.com/security/cve/CVE-2017-5465.html https://www.suse.com/security/cve/CVE-2017-5466.html https://www.suse.com/security/cve/CVE-2017-5467.html https://bugzilla.suse.com/1035082

1 0

openSUSE-SU-2017:1098-1: important: Security update for chromium
by opensuse-security＠opensuse.org 24 Apr '17

24 Apr '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1098-1 Rating: important References: #1035103 Cross-References: CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: This update to Chromium 58.0.3029.81 fixes the following security issues (bsc#1035103): - CVE-2017-5057: Type confusion in PDFium - CVE-2017-5058: Heap use after free in Print Preview - CVE-2017-5059: Type confusion in Blink - CVE-2017-5060: URL spoofing in Omnibox - CVE-2017-5061: URL spoofing in Omnibox - CVE-2017-5062: Use after free in Chrome Apps - CVE-2017-5063: Heap overflow in Skia - CVE-2017-5064: Use after free in Blink - CVE-2017-5065: Incorrect UI in Blink - CVE-2017-5066: Incorrect signature handing in Networking - CVE-2017-5067: URL spoofing in Omnibox - CVE-2017-5069: Cross-origin bypass in Blink Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-508=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-508=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-58.0.3029.81-104.9.1 chromedriver-debuginfo-58.0.3029.81-104.9.1 chromium-58.0.3029.81-104.9.1 chromium-debuginfo-58.0.3029.81-104.9.1 chromium-debugsource-58.0.3029.81-104.9.1 - openSUSE Leap 42.1 (x86_64): chromedriver-58.0.3029.81-111.1 chromedriver-debuginfo-58.0.3029.81-111.1 chromium-58.0.3029.81-111.1 chromium-debuginfo-58.0.3029.81-111.1 chromium-debugsource-58.0.3029.81-111.1 References: https://www.suse.com/security/cve/CVE-2017-5057.html https://www.suse.com/security/cve/CVE-2017-5058.html https://www.suse.com/security/cve/CVE-2017-5059.html https://www.suse.com/security/cve/CVE-2017-5060.html https://www.suse.com/security/cve/CVE-2017-5061.html https://www.suse.com/security/cve/CVE-2017-5062.html https://www.suse.com/security/cve/CVE-2017-5063.html https://www.suse.com/security/cve/CVE-2017-5064.html https://www.suse.com/security/cve/CVE-2017-5065.html https://www.suse.com/security/cve/CVE-2017-5066.html https://www.suse.com/security/cve/CVE-2017-5067.html https://www.suse.com/security/cve/CVE-2017-5069.html https://bugzilla.suse.com/1035103

1 0

openSUSE-SU-2017:1088-1: moderate: Security update for mozilla-nss
by opensuse-security＠opensuse.org 21 Apr '17

