May 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1202-1: Recommended update for yast2-services-manager
by maintenance＠opensuse.org 08 May '17

08 May '17

openSUSE Recommended Update: Recommended update for yast2-services-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1202-1 Rating: low References: #1012047 #1017166 #956043 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for yast2-services-manager provides the following fixes: - Use systemctl calls (is-active, is-enabled) to evaluate if the service is enabled/active. (bsc#1017166, bsc#1012047) - Filter out all YaST services which should e.g. not be restarted while installation. (bsc#956043) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-548=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): yast2-services-manager-3.1.44-20.3.1 References: https://bugzilla.suse.com/1012047 https://bugzilla.suse.com/1017166 https://bugzilla.suse.com/956043

1 0

openSUSE-SU-2017:1201-1: Security update for quagga
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1201-1 Rating: low References: #1021669 Cross-References: CVE-2017-5495 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following issues: This security issue was fixed: - CVE-2017-5495: Quagga was vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication (bsc#1021669). These non-security issues were fixed: - Disabled passwords in default zebra.conf config file, causing to disable vty telnet interface by default. The vty interface is available via "vtysh" utility using pam authentication to permit management access for root without password (boo#1021669). - Changed owner of /etc/quagga to quagga:quagga to permit to manage quagga via vty interface. - Added quagga.log and create and su statemets to logrotate config, changed default zebra log file name from quagga.log to zebra.log. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-547=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quagga-0.99.24.1-17.1 quagga-debuginfo-0.99.24.1-17.1 quagga-debugsource-0.99.24.1-17.1 quagga-devel-0.99.24.1-17.1 References: https://www.suse.com/security/cve/CVE-2017-5495.html https://bugzilla.suse.com/1021669

1 0

openSUSE-RU-2017:1200-1: Recommended update for machinery
by maintenance＠opensuse.org 08 May '17

08 May '17

openSUSE Recommended Update: Recommended update for machinery ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1200-1 Rating: low References: #1004697 #1009774 #1035727 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for machinery provides version 1.22.2 and brings the following fixes and improvements: - Prevent machinery-helper from crashing when files are inaccessible during inspection. (bsc#1009774) - Fix analyze of changed-config-files when NFS or SMB repositories are used. - Do not add repositories which require registration to built images. (bsc#1004697) - Fix package inspection on older Debian systems. - Fix extraction of information for Debian packages containing a dash in their name. - Only use sudo for reading files when necessary. - Gracefully handle RequireTTY enabled sudo configs. - Add rsync requirement check for remote system. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-553=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-553=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): machinery-1.22.2-2.3.2 machinery-debuginfo-1.22.2-2.3.2 machinery-debugsource-1.22.2-2.3.2 machinery-doc-1.22.2-2.3.2 - openSUSE Leap 42.1 (i586 x86_64): machinery-1.22.2-15.2 machinery-debuginfo-1.22.2-15.2 machinery-debugsource-1.22.2-15.2 machinery-doc-1.22.2-15.2 References: https://bugzilla.suse.com/1004697 https://bugzilla.suse.com/1009774 https://bugzilla.suse.com/1035727

