May 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1434-1: Recommended update for ncompress
by maintenance＠opensuse.org 29 May '17

29 May '17

openSUSE Recommended Update: Recommended update for ncompress ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1434-1 Rating: low References: #1040046 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ncompress fixes the following issues: - Fixed endian define. (boo#1040046) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-632=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ncompress-4.2.4.4-4.3.1 ncompress-debuginfo-4.2.4.4-4.3.1 ncompress-debugsource-4.2.4.4-4.3.1 References: https://bugzilla.suse.com/1040046

1 0

openSUSE-SU-2017:1433-1: moderate: Security update for ffmpeg2
by opensuse-security＠opensuse.org 29 May '17

29 May '17

openSUSE Security Update: Security update for ffmpeg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1433-1 Rating: moderate References: #1015120 #1022920 #1022921 #1022922 #1034176 #1034177 #1034179 Cross-References: CVE-2016-10190 CVE-2016-10191 CVE-2016-10192 CVE-2016-9561 CVE-2017-7863 CVE-2017-7865 CVE-2017-7866 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for ffmpeg2 fixes security issues, bugs, and enables AC3 and MP3 decoding. The following vulnerabilities were fixed: - CVE-2017-7863: heap-based buffer overflow (bsc#1034179) - CVE-2017-7865: heap-based buffer overflow (bsc#1034177) - CVE-2017-7866: stack-based buffer overflow (bsc#1034176) - CVE-2016-10191: remote code execution (bsc#1022921) - CVE-2016-10190: remote code execution (bsc#1022920) - CVE-2016-10192: remote code execution (bsc#1022922) - CVE-2016-9561: Huge amount memory allocated, resulting in DoS of ffmpeg (bsc#1015120) The following functionality was added: - Enable AC3 and MP3 decoding ffmpeg was updated to 2.8.11, containing a number of upstream improvements and fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-631=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ffmpeg2-debugsource-2.8.11-25.3.1 ffmpeg2-devel-2.8.11-25.3.1 libavcodec56-2.8.11-25.3.1 libavcodec56-debuginfo-2.8.11-25.3.1 libavdevice56-2.8.11-25.3.1 libavdevice56-debuginfo-2.8.11-25.3.1 libavfilter5-2.8.11-25.3.1 libavfilter5-debuginfo-2.8.11-25.3.1 libavformat56-2.8.11-25.3.1 libavformat56-debuginfo-2.8.11-25.3.1 libavresample2-2.8.11-25.3.1 libavresample2-debuginfo-2.8.11-25.3.1 libavutil54-2.8.11-25.3.1 libavutil54-debuginfo-2.8.11-25.3.1 libpostproc53-2.8.11-25.3.1 libpostproc53-debuginfo-2.8.11-25.3.1 libswresample1-2.8.11-25.3.1 libswresample1-debuginfo-2.8.11-25.3.1 libswscale3-2.8.11-25.3.1 libswscale3-debuginfo-2.8.11-25.3.1 - openSUSE Leap 42.2 (x86_64): libavcodec56-32bit-2.8.11-25.3.1 libavcodec56-debuginfo-32bit-2.8.11-25.3.1 libavdevice56-32bit-2.8.11-25.3.1 libavdevice56-debuginfo-32bit-2.8.11-25.3.1 libavfilter5-32bit-2.8.11-25.3.1 libavfilter5-debuginfo-32bit-2.8.11-25.3.1 libavformat56-32bit-2.8.11-25.3.1 libavformat56-debuginfo-32bit-2.8.11-25.3.1 libavresample2-32bit-2.8.11-25.3.1 libavresample2-debuginfo-32bit-2.8.11-25.3.1 libavutil54-32bit-2.8.11-25.3.1 libavutil54-debuginfo-32bit-2.8.11-25.3.1 libpostproc53-32bit-2.8.11-25.3.1 libpostproc53-debuginfo-32bit-2.8.11-25.3.1 libswresample1-32bit-2.8.11-25.3.1 libswresample1-debuginfo-32bit-2.8.11-25.3.1 libswscale3-32bit-2.8.11-25.3.1 libswscale3-debuginfo-32bit-2.8.11-25.3.1 References: https://www.suse.com/security/cve/CVE-2016-10190.html https://www.suse.com/security/cve/CVE-2016-10191.html https://www.suse.com/security/cve/CVE-2016-10192.html https://www.suse.com/security/cve/CVE-2016-9561.html https://www.suse.com/security/cve/CVE-2017-7863.html https://www.suse.com/security/cve/CVE-2017-7865.html https://www.suse.com/security/cve/CVE-2017-7866.html https://bugzilla.suse.com/1015120 https://bugzilla.suse.com/1022920 https://bugzilla.suse.com/1022921 https://bugzilla.suse.com/1022922 https://bugzilla.suse.com/1034176 https://bugzilla.suse.com/1034177 https://bugzilla.suse.com/1034179