21 Apr '17

openSUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1088-1 Rating: moderate References: #1015499 #1030071 Cross-References: CVE-2016-9574 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Mozilla-nss was updated to 3.28.4 to fix the following issues: Security issues: * CVE-2016-9574: Allow use of session tickets when there is no ticket wrapping key (boo#1015499, bmo#1320695) Non security issues: * A rare crash when initializing an SSL socket fails has been fixed (bmo#1342358) * Rare crashes in the base 64 decoder and encoder were fixed (bmo#1344380) * A carry over bug in the RNG was fixed (bmo#1345089) * Fixed hash computation (boo#1030071, bmo#1348767) This update also contains a rebuild of java-1_8_0-openjdk as the java security provider is very closely tied to the mozilla nss API. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-504=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-504=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-10.2.1 java-1_8_0-openjdk-accessibility-1.8.0.121-10.2.1 java-1_8_0-openjdk-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-debugsource-1.8.0.121-10.2.1 java-1_8_0-openjdk-demo-1.8.0.121-10.2.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-devel-1.8.0.121-10.2.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-headless-1.8.0.121-10.2.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-10.2.1 java-1_8_0-openjdk-src-1.8.0.121-10.2.1 libfreebl3-3.28.4-40.3.1 libfreebl3-debuginfo-3.28.4-40.3.1 libsoftokn3-3.28.4-40.3.1 libsoftokn3-debuginfo-3.28.4-40.3.1 mozilla-nss-3.28.4-40.3.1 mozilla-nss-certs-3.28.4-40.3.1 mozilla-nss-certs-debuginfo-3.28.4-40.3.1 mozilla-nss-debuginfo-3.28.4-40.3.1 mozilla-nss-debugsource-3.28.4-40.3.1 mozilla-nss-devel-3.28.4-40.3.1 mozilla-nss-sysinit-3.28.4-40.3.1 mozilla-nss-sysinit-debuginfo-3.28.4-40.3.1 mozilla-nss-tools-3.28.4-40.3.1 mozilla-nss-tools-debuginfo-3.28.4-40.3.1 - openSUSE Leap 42.2 (x86_64): libfreebl3-32bit-3.28.4-40.3.1 libfreebl3-debuginfo-32bit-3.28.4-40.3.1 libsoftokn3-32bit-3.28.4-40.3.1 libsoftokn3-debuginfo-32bit-3.28.4-40.3.1 mozilla-nss-32bit-3.28.4-40.3.1 mozilla-nss-certs-32bit-3.28.4-40.3.1 mozilla-nss-certs-debuginfo-32bit-3.28.4-40.3.1 mozilla-nss-debuginfo-32bit-3.28.4-40.3.1 mozilla-nss-sysinit-32bit-3.28.4-40.3.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.4-40.3.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-10.2.1 - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-25.1 java-1_8_0-openjdk-accessibility-1.8.0.121-25.1 java-1_8_0-openjdk-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-debugsource-1.8.0.121-25.1 java-1_8_0-openjdk-demo-1.8.0.121-25.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-devel-1.8.0.121-25.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-headless-1.8.0.121-25.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-25.1 java-1_8_0-openjdk-src-1.8.0.121-25.1 libfreebl3-3.28.4-41.1 libfreebl3-debuginfo-3.28.4-41.1 libsoftokn3-3.28.4-41.1 libsoftokn3-debuginfo-3.28.4-41.1 mozilla-nss-3.28.4-41.1 mozilla-nss-certs-3.28.4-41.1 mozilla-nss-certs-debuginfo-3.28.4-41.1 mozilla-nss-debuginfo-3.28.4-41.1 mozilla-nss-debugsource-3.28.4-41.1 mozilla-nss-devel-3.28.4-41.1 mozilla-nss-sysinit-3.28.4-41.1 mozilla-nss-sysinit-debuginfo-3.28.4-41.1 mozilla-nss-tools-3.28.4-41.1 mozilla-nss-tools-debuginfo-3.28.4-41.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-25.1 - openSUSE Leap 42.1 (x86_64): libfreebl3-32bit-3.28.4-41.1 libfreebl3-debuginfo-32bit-3.28.4-41.1 libsoftokn3-32bit-3.28.4-41.1 libsoftokn3-debuginfo-32bit-3.28.4-41.1 mozilla-nss-32bit-3.28.4-41.1 mozilla-nss-certs-32bit-3.28.4-41.1 mozilla-nss-certs-debuginfo-32bit-3.28.4-41.1 mozilla-nss-debuginfo-32bit-3.28.4-41.1 mozilla-nss-sysinit-32bit-3.28.4-41.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.4-41.1 References: https://www.suse.com/security/cve/CVE-2016-9574.html https://bugzilla.suse.com/1015499 https://bugzilla.suse.com/1030071

1 0

openSUSE-SU-2017:1087-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 21 Apr '17