1 0

openSUSE-SU-2017:1199-1: moderate: Security update for tcpdump, libpcap
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for tcpdump, libpcap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1199-1 Rating: moderate References: #1020940 #1035686 #905870 #905871 #905872 #922220 #922221 #922222 #922223 #927637 Cross-References: CVE-2014-8767 CVE-2014-8768 CVE-2014-8769 CVE-2015-0261 CVE-2015-2153 CVE-2015-2154 CVE-2015-2155 CVE-2015-3138 CVE-2016-7922 CVE-2016-7923 CVE-2016-7924 CVE-2016-7925 CVE-2016-7926 CVE-2016-7927 CVE-2016-7928 CVE-2016-7929 CVE-2016-7930 CVE-2016-7931 CVE-2016-7932 CVE-2016-7933 CVE-2016-7934 CVE-2016-7935 CVE-2016-7936 CVE-2016-7937 CVE-2016-7938 CVE-2016-7939 CVE-2016-7940 CVE-2016-7973 CVE-2016-7974 CVE-2016-7975 CVE-2016-7983 CVE-2016-7984 CVE-2016-7985 CVE-2016-7986 CVE-2016-7992 CVE-2016-7993 CVE-2016-8574 CVE-2016-8575 CVE-2017-5202 CVE-2017-5203 CVE-2017-5204 CVE-2017-5205 CVE-2017-5341 CVE-2017-5342 CVE-2017-5482 CVE-2017-5483 CVE-2017-5484 CVE-2017-5485 CVE-2017-5486 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 49 vulnerabilities is now available. Description: This update for tcpdump to version 4.9.0 and libpcap to version 1.8.1 fixes the several issues. These security issues were fixed in tcpdump: - CVE-2016-7922: The AH parser in tcpdump had a buffer overflow in print-ah.c:ah_print() (bsc#1020940). - CVE-2016-7923: The ARP parser in tcpdump had a buffer overflow in print-arp.c:arp_print() (bsc#1020940). - CVE-2016-7924: The ATM parser in tcpdump had a buffer overflow in print-atm.c:oam_print() (bsc#1020940). - CVE-2016-7925: The compressed SLIP parser in tcpdump had a buffer overflow in print-sl.c:sl_if_print() (bsc#1020940). - CVE-2016-7926: The Ethernet parser in tcpdump had a buffer overflow in print-ether.c:ethertype_print() (bsc#1020940). - CVE-2016-7927: The IEEE 802.11 parser in tcpdump had a buffer overflow in print-802_11.c:ieee802_11_radio_print() (bsc#1020940). - CVE-2016-7928: The IPComp parser in tcpdump had a buffer overflow in print-ipcomp.c:ipcomp_print() (bsc#1020940). - CVE-2016-7929: The Juniper PPPoE ATM parser in tcpdump had a buffer overflow in print-juniper.c:juniper_parse_header() (bsc#1020940). - CVE-2016-7930: The LLC/SNAP parser in tcpdump had a buffer overflow in print-llc.c:llc_print() (bsc#1020940). - CVE-2016-7931: The MPLS parser in tcpdump had a buffer overflow in print-mpls.c:mpls_print() (bsc#1020940). - CVE-2016-7932: The PIM parser in tcpdump had a buffer overflow in print-pim.c:pimv2_check_checksum() (bsc#1020940). - CVE-2016-7933: The PPP parser in tcpdump had a buffer overflow in print-ppp.c:ppp_hdlc_if_print() (bsc#1020940). - CVE-2016-7934: The RTCP parser in tcpdump had a buffer overflow in print-udp.c:rtcp_print() (bsc#1020940). - CVE-2016-7935: The RTP parser in tcpdump had a buffer overflow in print-udp.c:rtp_print() (bsc#1020940). - CVE-2016-7936: The UDP parser in tcpdump had a buffer overflow in print-udp.c:udp_print() (bsc#1020940). - CVE-2016-7937: The VAT parser in tcpdump had a buffer overflow in print-udp.c:vat_print() (bsc#1020940). - CVE-2016-7938: The ZeroMQ parser in tcpdump had an integer overflow in print-zeromq.c:zmtp1_print_frame() (bsc#1020940). - CVE-2016-7939: The GRE parser in tcpdump had a buffer overflow in print-gre.c, multiple functions (bsc#1020940). - CVE-2016-7940: The STP parser in tcpdump had a buffer overflow in print-stp.c, multiple functions (bsc#1020940). - CVE-2016-7973: The AppleTalk parser in tcpdump had a buffer overflow in print-atalk.c, multiple functions (bsc#1020940). - CVE-2016-7974: The IP parser in tcpdump had a buffer overflow in print-ip.c, multiple functions (bsc#1020940). - CVE-2016-7975: The TCP parser in tcpdump had a buffer overflow in print-tcp.c:tcp_print() (bsc#1020940). - CVE-2016-7983: The BOOTP parser in tcpdump had a buffer overflow in print-bootp.c:bootp_print() (bsc#1020940). - CVE-2016-7984: The TFTP parser in tcpdump had a buffer overflow in print-tftp.c:tftp_print() (bsc#1020940). - CVE-2016-7985: The CALM FAST parser in tcpdump had a buffer overflow in print-calm-fast.c:calm_fast_print() (bsc#1020940). - CVE-2016-7986: The GeoNetworking parser in tcpdump had a buffer overflow in print-geonet.c, multiple functions (bsc#1020940). - CVE-2016-7992: The Classical IP over ATM parser in tcpdump had a buffer overflow in print-cip.c:cip_if_print() (bsc#1020940). - CVE-2016-7993: