May 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:1215-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1215-1 Rating: important References: #1012829 #1012876 #1028415 #1030213 #1031003 #1031052 #1031440 #1031579 #1032435 #1033336 #1033340 #1033518 #1034670 #930399 #970083 Cross-References: CVE-2016-10318 CVE-2017-2671 CVE-2017-7187 CVE-2017-7261 CVE-2017-7294 CVE-2017-7308 CVE-2017-7616 CVE-2017-7618 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 7 fixes is now available. Description: The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-7618: crypto/ahash.c in the Linux kernel allowed attackers to cause a denial of service (API operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue (bnc#1033340). - CVE-2016-10318: A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel allowed a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service (bnc#1032435). - CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bnc#1033336). - CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579). - CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003). - CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440). - CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052). - CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213). The following non-security bugs were fixed: - ata: ahci_xgene: free structure returned by acpi_get_object_info() (bsc#1033518). - doc/README.SUSE: update links to KMP manual - ext4: do not perform data journaling when data is encrypted (bsc#1012876). - ext4: fix use-after-iput when fscrypt contexts are inconsistent (bsc#1012829). - ext4: mark inode dirty after converting inline directory (bsc#1012876). - ext4: reject inodes with negative size (bsc#1012876). - fs, seqfile: always allow oom killer (bsc#1012876). - ipv6: make ECMP route replacement less greedy (bsc#930399). - l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 (bsc#1028415). - mm: filemap: do not plant shadow entries without radix tree node (bsc#1012876). - netfilter: allow logging from non-init namespaces (bsc#970083). - nfsd4: minor NFSv2/v3 write decoding cleanup (bsc#1034670 CVE#2017-7645). - nfsd: check for oversized NFSv2/v3 arguments (bsc#1034670 CVE#2017-7645). - nfsd: stricter decoding of write-like NFSv2/v3 ops (bsc#1034670 CVE#2017-7645). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-562=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.39-56.1 kernel-debug-base-4.1.39-56.1 kernel-debug-base-debuginfo-4.1.39-56.1 kernel-debug-debuginfo-4.1.39-56.1 kernel-debug-debugsource-4.1.39-56.1 kernel-debug-devel-4.1.39-56.1 kernel-debug-devel-debuginfo-4.1.39-56.1 kernel-ec2-4.1.39-56.1 kernel-ec2-base-4.1.39-56.1 kernel-ec2-base-debuginfo-4.1.39-56.1 kernel-ec2-debuginfo-4.1.39-56.1 kernel-ec2-debugsource-4.1.39-56.1 kernel-ec2-devel-4.1.39-56.1 kernel-pv-4.1.39-56.1 kernel-pv-base-4.1.39-56.1 kernel-pv-base-debuginfo-4.1.39-56.1 kernel-pv-debuginfo-4.1.39-56.1 kernel-pv-debugsource-4.1.39-56.1 kernel-pv-devel-4.1.39-56.1 kernel-vanilla-4.1.39-56.1 kernel-vanilla-debuginfo-4.1.39-56.1 kernel-vanilla-debugsource-4.1.39-56.1 kernel-vanilla-devel-4.1.39-56.1 kernel-xen-4.1.39-56.1 kernel-xen-base-4.1.39-56.1 kernel-xen-base-debuginfo-4.1.39-56.1 kernel-xen-debuginfo-4.1.39-56.1 kernel-xen-debugsource-4.1.39-56.1 kernel-xen-devel-4.1.39-56.1 - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.39-56.1 kernel-default-base-4.1.39-56.1 kernel-default-base-debuginfo-4.1.39-56.1 kernel-default-debuginfo-4.1.39-56.1 kernel-default-debugsource-4.1.39-56.1 kernel-default-devel-4.1.39-56.1 kernel-obs-build-4.1.39-56.3 kernel-obs-build-debugsource-4.1.39-56.3 kernel-obs-qa-4.1.39-56.1 kernel-syms-4.1.39-56.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.39-56.1 kernel-docs-4.1.39-56.2 kernel-docs-html-4.1.39-56.2 kernel-docs-pdf-4.1.39-56.2 kernel-macros-4.1.39-56.1 kernel-source-4.1.39-56.1 kernel-source-vanilla-4.1.39-56.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.39-56.1 kernel-pae-base-4.1.39-56.1 kernel-pae-base-debuginfo-4.1.39-56.1 kernel-pae-debuginfo-4.1.39-56.1 kernel-pae-debugsource-4.1.39-56.1 kernel-pae-devel-4.1.39-56.1 References: https://www.suse.com/security/cve/CVE-2016-10318.html https://www.suse.com/security/cve/CVE-2017-2671.html https://www.suse.com/security/cve/CVE-2017-7187.html https://www.suse.com/security/cve/CVE-2017-7261.html https://www.suse.com/security/cve/CVE-2017-7294.html https://www.suse.com/security/cve/CVE-2017-7308.html https://www.suse.com/security/cve/CVE-2017-7616.html https://www.suse.com/security/cve/CVE-2017-7618.html https://bugzilla.suse.com/1012829 https://bugzilla.suse.com/1012876 https://bugzilla.suse.com/1028415 https://bugzilla.suse.com/1030213 https://bugzilla.suse.com/1031003 https://bugzilla.suse.com/1031052 https://bugzilla.suse.com/1031440 https://bugzilla.suse.com/1031579 https://bugzilla.suse.com/1032435 https://bugzilla.suse.com/1033336 https://bugzilla.suse.com/1033340 https://bugzilla.suse.com/1033518 https://bugzilla.suse.com/1034670 https://bugzilla.suse.com/930399 https://bugzilla.suse.com/970083