21 Apr '17

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1087-1 Rating: moderate References: #1033936 #1033937 #1033938 #1033939 #1033940 #1033941 #1033942 #1033943 #1033944 #1033945 Cross-References: CVE-2017-7700 CVE-2017-7701 CVE-2017-7702 CVE-2017-7703 CVE-2017-7704 CVE-2017-7705 CVE-2017-7745 CVE-2017-7746 CVE-2017-7747 CVE-2017-7748 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update to Wireshark 2.2.6 fixes minor vulnerabilities that could be used to trigger a dissector crash or infinite loops by sending specially crafted packages over the network or into a capture file: * CVE-2017-7700: NetScaler file parser infinite loop (boo#1033936) * CVE-2017-7701: BGP dissector infinite loop (boo#1033937) * CVE-2017-7702: WBMXL dissector infinite loop (boo#1033938) * CVE-2017-7703: IMAP dissector crash (boo#1033939) * CVE-2017-7704: DOF dissector infinite loop (boo#1033940) * CVE-2017-7705: RPCoRDMA dissector infinite loop (boo#1033941) * CVE-2017-7745: SIGCOMP dissector infinite loop (boo#1033942) * CVE-2017-7746: SLSK dissector long loop (boo#1033943) * CVE-2017-7747: PacketBB dissector crash (boo#1033944) * CVE-2017-7748: WSP dissector infinite loop (boo#1033945) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-503=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): wireshark-2.2.6-14.3.1 wireshark-debuginfo-2.2.6-14.3.1 wireshark-debugsource-2.2.6-14.3.1 wireshark-devel-2.2.6-14.3.1 wireshark-ui-gtk-2.2.6-14.3.1 wireshark-ui-gtk-debuginfo-2.2.6-14.3.1 wireshark-ui-qt-2.2.6-14.3.1 wireshark-ui-qt-debuginfo-2.2.6-14.3.1 References: https://www.suse.com/security/cve/CVE-2017-7700.html https://www.suse.com/security/cve/CVE-2017-7701.html https://www.suse.com/security/cve/CVE-2017-7702.html https://www.suse.com/security/cve/CVE-2017-7703.html https://www.suse.com/security/cve/CVE-2017-7704.html https://www.suse.com/security/cve/CVE-2017-7705.html https://www.suse.com/security/cve/CVE-2017-7745.html https://www.suse.com/security/cve/CVE-2017-7746.html https://www.suse.com/security/cve/CVE-2017-7747.html https://www.suse.com/security/cve/CVE-2017-7748.html https://bugzilla.suse.com/1033936 https://bugzilla.suse.com/1033937 https://bugzilla.suse.com/1033938 https://bugzilla.suse.com/1033939 https://bugzilla.suse.com/1033940 https://bugzilla.suse.com/1033941 https://bugzilla.suse.com/1033942 https://bugzilla.suse.com/1033943 https://bugzilla.suse.com/1033944 https://bugzilla.suse.com/1033945

1 0

openSUSE-OU-2017:1086-1: Optional update adding google-compute-engine-init
by maintenance＠opensuse.org 21 Apr '17

21 Apr '17

openSUSE Optional Update: Optional update adding google-compute-engine-init ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:1086-1 Rating: low References: #1015829 #1016372 #1017395 #994943 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has four optional fixes can now be installed. Description: This update adds package google-compute-engine-init to the distribution. The google-compute-engine-init package provides the initialization code for instances in Google Compute Engine. It obsoletes packages gcimagebundle, google-daemon and google-startup-scripts. The code previously provided by gcimagebundle is not replaced. New image creation from running instances is accomplished using functionality from google-cloud-sdk or through the GCE web console. It contains the following tracked changes: - Scripts that are one-shot should not be marked as "stop_on_removal" as there is no process running. (bsc#1017395) - Add and improved support for alias IPs in the IP forwarding daemon. (bsc#1016372, bsc#1015829) - Fix startup script to run after network setup. - Provide a service to enable network interfaces on boot. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-505=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): google-compute-engine-init-20161212-3.1 google-startup-scripts-1.3.2-3.1 References: https://bugzilla.suse.com/1015829 https://bugzilla.suse.com/1016372 https://bugzilla.suse.com/1017395 https://bugzilla.suse.com/994943

1 0

openSUSE-OU-2017:1085-1: Optional update for python-azure-sdk
by maintenance＠opensuse.org 21 Apr '17

21 Apr '17

openSUSE Optional Update: Optional update for python-azure-sdk ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:1085-1 Rating: low References: #1014478 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update makes the Azure SDK available in the distribution. It is conatined in the package python-azure-sdk. The packages python-adal, python-msrest and python-msrestazure are added as dependencies. python-isodate was updated to 0.5.4 for some minor date parsing fixes. This update was imported from the SUSE:SLE-12:Update and SUSE:SLE-12-SP1:Update update projects. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-507=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-507=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): python-adal-0.4.3-2.1 python-azure-sdk-2.0.0-2.1 python-isodate-0.5.4-13.3.1 python-msrest-0.4.4-2.1 python-msrestazure-0.4.5-2.1 python-requests-oauthlib-0.7.0-2.3.1 - openSUSE Leap 42.1 (noarch): python-adal-0.4.3-2.1 python-azure-sdk-2.0.0-2.1 python-isodate-0.5.4-13.1 python-msrest-0.4.4-2.1 python-msrestazure-0.4.5-2.1 python-requests-oauthlib-0.7.0-2.1 References: https://bugzilla.suse.com/1014478