A bug in util-print.c:relts_print() in tcpdump could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM) (bsc#1020940). - CVE-2016-8574: The FRF.15 parser in tcpdump had a buffer overflow in print-fr.c:frf15_print() (bsc#1020940). - CVE-2016-8575: The Q.933 parser in tcpdump had a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482 (bsc#1020940). - CVE-2017-5202: The ISO CLNS parser in tcpdump had a buffer overflow in print-isoclns.c:clnp_print() (bsc#1020940). - CVE-2017-5203: The BOOTP parser in tcpdump had a buffer overflow in print-bootp.c:bootp_print() (bsc#1020940). - CVE-2017-5204: The IPv6 parser in tcpdump had a buffer overflow in print-ip6.c:ip6_print() (bsc#1020940). - CVE-2017-5205: The ISAKMP parser in tcpdump had a buffer overflow in print-isakmp.c:ikev2_e_print() (bsc#1020940). - CVE-2017-5341: The OTV parser in tcpdump had a buffer overflow in print-otv.c:otv_print() (bsc#1020940). - CVE-2017-5342: In tcpdump a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print() (bsc#1020940). - CVE-2017-5482: The Q.933 parser in tcpdump had a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2016-8575 (bsc#1020940). - CVE-2017-5483: The SNMP parser in tcpdump had a buffer overflow in print-snmp.c:asn1_parse() (bsc#1020940). - CVE-2017-5484: The ATM parser in tcpdump had a buffer overflow in print-atm.c:sig_print() (bsc#1020940). - CVE-2017-5485: The ISO CLNS parser in tcpdump had a buffer overflow in addrtoname.c:lookup_nsap() (bsc#1020940). - CVE-2017-5486: The ISO CLNS parser in tcpdump had a buffer overflow in print-isoclns.c:clnp_print() (bsc#1020940). - CVE-2015-3138: Fixed potential denial of service in print-wb.c (bsc#927637). - CVE-2015-0261: Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump allowed remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value (bsc#922220). - CVE-2015-2153: The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump allowed remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU) (bsc#922221). - CVE-2015-2154: The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump allowed remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value (bsc#922222). - CVE-2015-2155: The force printer in tcpdump allowed remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors (bsc#922223). - CVE-2014-8767: Integer underflow in the olsr_print function in tcpdump 3.9.6 when in verbose mode, allowed remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame (bsc#905870). - CVE-2014-8768: Multiple Integer underflows in the geonet_print function in tcpdump when run in verbose mode, allowed remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame (bsc#905871). - CVE-2014-8769: tcpdump might have allowed remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet, which triggers an out-of-bounds memory access (bsc#905872). These non-security issues were fixed in tcpdump: - PPKI to Router Protocol: Fix Segmentation Faults and other problems - RPKI to Router Protocol: print strings with fn_printn() - Added a short option '#', same as long option '--number' - nflog, mobile, forces, pptp, AODV, AHCP, IPv6, OSPFv4, RPL, DHCPv6 enhancements/fixes - M3UA decode added. - Added bittok2str(). - A number of unaligned access faults fixed - The -A flag does not consider CR to be printable anymore - fx.lebail took over coverity baby sitting - Default snapshot size increased to 256K for accomodate USB captures These non-security issues were fixed in libpcap: - Provide a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - Fix handling of packet count in the TPACKET_V3 inner loop - Filter out duplicate looped back CAN frames. - Fix the handling of loopback filters for IPv6 packets. - Add a link-layer header type for RDS (IEC 62106) groups. - Handle all CAN captures with pcap-linux.c, in cooked mode. - Removes the need for the "host-endian" link-layer header type. - Have separate DLTs for big-endian and host-endian SocketCAN headers. - Properly check for sock_recv() errors. - Re-impose some of Winsock's limitations on sock_recv(). - Replace sprintf() with pcap_snprintf(). - Fix signature of pcap_stats_ex_remote(). - Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. - Clean up {DAG, Septel, Myricom SNF}-only builds. - pcap_create_interface() needs the interface name on Linux. - Clean up hardware time stamp support: the "any" device does not support any time stamp types. - Recognize 802.1ad nested VLAN tag in vlan filter. - Support for filtering Geneve encapsulated packets. - Fix handling of zones for BPF on Solaris - Added bpf_filter1() with extensions - EBUSY can now be returned by SNFv3 code. - Don't crash on filters testing a non-existent link-layer type field. - Fix sending in non-blocking mode on Linux with memory-mapped capture. - Fix timestamps when reading pcap-ng files on big-endian machines. - Fixes for byte order issues with NFLOG captures - Handle using cooked mode for DLT_NETLINK in activate_new(). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-557=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-557=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libpcap-debugsource-1.8.1-7.3.1 libpcap-devel-1.8.1-7.3.1 libpcap-devel-static-1.8.1-7.3.1 libpcap1-1.8.1-7.3.1 libpcap1-debuginfo-1.8.1-7.3.1 - openSUSE Leap 42.2 (x86_64): libpcap-devel-32bit-1.8.1-7.3.1 libpcap1-32bit-1.8.1-7.3.1 libpcap1-debuginfo-32bit-1.8.1-7.3.1 tcpdump-4.9.0-6.3.1 tcpdump-debuginfo-4.9.0-6.3.1 tcpdump-debugsource-4.9.0-6.3.1 - openSUSE Leap 42.1 (i586 x86_64): libpcap-debugsource-1.8.1-8.1 libpcap-devel-1.8.1-8.1 libpcap-devel-static-1.8.1-8.1 libpcap1-1.8.1-8.1 libpcap1-debuginfo-1.8.1-8.1 tcpdump-4.9.0-7.1 tcpdump-debuginfo-4.9.0-7.1 tcpdump-debugsource-4.9.0-7.1 - openSUSE Leap 42.1 (x86_64): libpcap-devel-32bit-1.8.1-8.1 libpcap1-32bit-1.8.1-8.1 libpcap1-debuginfo-32bit-1.8.1-8.1 References: https://www.suse.com/security/cve/CVE-2014-8767.html https://www.suse.com/security/cve/CVE-2014-8768.html https://www.suse.com/security/cve/CVE-2014-8769.html https://www.suse.com/security/cve/CVE-2015-0261.html https://www.suse.com/security/cve/CVE-2015-2153.html https://www.suse.com/security/cve/CVE-2015-2154.html https://www.suse.com/security/cve/CVE-2015-2155.html https://www.suse.com/security/cve/CVE-2015-3138.html https://www.suse.com/security/cve/CVE-2016-7922.html https://www.suse.com/security/cve/CVE-2016-7923.html https://www.suse.com/security/cve/CVE-2016-7924.html https://www.suse.com/security/cve/CVE-2016-7925.html https://www.suse.com/security/cve/CVE-2016-7926.html https://www.suse.com/security/cve/CVE-2016-7927.html https://www.suse.com/security/cve/CVE-2016-7928.html https://www.suse.com/security/cve/CVE-2016-7929.html https://www.suse.com/security/cve/CVE-2016-7930.html https://www.suse.com/security/cve/CVE-2016-7931.html https://www.suse.com/security/cve/CVE-2016-7932.html https://www.suse.com/security/cve/CVE-2016-7933.html https://www.suse.com/security/cve/CVE-2016-7934.html https://www.suse.com/security/cve/CVE-2016-7935.html https://www.suse.com/security/cve/CVE-2016-7936.html https://www.suse.com/security/cve/CVE-2016-7937.html https://www.suse.com/security/cve/CVE-2016-7938.html https://www.suse.com/security/cve/CVE-2016-7939.html https://www.suse.com/security/cve/CVE-2016-7940.html https://www.suse.com/security/cve/CVE-2016-7973.html https://www.suse.com/security/cve/CVE-2016-7974.html https://www.suse.com/security/cve/CVE-2016-7975.html https://www.suse.com/security/cve/CVE-2016-7983.html https://www.suse.com/security/cve/CVE-2016-7984.html https://www.suse.com/security/cve/CVE-2016-7985.html https://www.suse.com/security/cve/CVE-2016-7986.html https://www.suse.com/security/cve/CVE-2016-7992.html https://www.suse.com/security/cve/CVE-2016-7993.html https://www.suse.com/security/cve/CVE-2016-8574.html https://www.suse.com/security/cve/CVE-2016-8575.html https://www.suse.com/security/cve/CVE-2017-5202.html https://www.suse.com/security/cve/CVE-2017-5203.html https://www.suse.com/security/cve/CVE-2017-5204.html https://www.suse.com/security/cve/CVE-2017-5205.html https://www.suse.com/security/cve/CVE-2017-5341.html https://www.suse.com/security/cve/CVE-2017-5342.html https://www.suse.com/security/cve/CVE-2017-5482.html https://www.suse.com/security/cve/CVE-2017-5483.html https://www.suse.com/security/cve/CVE-2017-5484.html https://www.suse.com/security/cve/CVE-2017-5485.html https://www.suse.com/security/cve/CVE-2017-5486.html https://bugzilla.suse.com/1020940 https://bugzilla.suse.com/1035686 https://bugzilla.suse.com/905870 https://bugzilla.suse.com/905871 https://bugzilla.suse.com/905872 https://bugzilla.suse.com/922220 https://bugzilla.suse.com/922221 https://bugzilla.suse.com/922222 https://bugzilla.suse.com/922223 https://bugzilla.suse.com/927637