1 0

openSUSE-RU-2017:1431-1: moderate: Recommended update for Opera
by maintenance＠opensuse.org 28 May '17

28 May '17

openSUSE Recommended Update: Recommended update for Opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1431-1 Rating: moderate References: #1041111 Affected Products: openSUSE Leap 42.2:NonFree ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to Opera 45.0.2552.881 contains the following upstream fixes: - Broken drop down list elements (wrong font color) - Black borders on context menus - Sub-menu after expand is visible /expandable/ only once - Menu not position correctly + no menu label - Remove grey wallpaper from list of wallpapers - Corrupted installer message is not translated - Full screen issue 1px line at the bottom - Crash at blink::WebSpeechSynthesisVoice::operator blink::PlatformSpeechSynthesisVoice*() - Crash on right clicking extensions sidebar (signature: ui::MenuModel::GetModelAndIndexForCommandId(int, ui::MenuModel*, int)) - Opera crashes when trying to manage print preferences - Dark theme hint polish translation - Get the new wallpaper into master - Red UI elements in high-DPI with Reborn enabled - Current theme is not updated when selecting it from “Customize start page” in some use cases - MFDemuxer stalls after seeking - Error about missing opera_200_percent.pak - Fix messenger feature page's URL Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-630=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-45.0.2552.881-41.1 References: https://bugzilla.suse.com/1041111

1 0

openSUSE-RU-2017:1430-1: moderate: Recommended update for postgresql94
by maintenance＠opensuse.org 28 May '17

28 May '17

openSUSE Recommended Update: Recommended update for postgresql94 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1430-1 Rating: moderate References: #1029547 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides PostgreSQL 9.4.11, which brings fixes and enhancements: - Fix a race condition that could cause indexes built with CREATE INDEX CONCURRENTLY to be corrupt. - Fixes for visibility and write-ahead-log stability. - Fix WAL-logging of truncated relations. - Fix pg_upgrade issues on big-endian machines. For a comprehensive list of bug fixes, please refer to the release notes: - https://www.postgresql.org/docs/9.4/static/release-9-4-10.html - https://www.postgresql.org/docs/9.4/static/release-9-4-11.html This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-626=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libecpg6-9.4.11-9.3.1 libecpg6-debuginfo-9.4.11-9.3.1 libpq5-9.4.11-9.3.1 libpq5-debuginfo-9.4.11-9.3.1 postgresql94-9.4.11-9.3.1 postgresql94-contrib-9.4.11-9.3.1 postgresql94-contrib-debuginfo-9.4.11-9.3.1 postgresql94-debuginfo-9.4.11-9.3.1 postgresql94-debugsource-9.4.11-9.3.1 postgresql94-devel-9.4.11-9.3.1 postgresql94-devel-debuginfo-9.4.11-9.3.1 postgresql94-libs-debugsource-9.4.11-9.3.1 postgresql94-plperl-9.4.11-9.3.1 postgresql94-plperl-debuginfo-9.4.11-9.3.1 postgresql94-plpython-9.4.11-9.3.1 postgresql94-plpython-debuginfo-9.4.11-9.3.1 postgresql94-pltcl-9.4.11-9.3.1 postgresql94-pltcl-debuginfo-9.4.11-9.3.1 postgresql94-server-9.4.11-9.3.1 postgresql94-server-debuginfo-9.4.11-9.3.1 postgresql94-test-9.4.11-9.3.1 - openSUSE Leap 42.2 (noarch): postgresql94-docs-9.4.11-9.3.1 - openSUSE Leap 42.2 (x86_64): libecpg6-32bit-9.4.11-9.3.1 libecpg6-debuginfo-32bit-9.4.11-9.3.1 libpq5-32bit-9.4.11-9.3.1 libpq5-debuginfo-32bit-9.4.11-9.3.1 References: https://bugzilla.suse.com/1029547