1 0

openSUSE-RU-2017:1084-1: important: Recommended update for multipath-tools
by maintenance＠opensuse.org 21 Apr '17

21 Apr '17

openSUSE Recommended Update: Recommended update for multipath-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1084-1 Rating: important References: #1004858 #1005255 #1005763 #1008691 #1011400 #1012910 #1019181 #1019798 #1027188 #1033541 #986838 #991432 #998893 #998906 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 14 recommended fixes can now be installed. Description: This update for multipath-tools provides the following fixes: - Fix check for new path states, preventing double increments. (bsc#1019798) - Do not select sysfs prioritizer for RDAC arrays. (bsc#1004858) - Do not cache 'access_state' sysfs attribute. (bsc#1004858) - Re-use existing alias from bindings file. (bsc#1005255) - Set DI_SERIAL in 'multipath -ll' output. (bsc#991432) - Add 'need_suspend' to _dm_flush_map. (bsc#986838) - Ignore '-i' if find_multipaths is set. (bsc#1012910) - Imply '-n' if find_multipaths is set. (bsc#1012910) - Use weaker 'force_reload' on startup. (bsc#998906, bsc#998893, bsc#1005763, bsc#1011400) - Update log messages for setup_feature. (bsc#998906, bsc#998893, bsc#1005763, bsc#1011400) - Update feature handling. (bsc#998906, bsc#998893, bsc#1005763, bsc#1011400) - Reload map if not known to udev. (bsc#998906, bsc#998893, bsc#1005763, bsc#1011400) - Differentiate ACT_NOTHING and ACT_IMPOSSIBLE. (bsc#998906, bsc#998893, bsc#1005763, bsc#1011400) - Trigger uevent if nothing done. (bsc#998906, bsc#998893, bsc#1005763, bsc#1011400) - Re-add 'Before: lvm2-activation-early.service' to multipathd.service. (bsc#1019181) - Sanitize how kpartx delete partitions. (bsc#1008691) - A segmentation fault in mpathpersist. (bsc#1027188) The following tracked regression fixes are included (not released for openSUSE): - regression that prevented kpartx from deleting partition mappings. (bsc#1033541) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-506=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kpartx-0.6.2+suse20170412.35e16a42-2.4.1 kpartx-debuginfo-0.6.2+suse20170412.35e16a42-2.4.1 multipath-tools-0.6.2+suse20170412.35e16a42-2.4.1 multipath-tools-debuginfo-0.6.2+suse20170412.35e16a42-2.4.1 multipath-tools-debugsource-0.6.2+suse20170412.35e16a42-2.4.1 multipath-tools-devel-0.6.2+suse20170412.35e16a42-2.4.1 References: https://bugzilla.suse.com/1004858 https://bugzilla.suse.com/1005255 https://bugzilla.suse.com/1005763 https://bugzilla.suse.com/1008691 https://bugzilla.suse.com/1011400 https://bugzilla.suse.com/1012910 https://bugzilla.suse.com/1019181 https://bugzilla.suse.com/1019798 https://bugzilla.suse.com/1027188 https://bugzilla.suse.com/1033541 https://bugzilla.suse.com/986838 https://bugzilla.suse.com/991432 https://bugzilla.suse.com/998893 https://bugzilla.suse.com/998906

1 0

openSUSE-SU-2017:1079-1: Security update for gstreamer-0_10-plugins-base
by opensuse-security＠opensuse.org 20 Apr '17