1 0

openSUSE-RU-2017:1197-1: moderate: Recommended update for grub2
by maintenance＠opensuse.org 08 May '17

08 May '17

openSUSE Recommended Update: Recommended update for grub2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1197-1 Rating: moderate References: #1015138 #1016536 #1023160 #1027401 #1031025 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for grub2 provides the following fixes: - Fix out of memory error on lvm detection. (bsc#1016536, bsc#1027401) - Fix regression on how GRUB_DISABLE_LINUX_UUID=true is interpreted. (bsc#1015138) - Fix boot failure if /boot is a separate btrfs partition. (bsc#1023160) - Fix savedefault option when using btrfs as root file system. (bsc#1031025) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-559=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): grub2-2.02~beta2-94.3.1 grub2-branding-upstream-2.02~beta2-94.3.1 grub2-debuginfo-2.02~beta2-94.3.1 grub2-debugsource-2.02~beta2-94.3.1 grub2-i386-pc-2.02~beta2-94.3.1 - openSUSE Leap 42.2 (noarch): grub2-snapper-plugin-2.02~beta2-94.3.1 grub2-systemd-sleep-plugin-2.02~beta2-94.3.1 - openSUSE Leap 42.2 (x86_64): grub2-x86_64-efi-2.02~beta2-94.3.1 grub2-x86_64-xen-2.02~beta2-94.3.1 - openSUSE Leap 42.2 (i586): grub2-i386-efi-2.02~beta2-94.3.1 References: https://bugzilla.suse.com/1015138 https://bugzilla.suse.com/1016536 https://bugzilla.suse.com/1023160 https://bugzilla.suse.com/1027401 https://bugzilla.suse.com/1031025

1 0

openSUSE-SU-2017:1196-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 May '17