1 0

openSUSE-SU-2017:1429-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 28 May '17

28 May '17

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1429-1 Rating: important References: #1034849 Cross-References: CVE-2017-3289 CVE-2017-3509 CVE-2017-3511 CVE-2017-3512 CVE-2017-3514 CVE-2017-3526 CVE-2017-3533 CVE-2017-3539 CVE-2017-3544 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: - Update to 2.6.10 - OpenJDK 7u141 (bsc#1034849) * Security fixes - S8163520, CVE-2017-3509: Reuse cache entries - S8163528, CVE-2017-3511: Better library loading - S8165626, CVE-2017-3512: Improved window framing - S8167110, CVE-2017-3514: Windows peering issue - S8169011, CVE-2017-3526: Resizing XML parse trees - S8170222, CVE-2017-3533: Better transfers of files - S8171121, CVE-2017-3539: Enhancing jar checking - S8171533, CVE-2017-3544: Better email transfer - S8172299: Improve class processing * New features - PR3347: jstack.stp should support AArch64 * Import of OpenJDK 7 u141 build 0 - S4717864: setFont() does not update Fonts of Menus already on screen - S6474807: (smartcardio) CardTerminal.connect() throws CardException instead of CardNotPresentException - S6518907: cleanup IA64 specific code in Hotspot - S6869327: Add new C2 flag to keep safepoints in counted loops. - S7112912: Message "Error occurred during initialization of VM" on boxes with lots of RAM - S7124213: [macosx] pack() does ignore size of a component; doesn't on the other platforms - S7124219: [macosx] Unable to draw images to fullscreen - S7124552: [macosx] NullPointerException in getBufferStrategy() - S7148275: [macosx] setIconImages() not working correctly (distorted icon when minimized) - S7154841: [macosx] Popups appear behind taskbar - S7155957: closed/java/awt/MenuBar/MenuBarStress1/MenuBarStress1.java hangs on win 64 bit with jdk8 - S7160627: [macosx] TextArea has wrong initial size - S7167293: FtpURLConnection connection leak on FileNotFoundException - S7168851: [macosx] Netbeans crashes in CImage.nativeCreateNSImageFromArray - S7197203: sun/misc/URLClassPath/ClassnameCharTest.sh failed, compile error - S8005255: [macosx] Cleanup warnings in sun.lwawt - S8006088: Incompatible heap size flags accepted by VM - S8007295: Reduce number of warnings in awt classes - S8010722: assert: failed: heap size is too big for compressed oops - S8011059: [macosx] Support automatic @2x images loading on Mac OS X - S8014058: Regression tests for 8006088 - S8014489: tests/gc/arguments/Test(Serial|CMS|Parallel|G1)HeapSizeFlags jtreg tests invoke wrong class - S8016302: Change type of the number of GC workers to unsigned int (2) - S8024662: gc/arguments/TestUseCompressedOopsErgo.java does not compile. - S8024669: Native OOME when allocating after changes to maximum heap supporting Coops sizing on sparcv9 - S8024926: [macosx] AquaIcon HiDPI support - S8025974: l10n for policytool - S8027025: [macosx] getLocationOnScreen returns 0 if parent invisible - S8028212: Custom cursor HiDPI support - S8028471: PPC64 (part 215): opto: Extend ImplicitNullCheck optimization. - S8031573: [macosx] Checkmarks of JCheckBoxMenuItems aren't rendered in high resolution on Retina - S8033534: [macosx] Get MultiResolution image from native system - S8033786: White flashing when opening Dialogs and Menus using Nimbus with dark background - S8035568: [macosx] Cursor management unification - S8041734: JFrame in full screen mode leaves empty workspace after close - S8059803: Update use of GetVersionEx to get correct Windows version in hs_err files - S8066504: GetVersionEx in java.base/windows/native/libjava/java_props_md.c might not get correct Windows version 0 - S8079595: Resizing dialog which is JWindow parent makes JVM crash - S8080729: [macosx] java 7 and 8 JDialogs on multiscreen jump to parent frame on focus - S8130769: The new menu can't be shown on the menubar after clicking the "Add" button. - S8133357: 8u65 l10n resource file translation update - S8146602: jdk/test/sun/misc/URLClassPath/ClassnameCharTest.java test fails with NullPointerException - S8147842: IME Composition Window is displayed at incorrect location - S8147910: Cache initial active_processor_count - S8150490: Update OS detection code to recognize