20 Apr '17

openSUSE Security Update: Security update for gstreamer-0_10-plugins-base ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1079-1 Rating: low References: #1024076 #1024079 Cross-References: CVE-2017-5837 CVE-2017-5844 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gstreamer-0_10-plugins-base fixes the following issues: - A crafted AVI file could have caused a floating point exception leading to DoS (bsc#1024076, CVE-2017-5837, bsc#1024079, CVE-2017-5844) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-502=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gstreamer-0_10-plugin-gnomevfs-0.10.36-17.1 gstreamer-0_10-plugin-gnomevfs-debuginfo-0.10.36-17.1 gstreamer-0_10-plugins-base-0.10.36-17.1 gstreamer-0_10-plugins-base-debuginfo-0.10.36-17.1 gstreamer-0_10-plugins-base-debugsource-0.10.36-17.1 gstreamer-0_10-plugins-base-devel-0.10.36-17.1 gstreamer-0_10-plugins-base-doc-0.10.36-17.1 libgstapp-0_10-0-0.10.36-17.1 libgstapp-0_10-0-debuginfo-0.10.36-17.1 libgstinterfaces-0_10-0-0.10.36-17.1 libgstinterfaces-0_10-0-debuginfo-0.10.36-17.1 typelib-1_0-GstApp-0_10-0.10.36-17.1 typelib-1_0-GstInterfaces-0_10-0.10.36-17.1 - openSUSE Leap 42.1 (noarch): gstreamer-0_10-plugins-base-lang-0.10.36-17.1 - openSUSE Leap 42.1 (x86_64): gstreamer-0_10-plugins-base-32bit-0.10.36-17.1 gstreamer-0_10-plugins-base-debuginfo-32bit-0.10.36-17.1 libgstapp-0_10-0-32bit-0.10.36-17.1 libgstapp-0_10-0-debuginfo-32bit-0.10.36-17.1 libgstinterfaces-0_10-0-32bit-0.10.36-17.1 libgstinterfaces-0_10-0-debuginfo-32bit-0.10.36-17.1 References: https://www.suse.com/security/cve/CVE-2017-5837.html https://www.suse.com/security/cve/CVE-2017-5844.html https://bugzilla.suse.com/1024076 https://bugzilla.suse.com/1024079

1 0

openSUSE-SU-2017:1078-1: important: Security update for xen
by opensuse-security＠opensuse.org 20 Apr '17

20 Apr '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1078-1 Rating: important References: #1014136 #1015348 #1022555 #1026236 #1027519 #1028235 #1029128 #1029827 #1030144 #1030442 Cross-References: CVE-2017-6505 CVE-2017-7228 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 8 fixes is now available. Description: This update for xen to version 4.7.2 fixes the following issues: These security issues were fixed: - CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442). - XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144). - CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235). These non-security issues were fixed: - bsc#1015348: libvirtd didn't not start during boot - bsc#1014136: kdump couldn't dump a kernel on SLES12-SP2 with Xen hypervisor. - bsc#1026236: Fixed paravirtualized performance - bsc#1022555: Timeout in "execution of /etc/xen/scripts/block add" - bsc#1029827: Forward port xenstored - bsc#1029128: Make xen to really produce xen.efi with gcc48 This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-492=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xen-debugsource-4.7.2_02-11.3.1 xen-devel-4.7.2_02-11.3.1 xen-libs-4.7.2_02-11.3.1 xen-libs-debuginfo-4.7.2_02-11.3.1 xen-tools-domU-4.7.2_02-11.3.1 xen-tools-domU-debuginfo-4.7.2_02-11.3.1 - openSUSE Leap 42.2 (x86_64): xen-4.7.2_02-11.3.1 xen-doc-html-4.7.2_02-11.3.1 xen-libs-32bit-4.7.2_02-11.3.1 xen-libs-debuginfo-32bit-4.7.2_02-11.3.1 xen-tools-4.7.2_02-11.3.1 xen-tools-debuginfo-4.7.2_02-11.3.1 References: https://www.suse.com/security/cve/CVE-2017-6505.html https://www.suse.com/security/cve/CVE-2017-7228.html https://bugzilla.suse.com/1014136 https://bugzilla.suse.com/1015348 https://bugzilla.suse.com/1022555 https://bugzilla.suse.com/1026236 https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1028235 https://bugzilla.suse.com/1029128 https://bugzilla.suse.com/1029827 https://bugzilla.suse.com/1030144 https://bugzilla.suse.com/1030442

1 0