06 May '17

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1196-1 Rating: moderate References: #1028391 #1035082 Cross-References: CVE-2017-5398 CVE-2017-5399 CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5403 CVE-2017-5404 CVE-2017-5405 CVE-2017-5406 CVE-2017-5407 CVE-2017-5408 CVE-2017-5410 CVE-2017-5412 CVE-2017-5413 CVE-2017-5414 CVE-2017-5416 CVE-2017-5418 CVE-2017-5419 CVE-2017-5421 CVE-2017-5422 CVE-2017-5426 CVE-2017-5429 CVE-2017-5430 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5437 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5449 CVE-2017-5451 CVE-2017-5454 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5462 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 CVE-2017-5469 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 51 vulnerabilities is now available. Description: This update to MozillaThunderbird 51.1.0 fixes security issues and bugs. In general, these flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. The following vulnerabilities were fixed: boo#1035082, MFSA 2017-13, boo#1028391, MFSA 2017-09) - CVE-2017-5443: Out-of-bounds write during BinHex decoding - CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 - CVE-2017-5464: Memory corruption with accessibility and DOM manipulation - CVE-2017-5465: Out-of-bounds read in ConvolvePixel - CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL - CVE-2017-5467: Memory corruption when drawing Skia content - CVE-2017-5460: Use-after-free in frame selection - CVE-2017-5449: Crash during bidirectional unicode manipulation with animation - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data - CVE-2017-5447: Out-of-bounds read during glyph processing - CVE-2017-5444: Buffer overflow while parsing application/http-index-format content - CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content - CVE-2017-5442: Use-after-free during style changes - CVE-2017-5469: Potential Buffer overflow in flex-generated code - CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing - CVE-2017-5441: Use-after-free with selection during scroll events - CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing - CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing - CVE-2017-5437: Vulnerabilities in Libevent library - CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2 - CVE-2017-5435: Use-after-free during transaction processing in the editor - CVE-2017-5434: Use-after-free during focus handling - CVE-2017-5433: Use-after-free in SMIL animation functions - CVE-2017-5432: Use-after-free in text input selection - CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 - CVE-2017-5459: Buffer overflow in WebGL - CVE-2017-5454; Sandbox escape allowing file system read access through file picker - CVE-2017-5451: Addressbar spoofing with onblur event - CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP - CVE-2017-5401: Memory Corruption when handling ErrorResult - CVE-2017-5402: Use-after-free working with events in FontFace objects - CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object - CVE-2017-5404: Use-after-free working with ranges in selections - CVE-2017-5406: Segmentation fault in Skia with canvas operations - CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters - CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping - CVE-2017-5408: Cross-origin reading of video captions in violation of CORS - CVE-2017-5412: Buffer overflow read in SVG filters - CVE-2017-5413: Segmentation fault during bidirectional operations - CVE-2017-5414: File picker can choose incorrect default directory - CVE-2017-5416: Null dereference crash in HttpChannel - CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running - CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses - CVE-2017-5419: Repeated authentication prompts lead to DOS attack - CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports - CVE-2017-5421: Print preview spoofing - CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink - CVE-2017-5399: Memory safety bugs fixed in Thunderbird 52 - CVE-2017-5398: Memory safety bugs fixed in Thunderbird 52 and Thunderbird 45.8 The following non-security changes are included: - Background images not working and other issues related to embedded images when composing email have been fixed - Google Oauth setup can sometimes not progress to the next step - Clicking on a link in an email may not open this link in the external browser - addon blocklist updates - enable ALSA for systems without PulseAudio - Optionally remove corresponding data files when removing an account - Possibility to copy message filter - Calendar: Event can now be created and edited in a tab - Calendar: Processing of received invitation counter proposals - Chat: Support Twitter Direct Messages - Chat: Liking and favoriting in Twitter - Chat: Removed Yahoo! Messenger support Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-545=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-545=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaThunderbird-52.1.0-41.3.1 MozillaThunderbird-buildsymbols-52.1.0-41.3.1 MozillaThunderbird-debuginfo-52.1.0-41.3.1 MozillaThunderbird-debugsource-52.1.0-41.3.1 MozillaThunderbird-devel-52.1.0-41.3.1 MozillaThunderbird-translations-common-52.1.0-41.3.1 MozillaThunderbird-translations-other-52.1.0-41.3.1 - openSUSE Leap 42.1 (x86_64): MozillaThunderbird-52.1.0-42.1 MozillaThunderbird-buildsymbols-52.1.0-42.1 MozillaThunderbird-debuginfo-52.1.0-42.1 MozillaThunderbird-debugsource-52.1.0-42.1 MozillaThunderbird-devel-52.1.0-42.1 MozillaThunderbird-translations-common-52.1.0-42.1 MozillaThunderbird-translations-other-52.1.0-42.1 References: https://www.suse.com/security/cve/CVE-2017-5398.html https://www.suse.com/security/cve/CVE-2017-5399.html https://www.suse.com/security/cve/CVE-2017-5400.html https://www.suse.com/security/cve/CVE-2017-5401.html https://www.suse.com/security/cve/CVE-2017-5402.html https://www.suse.com/security/cve/CVE-2017-5403.html https://www.suse.com/security/cve/CVE-2017-5404.html https://www.suse.com/security/cve/CVE-2017-5405.html https://www.suse.com/security/cve/CVE-2017-5406.html https://www.suse.com/security/cve/CVE-2017-5407.html https://www.suse.com/security/cve/CVE-2017-5408.html https://www.suse.com/security/cve/CVE-2017-5410.html https://www.suse.com/security/cve/CVE-2017-5412.html https://www.suse.com/security/cve/CVE-2017-5413.html https://www.suse.com/security/cve/CVE-2017-5414.html https://www.suse.com/security/cve/CVE-2017-5416.html https://www.suse.com/security/cve/CVE-2017-5418.html https://www.suse.com/security/cve/CVE-2017-5419.html https://www.suse.com/security/cve/CVE-2017-5421.html https://www.suse.com/security/cve/CVE-2017-5422.html https://www.suse.com/security/cve/CVE-2017-5426.html https://www.suse.com/security/cve/CVE-2017-5429.html https://www.suse.com/security/cve/CVE-2017-5430.html https://www.suse.com/security/cve/CVE-2017-5432.html https://www.suse.com/security/cve/CVE-2017-5433.html https://www.suse.com/security/cve/CVE-2017-5434.html https://www.suse.com/security/cve/CVE-2017-5435.html https://www.suse.com/security/cve/CVE-2017-5436.html https://www.suse.com/security/cve/CVE-2017-5437.html https://www.suse.com/security/cve/CVE-2017-5438.html https://www.suse.com/security/cve/CVE-2017-5439.html https://www.suse.com/security/cve/CVE-2017-5440.html https://www.suse.com/security/cve/CVE-2017-5441.html https://www.suse.com/security/cve/CVE-2017-5442.html https://www.suse.com/security/cve/CVE-2017-5443.html https://www.suse.com/security/cve/CVE-2017-5444.html https://www.suse.com/security/cve/CVE-2017-5445.html https://www.suse.com/security/cve/CVE-2017-5446.html https://www.suse.com/security/cve/CVE-2017-5447.html https://www.suse.com/security/cve/CVE-2017-5449.html https://www.suse.com/security/cve/CVE-2017-5451.html https://www.suse.com/security/cve/CVE-2017-5454.html https://www.suse.com/security/cve/CVE-2017-5459.html https://www.suse.com/security/cve/CVE-2017-5460.html https://www.suse.com/security/cve/CVE-2017-5461.html https://www.suse.com/security/cve/CVE-2017-5462.html https://www.suse.com/security/cve/CVE-2017-5464.html https://www.suse.com/security/cve/CVE-2017-5465.html https://www.suse.com/security/cve/CVE-2017-5466.html https://www.suse.com/security/cve/CVE-2017-5467.html https://www.suse.com/security/cve/CVE-2017-5469.html https://bugzilla.suse.com/1028391 https://bugzilla.suse.com/1035082