Windows Server 2016 - S8161147: jvm crashes when -XX:+UseCountedLoopSafepoints is enabled - S8161195: Regression: closed/javax/swing/text/FlowView/LayoutTest.java - S8161993: G1 crashes if active_processor_count changes during startup - S8162603: Unrecognized VM option 'UseCountedLoopSafepoints' - S8162876: [TEST_BUG] sun/net/www/protocol/http/HttpInputStream.java fails intermittently - S8164533: sun/security/ssl/SSLSocketImpl/CloseSocket.java failed with "Error while cleaning up threads after test" - S8167179: Make XSL generated namespace prefixes local to transformation process - S8169465: Deadlock in com.sun.jndi.ldap.pool.Connections - S8169589: [macosx] Activating a JDialog puts to back another dialog - S8170307: Stack size option -Xss is ignored - S8170316: (tz) Support tzdata2016j - S8170814: Reuse cache entries (part II) - S8171388: Update JNDI Thread contexts - S8171949: [macosx] AWT_ZoomFrame Automated tests fail with error: The bitwise mask Frame.ICONIFIED is not setwhen the frame is in ICONIFIED state - S8171952: [macosx] AWT_Modality/Automated/ModalExclusion/NoExclusion/ModelessDialog test fails as DummyButton on Dialog did not gain focus when clicked. - S8173931: 8u131 L10n resource file update - S8174844: Incorrect GPL header causes RE script to miss swap to commercial header for licensee source bundle - S8175087: [bsd] Fix build after "8024900: PPC64: Enable new build on AIX (jdk part)" - S8175163: [bsd] Fix build after "8005629: javac warnings compiling java.awt.EventDispatchThread..." - S8176044: (tz) Support tzdata2017a * Import of OpenJDK 7 u141 build 1 - S8043723: max_heap_for_compressed_oops() declared with size_t, but defined with uintx * Import of OpenJDK 7 u141 build 2 - S8011123: serialVersionUID of java.awt.dnd.InvalidDnDOperationException changed in JDK8-b82 * Backports - S6515172, PR3362: Runtime.availableProcessors() ignores Linux taskset command - S8022284, PR3209: Hide internal data structure in PhaseCFG - S8023003, PR3209: Cleanup the public interface to PhaseCFG - S8023691, PR3209: Create interface for nodes in class Block - S8023988, PR3209: Move local scheduling of nodes to the CFG creation and code motion phase (PhaseCFG) - S8043780, PR3369: Use open(O_CLOEXEC) instead of fcntl(FD_CLOEXEC) - S8157306, PR3209: Random infrequent null pointer exceptions in javac - S8173783, PR3329: IllegalArgumentException: jdk.tls.namedGroups - S8173941, PR3330: SA does not work if executable is DSO - S8174729, PR3361: Race Condition in java.lang.reflect.WeakCache * Bug fixes - PR3349: Architectures unsupported by SystemTap tapsets throw a parse error - PR3370: Disable ARM32 JIT by default in jdk_generic_profile.sh - PR3379: Perl should be mandatory - PR3390: javac.in and javah.in should use @PERL@ rather than a hardcoded path * CACAO - PR2732: Raise javadoc memory limits for CACAO again! * AArch64 port - S8177661, PR3367: Correct ad rule output register types from iRegX to iRegXNoSp - Get ecj.jar path from gcj, use the gcc variant that provides Java to build C code to make sure jni.h is available. - S8167104, CVE-2017-3289: Additional class construction - S6253144: Long narrowing conversion should describe the - S6328537: Improve javadocs for Socket class by adding - S6978886: javadoc shows stacktrace after print error - S6995421: Eliminate the static dependency to - S7027045: (doc) java/awt/Window.java has several typos in - S7054969: Null-check-in-finally pattern in java/security - S7072353: JNDI libraries do not build with javac -Xlint:all - S7092447: Clarify the default locale used in each locale - S7103570: AtomicIntegerFieldUpdater does not work when - S7187144: JavaDoc for ScriptEngineFactory.getProgram() - S8000418: javadoc should used a standard "generated by - S8000666: javadoc should write directly to Writer instead of - S8000970: break out auxiliary classes that will prevent - S8001669: javadoc internal DocletAbortException should set - S8011402: Move blacklisting certificate logic from hard code - S8011547: Update XML Signature implementation to Apache - S8012288: XML DSig API allows wrong tag names and extra - S8017325: Cleanup of the javadoc <code> tag in - S8017326: Cleanup of the javadoc <code> tag in - S8019772: Fix