1 0

openSUSE-RU-2017:1195-1: Recommended update for java-1_8_0-openjdk
by maintenance＠opensuse.org 06 May '17

06 May '17

openSUSE Recommended Update: Recommended update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1195-1 Rating: low References: #1026102 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for java-1_8_0-openjdk fixes the following issues: - Fix build of Sun Elliptical Curves Crypto provider. (bsc#1026102) - Clean the mozilla-nss requires and move them into the headless flavor. - Add a test to check that ECC is working. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-544=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-544=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-10.5.1 java-1_8_0-openjdk-accessibility-1.8.0.121-10.5.1 java-1_8_0-openjdk-debuginfo-1.8.0.121-10.5.1 java-1_8_0-openjdk-debugsource-1.8.0.121-10.5.1 java-1_8_0-openjdk-demo-1.8.0.121-10.5.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-10.5.1 java-1_8_0-openjdk-devel-1.8.0.121-10.5.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-10.5.1 java-1_8_0-openjdk-headless-1.8.0.121-10.5.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-10.5.1 java-1_8_0-openjdk-src-1.8.0.121-10.5.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-10.5.1 - openSUSE Leap 42.1 (i586 x86_64): java-1_8_0-openjdk-1.8.0.121-28.1 java-1_8_0-openjdk-accessibility-1.8.0.121-28.1 java-1_8_0-openjdk-debuginfo-1.8.0.121-28.1 java-1_8_0-openjdk-debugsource-1.8.0.121-28.1 java-1_8_0-openjdk-demo-1.8.0.121-28.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.121-28.1 java-1_8_0-openjdk-devel-1.8.0.121-28.1 java-1_8_0-openjdk-devel-debuginfo-1.8.0.121-28.1 java-1_8_0-openjdk-headless-1.8.0.121-28.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.121-28.1 java-1_8_0-openjdk-src-1.8.0.121-28.1 - openSUSE Leap 42.1 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.121-28.1 References: https://bugzilla.suse.com/1026102

1 0

openSUSE-SU-2017:1194-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 06 May '17