doclint issues in javax.crypto and - S8020688: Broken links in documentation at - S8021108: Clean up doclint warnings and errors in java.text - S8022120: JCK test api/javax_xml/crypto/dsig/TransformService/index_ParamMethods - S8025409: Fix javadoc comments errors and warning reported by - S8026021: more fix of javadoc errors and warnings reported by - S8037099: [macosx] Remove all references to GC from native - S8038184: XMLSignature throws StringIndexOutOfBoundsException - S8038349: Signing XML with DSA throws Exception when key is - S8049244: XML Signature performance issue caused by - S8050893: (smartcardio) Invert reset argument in tests in - S8059212: Modify sun/security/smartcardio manual regression - S8068279: (typo in the spec) - S8068491: Update the protocol for references of - S8069038: javax/net/ssl/TLS/TLSClientPropertyTest.java needs - S8076369: Introduce the jdk.tls.client.protocols system - S8139565: Restrict certificates with DSA keys less than 1024 - S8140422: Add mechanism to allow non default root CAs to be - S8140587: Atomic*FieldUpdaters should use Class.isInstance - S8149029: Secure validation of XML based digital signature - S8151893: Add security property to configure XML Signature - S8161228: URL objects with custom protocol handlers have port - S8163304: jarsigner -verbose -verify should print the - S8164908: ReflectionFactory support for IIOP and custom - S8165230: RMIConnection addNotificationListeners failing with - S8166393: disabledAlgorithms property should not be strictly - S8166591: [macos 10.12] Trackpad scrolling of text on OS X - S8166739: Improve extensibility of ObjectInputFilter - S8167356: Follow up fix for jdk8 backport of 8164143. Changes - S8167459: Add debug output for indicating if a chosen - S8168861: AnchorCertificates uses hardcoded password for - S8169688: Backout (remove) MD5 from - S8169911: Enhanced tests for jarsigner -verbose -verify after - S8170131: Certificates not being blocked by - S8173854: [TEST] Update DHEKeySizing test case following - S7102489, PR3316, RH1390708: RFE: cleanup jlong typedef on - S8000351, PR3316, RH1390708: Tenuring threshold should be - S8153711, PR3315, RH1284948: [REDO] JDWP: Memory Leak: - S8170888, PR3316, RH1390708: [linux] Experimental support for - PR3318: Replace 'infinality' with 'improved font rendering' - PR3324: Fix NSS_LIBDIR substitution in - S8165673, PR3320: AArch64: Fix JNI floating point argument + S6604109, PR3162: - Add -fno-delete-null-pointer-checks -fno-lifetime-dse to try to directory to be specified versions of IcedTea This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-629=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.141-42.3.1 java-1_7_0-openjdk-accessibility-1.7.0.141-42.3.1 java-1_7_0-openjdk-bootstrap-1.7.0.141-42.3.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.141-42.3.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.141-42.3.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.141-42.3.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.141-42.3.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.141-42.3.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.141-42.3.1 java-1_7_0-openjdk-debuginfo-1.7.0.141-42.3.1 java-1_7_0-openjdk-debugsource-1.7.0.141-42.3.1 java-1_7_0-openjdk-demo-1.7.0.141-42.3.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.141-42.3.1 java-1_7_0-openjdk-devel-1.7.0.141-42.3.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.141-42.3.1 java-1_7_0-openjdk-headless-1.7.0.141-42.3.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.141-42.3.1 java-1_7_0-openjdk-src-1.7.0.141-42.3.1 - openSUSE Leap 42.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.141-42.3.1 References: https://www.suse.com/security/cve/CVE-2017-3289.html https://www.suse.com/security/cve/CVE-2017-3509.html https://www.suse.com/security/cve/CVE-2017-3511.html https://www.suse.com/security/cve/CVE-2017-3512.html https://www.suse.com/security/cve/CVE-2017-3514.html https://www.suse.com/security/cve/CVE-2017-3526.html https://www.suse.com/security/cve/CVE-2017-3533.html https://www.suse.com/security/cve/CVE-2017-3539.html https://www.suse.com/security/cve/CVE-2017-3544.html https://bugzilla.suse.com/1034849