06 May '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1194-1 Rating: important References: #1037594 Cross-References: CVE-2017-5068 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to Chromium 58.0.3029.96 fixes one security issue: - CVE-2017-5068: race condition in WebRTC (bsc#1037594) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-541=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-58.0.3029.96-17.1 chromium-58.0.3029.96-17.1 References: https://www.suse.com/security/cve/CVE-2017-5068.html https://bugzilla.suse.com/1037594

1 0

openSUSE-RU-2017:1193-1: moderate: Recommended update for pgadmin3
by maintenance＠opensuse.org 06 May '17

06 May '17

openSUSE Recommended Update: Recommended update for pgadmin3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1193-1 Rating: moderate References: #1036952 #986857 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update of pgadmin3 to 1.22.2 fixes the following issues: - Fix control grid row on hidpi screen. - Do not recommend but only suggest to install postgresql-server - Fix a segmentation fault (bsc#986857) The following upstream changes and bug fixes are included in version 1.22.2: - Include the Negator when reverse engineering SQL for operators - Prevent a crash in some situtions where the database connection is lost and needs to be reset. - Fix display of elapsed query time for queries running longer than 1 hour - Don't barf when connecting to Greenplum or Greenplum HAWQ - Fix selection of conversion functions in the CREATE CONVERSION dialogue. - Properly quote type names in the Type dialogue, and ensure range information is displayed for existing types - Fix selection of cast functions in the Cast dialogue - Resolved an issue related to check options selection in the view properties dialog with the check option. - Properly detect serial columns as such when identifiers have been truncated. - Fixes an issue related to the column inheritance information properly, when one (or, more) common columns are inherited from multiple tables. - Ensure the correct syntax used for moving the objects from one tablespace to another. - Ensure the correct line endings are used when copying from the SQL Pane - Toolbar icons, and menu items for Commit and Rollback actions. - Display the connection details for the current browser object in the status bar - Reset the position (x, y) for dialog(s), and frame(s) to 0 (if found negative), while saving its position and size. - Fixes an issue identifying the return type to TABLE in some cases, using pg_get_function_result(..) for the same instead of format_type(..) - Honour PGPASSFILE environment variable for saving - Fix a segfault occurs while detecting transaction section requirement, when autocommit has been disabled. - Format execution time in a more readable manner - Improve sorting in Data editor - Allow to format the selecte SQL using external tools in Query Editor - Allow to set auto-commit mode to on/off in the query editor - Do not try unlock the mutex, which was not owned by the thread, while creating the popup menu - Set the focus on browser tree windows on startup - Make the arrow key navigation consistent across all platform on the object browser tree - Show indexes for the materialized views in Query pane - Add support for searching materialized views 1.22.2 is the last upstream supported release of pgadmin3. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-543=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-543=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): pgadmin3-1.22.2-3.3.1 pgadmin3-debuginfo-1.22.2-3.3.1 pgadmin3-debugsource-1.22.2-3.3.1 - openSUSE Leap 42.2 (noarch): pgadmin3-lang-1.22.2-3.3.1 - openSUSE Leap 42.1 (i586 x86_64): pgadmin3-1.22.2-3.1 pgadmin3-debuginfo-1.22.2-3.1 pgadmin3-debugsource-1.22.2-3.1 - openSUSE Leap 42.1 (noarch): pgadmin3-lang-1.22.2-3.1 References: https://bugzilla.suse.com/1036952 https://bugzilla.suse.com/986857

1 0

openSUSE-RU-2017:1192-1: moderate: Recommended update for Opera
by maintenance＠opensuse.org 06 May '17

06 May '17

openSUSE Recommended Update: Recommended update for Opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1192-1 Rating: moderate References: #1036951 Affected Products: openSUSE Leap 42.2:NonFree openSUSE Leap 42.1:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to Opera 44.0.2510.1449 fixes the following issues: - Unable to add bookmarks to unsorted bookmarks if you have them - Some links opened in new tab don’t render - Never ending memory use increase on youtube 24/7 stream - Wallpapers wont load immediately - Remove non-default-themes from O44 stable Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-542=1 - openSUSE Leap 42.1:NonFree: zypper in -t patch openSUSE-2017-542=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-44.0.2510.1449-35.1 - openSUSE Leap 42.1:NonFree (x86_64): opera-44.0.2510.1449-72.1 References: https://bugzilla.suse.com/1036951

1 0