1 0

openSUSE-RU-2017:1428-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 28 May '17

28 May '17

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1428-1 Rating: moderate References: #1010220 #1025398 #1025886 #1028263 #1028610 #1029183 #1029691 #1030290 #1031355 #1032538 #1032660 #1033855 #1034565 #955770 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 14 recommended fixes can now be installed. Description: This update for systemd provides the following fixes: - logind: Update empty and "infinity" handling for [User]TasksMax. (bsc#1031355) - importd: Support SUSE style checksums. (fate#322054) - journal: Don't remove leading spaces. (bsc#1033855) - Make sure all swap units are ordered before the swap target. (bsc#955770, bsc#1034565) - hwdb: Fix warning "atkbd serio0: Unknown key pressed". (bsc#1010220) - logind: Restart logind on package update only on SLE12 distros. (bsc#1032660) - core: Treat masked files as "unchanged". (bsc#1032538) - units: Move Before deps for quota services to remote-fs.target. (bsc#1028263) - udev: Support predictable ifnames on vio buses. (bsc#1029183) - udev: Add a persistent rule for ibmvnic devices. (bsc#1029183) - units: Do not throw a warning in emergency mode if plymouth is not installed. (bsc#1025398) - core: Downgrade "Time has been changed" message to debug level. (bsc#1028610) - vconsole: Don't do GIO_SCRNMAP / GIO_UNISCRNMAP. (bsc#1029691) - udev-rules: Perform whitespace replacement for symlink subst values. (bsc#1025886) - Consider chroot updates in fix-machines-subvol-for-rollbacks.sh. (bsc#1030290) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-628=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsystemd0-228-25.3.1 libsystemd0-debuginfo-228-25.3.1 libsystemd0-mini-228-25.3.1 libsystemd0-mini-debuginfo-228-25.3.1 libudev-devel-228-25.3.1 libudev-mini-devel-228-25.3.1 libudev-mini1-228-25.3.1 libudev-mini1-debuginfo-228-25.3.1 libudev1-228-25.3.1 libudev1-debuginfo-228-25.3.1 nss-myhostname-228-25.3.1 nss-myhostname-debuginfo-228-25.3.1 nss-mymachines-228-25.3.1 nss-mymachines-debuginfo-228-25.3.1 systemd-228-25.3.1 systemd-debuginfo-228-25.3.1 systemd-debugsource-228-25.3.1 systemd-devel-228-25.3.1 systemd-logger-228-25.3.1 systemd-mini-228-25.3.1 systemd-mini-debuginfo-228-25.3.1 systemd-mini-debugsource-228-25.3.1 systemd-mini-devel-228-25.3.1 systemd-mini-sysvinit-228-25.3.1 systemd-sysvinit-228-25.3.1 udev-228-25.3.1 udev-debuginfo-228-25.3.1 udev-mini-228-25.3.1 udev-mini-debuginfo-228-25.3.1 - openSUSE Leap 42.2 (x86_64): libsystemd0-32bit-228-25.3.1 libsystemd0-debuginfo-32bit-228-25.3.1 libudev1-32bit-228-25.3.1 libudev1-debuginfo-32bit-228-25.3.1 nss-myhostname-32bit-228-25.3.1 nss-myhostname-debuginfo-32bit-228-25.3.1 systemd-32bit-228-25.3.1 systemd-debuginfo-32bit-228-25.3.1 - openSUSE Leap 42.2 (noarch): systemd-bash-completion-228-25.3.1 systemd-mini-bash-completion-228-25.3.1 References: https://bugzilla.suse.com/1010220 https://bugzilla.suse.com/1025398 https://bugzilla.suse.com/1025886 https://bugzilla.suse.com/1028263 https://bugzilla.suse.com/1028610 https://bugzilla.suse.com/1029183 https://bugzilla.suse.com/1029691 https://bugzilla.suse.com/1030290 https://bugzilla.suse.com/1031355 https://bugzilla.suse.com/1032538 https://bugzilla.suse.com/1032660 https://bugzilla.suse.com/1033855 https://bugzilla.suse.com/1034565 https://bugzilla.suse.com/955770

1 0

openSUSE-SU-2017:1427-1: moderate: Security update for libsndfile
by opensuse-security＠opensuse.org 28 May '17

28 May '17

openSUSE Security Update: Security update for libsndfile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1427-1 Rating: moderate References: #1033054 #1033914 #1033915 #1036943 #1036944 #1036945 #1036946 #1038856 Cross-References: CVE-2017-7585 CVE-2017-7741 CVE-2017-7742 CVE-2017-8361 CVE-2017-8362 CVE-2017-8363 CVE-2017-8365 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: This update for libsndfile fixes the following issues: - CVE-2017-8361: Global buffer overflow in flac_buffer_copy. (bsc#1036946) - CVE-2017-8362: Invalid memory read in flac_buffer_copy. (bsc#1036943) - CVE-2017-8363: Heap-based buffer overflow in flac_buffer_copy. (bsc#1036945) - CVE-2017-7585, CVE-2017-7741, CVE-2017-7742: Stack-based buffer overflows via specially crafted FLAC files. (bsc#1033054) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-625=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsndfile-debugsource-1.0.25-26.6.1 libsndfile-devel-1.0.25-26.6.1 libsndfile-progs-1.0.25-26.6.1 libsndfile-progs-debuginfo-1.0.25-26.6.1 libsndfile-progs-debugsource-1.0.25-26.6.1 libsndfile1-1.0.25-26.6.1 libsndfile1-debuginfo-1.0.25-26.6.1 - openSUSE Leap 42.2 (x86_64): libsndfile1-32bit-1.0.25-26.6.1 libsndfile1-debuginfo-32bit-1.0.25-26.6.1 References: https://www.suse.com/security/cve/CVE-2017-7585.html https://www.suse.com/security/cve/CVE-2017-7741.html https://www.suse.com/security/cve/CVE-2017-7742.html https://www.suse.com/security/cve/CVE-2017-8361.html https://www.suse.com/security/cve/CVE-2017-8362.html https://www.suse.com/security/cve/CVE-2017-8363.html https://www.suse.com/security/cve/CVE-2017-8365.html https://bugzilla.suse.com/1033054 https://bugzilla.suse.com/1033914 https://bugzilla.suse.com/1033915 https://bugzilla.suse.com/1036943 https://bugzilla.suse.com/1036944 https://bugzilla.suse.com/1036945 https://bugzilla.suse.com/1036946 https://bugzilla.suse.com/1038856

1 0

openSUSE-SU-2017:1426-1: moderate: Security update for libplist
by opensuse-security＠opensuse.org 28 May '17

28 May '17

openSUSE Security Update: Security update for libplist ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1426-1 Rating: moderate References: #1019531 #1021610 #1023807 #1023822 #1023848 #1029631 #1035312 Cross-References: CVE-2017-5209 CVE-2017-5545 CVE-2017-5834 CVE-2017-5835 CVE-2017-5836 CVE-2017-6440 CVE-2017-7982 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libplist fixes the following issues: - CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (bsc#1019531). - CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610). - CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807) - CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822) - CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed. (bsc#1023848) - CVE-2017-6440: Ensure that sanity checks work on 32-bit platforms. (bsc#1029631) - CVE-2017-7982: Add some safety checks, backported from upstream (bsc#1035312). - CVE-2017-5836: A maliciously crafted file could cause the application to crash. (bsc#1023807). - CVE-2017-5835: Malicious crafted file could cause libplist to allocate large amounts of memory and consume lots of CPU (bsc#1023822) - CVE-2017-5834: Maliciou crafted file could cause a heap buffer overflow or segmentation fault (bsc#1023848) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-627=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libplist++-devel-1.12-7.3.1 libplist++3-1.12-7.3.1 libplist++3-debuginfo-1.12-7.3.1 libplist-debugsource-1.12-7.3.1 libplist-devel-1.12-7.3.1 libplist3-1.12-7.3.1 libplist3-debuginfo-1.12-7.3.1 plistutil-1.12-7.3.1 plistutil-debuginfo-1.12-7.3.1 python-plist-1.12-7.3.1 python-plist-debuginfo-1.12-7.3.1 - openSUSE Leap 42.2 (x86_64): libplist++3-32bit-1.12-7.3.1 libplist++3-debuginfo-32bit-1.12-7.3.1 libplist3-32bit-1.12-7.3.1 libplist3-debuginfo-32bit-1.12-7.3.1 References: https://www.suse.com/security/cve/CVE-2017-5209.html https://www.suse.com/security/cve/CVE-2017-5545.html https://www.suse.com/security/cve/CVE-2017-5834.html https://www.suse.com/security/cve/CVE-2017-5835.html https://www.suse.com/security/cve/CVE-2017-5836.html https://www.suse.com/security/cve/CVE-2017-6440.html https://www.suse.com/security/cve/CVE-2017-7982.html https://bugzilla.suse.com/1019531 https://bugzilla.suse.com/1021610 https://bugzilla.suse.com/1023807 https://bugzilla.suse.com/1023822 https://bugzilla.suse.com/1023848 https://bugzilla.suse.com/1029631 https://bugzilla.suse.com/1035312

1 0

openSUSE-RU-2017:1425-1: Recommended update for lua
by maintenance＠opensuse.org 27 May '17

27 May '17

openSUSE Recommended Update: Recommended update for lua ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1425-1 Rating: low References: #1010089 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides Lua 5.2.4, which brings fixes for the following issues: - Wrong overflow check in table.unpack - Ephemeron table wrongly collecting strong keys - Crash in chunks that are too long - Garbage collector can trigger too many times in recursive loops - Wrong assert when reporting concatenation errors - Wrong error message in some short-cut expressions - luac listings choke on long strings - Reorder items in private Table struct, restoring ABI compatibility. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-623=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): liblua5_2-5.2.4-5.3.1 liblua5_2-debuginfo-5.2.4-5.3.1 lua-5.2.4-5.3.1 lua-debuginfo-5.2.4-5.3.1 lua-debugsource-5.2.4-5.3.1 lua-devel-5.2.4-5.3.1 - openSUSE Leap 42.2 (noarch): lua-doc-5.2.4-5.3.1 - openSUSE Leap 42.2 (x86_64): liblua5_2-32bit-5.2.4-5.3.1 liblua5_2-debuginfo-32bit-5.2.4-5.3.1 References: https://bugzilla.suse.com/1010089

1 0

openSUSE-RU-2017:1424-1: Recommended update for python3
by maintenance＠opensuse.org 27 May '17

27 May '17

openSUSE Recommended Update: Recommended update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1424-1 Rating: low References: #1027282 #1029377 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides Python 3.4.6, which brings the following fixes: - Fix potential crash in PyUnicode_AsDecodedObject() in debug build. - Fix possible DoS and arbitrary execution in gettext plurals. - Fix possible use of uninitialized memory in operator.methodcaller. - Fix possible Py_DECREF on unowned object in _sre. - Fix possible integer overflow in _csv module. - Fix selectors incorrectly retaining invalid file descriptors. - Move _elementtree to python3.rpm to match its pyexpat dependency. (bsc#1029377) For a comprehensive list of changes, please refer to the upstream Release Notes available at https://hg.python.org/cpython/raw-file/v3.4.6/Misc/NEWS This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-620=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libpython3_4m1_0-3.4.6-10.3.1 libpython3_4m1_0-debuginfo-3.4.6-10.3.1 python3-3.4.6-10.3.1 python3-base-3.4.6-10.3.1 python3-base-debuginfo-3.4.6-10.3.1 python3-base-debugsource-3.4.6-10.3.1 python3-curses-3.4.6-10.3.1 python3-curses-debuginfo-3.4.6-10.3.1 python3-dbm-3.4.6-10.3.1 python3-dbm-debuginfo-3.4.6-10.3.1 python3-debuginfo-3.4.6-10.3.1 python3-debugsource-3.4.6-10.3.1 python3-devel-3.4.6-10.3.1 python3-devel-debuginfo-3.4.6-10.3.1 python3-idle-3.4.6-10.3.1 python3-testsuite-3.4.6-10.3.1 python3-testsuite-debuginfo-3.4.6-10.3.1 python3-tk-3.4.6-10.3.1 python3-tk-debuginfo-3.4.6-10.3.1 python3-tools-3.4.6-10.3.1 - openSUSE Leap 42.2 (noarch): python3-doc-3.4.6-10.3.1 python3-doc-pdf-3.4.6-10.3.1 - openSUSE Leap 42.2 (x86_64): libpython3_4m1_0-32bit-3.4.6-10.3.1 libpython3_4m1_0-debuginfo-32bit-3.4.6-10.3.1 python3-32bit-3.4.6-10.3.1 python3-base-32bit-3.4.6-10.3.1 python3-base-debuginfo-32bit-3.4.6-10.3.1 python3-debuginfo-32bit-3.4.6-10.3.1 References: https://bugzilla.suse.com/1027282 https://bugzilla.suse.com/1029377

1 0