1 0

openSUSE-RU-2017:1214-1: important: Recommended update for ruby2.1
by maintenance＠opensuse.org 08 May '17

08 May '17

openSUSE Recommended Update: Recommended update for ruby2.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1214-1 Rating: important References: #1014863 #1035988 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for ruby2.1 fixes a regression introduced by a previous update that was intended to fix insufficient support for domain wildcards in the $no_proxy environment variable. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-556=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-556=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libruby2_1-2_1-2.1.9-8.6.1 libruby2_1-2_1-debuginfo-2.1.9-8.6.1 ruby2.1-2.1.9-8.6.1 ruby2.1-debuginfo-2.1.9-8.6.1 ruby2.1-debugsource-2.1.9-8.6.1 ruby2.1-devel-2.1.9-8.6.1 ruby2.1-devel-extra-2.1.9-8.6.1 ruby2.1-doc-2.1.9-8.6.1 ruby2.1-stdlib-2.1.9-8.6.1 ruby2.1-stdlib-debuginfo-2.1.9-8.6.1 - openSUSE Leap 42.2 (noarch): ruby2.1-doc-ri-2.1.9-8.6.1 - openSUSE Leap 42.1 (i586 x86_64): libruby2_1-2_1-2.1.9-13.1 libruby2_1-2_1-debuginfo-2.1.9-13.1 ruby2.1-2.1.9-13.1 ruby2.1-debuginfo-2.1.9-13.1 ruby2.1-debugsource-2.1.9-13.1 ruby2.1-devel-2.1.9-13.1 ruby2.1-devel-extra-2.1.9-13.1 ruby2.1-doc-2.1.9-13.1 ruby2.1-stdlib-2.1.9-13.1 ruby2.1-stdlib-debuginfo-2.1.9-13.1 - openSUSE Leap 42.1 (noarch): ruby2.1-doc-ri-2.1.9-13.1 References: https://bugzilla.suse.com/1014863 https://bugzilla.suse.com/1035988

1 0

openSUSE-RU-2017:1213-1: Recommended update for nfs-utils
by maintenance＠opensuse.org 08 May '17

08 May '17

openSUSE Recommended Update: Recommended update for nfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1213-1 Rating: low References: #1005609 #1019211 #1028376 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for nfs-utils fixes the following issues: - When updating from SLES 12 to 12-SP1, enable nfsserver.service if the old SysV service "nfsserver" was enabled. Ditto for nfs.service and "nfs". (bsc#1028376) - Only require a filesystem to be mounted if it isn't marked 'noauto' in /etc/fstab. (bsc#1019211) - Move rpc.svcgssd and corresponding man page from nfs-client package to nfs-kernel-server. For NFSv4.0 this is needed on client as well as the server to support the back-channel. (bsc#1005609) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-550=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): nfs-client-1.3.0-29.1 nfs-client-debuginfo-1.3.0-29.1 nfs-doc-1.3.0-29.1 nfs-kernel-server-1.3.0-29.1 nfs-kernel-server-debuginfo-1.3.0-29.1 nfs-utils-debugsource-1.3.0-29.1 References: https://bugzilla.suse.com/1005609 https://bugzilla.suse.com/1019211 https://bugzilla.suse.com/1028376

1 0

openSUSE-SU-2017:1212-1: moderate: Security update for libressl
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1212-1 Rating: moderate References: #1019334 #968050 Cross-References: CVE-2016-0702 CVE-2016-7056 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libressl to version 2.5.1 fixes the following issues: These security issues were fixed: - CVE-2016-0702: Prevent side channel attack on modular exponentiation (boo#968050). - CVE-2016-7056: Avoid a side-channel cache-timing attack that can leak the ECDSA private keys when signing (boo#1019334). These non-security issues were fixed: - Detect zero-length encrypted session data early - Curve25519 Key Exchange support. - Support for alternate chains for certificate verification. - Added EVP interface for MD5+SHA1 hashes - Fixed DTLS client failures when the server sends a certificate request. - Corrected handling of padding when upgrading an SSLv2 challenge into an SSLv3/TLS connection. - Allowed protocols and ciphers to be set on a TLS config object in libtls. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-560=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libcrypto41-2.5.3-13.1 libcrypto41-debuginfo-2.5.3-13.1 libressl-2.5.3-13.1 libressl-debuginfo-2.5.3-13.1 libressl-debugsource-2.5.3-13.1 libressl-devel-2.5.3-13.1 libssl43-2.5.3-13.1 libssl43-debuginfo-2.5.3-13.1 libtls15-2.5.3-13.1 libtls15-debuginfo-2.5.3-13.1 - openSUSE Leap 42.1 (noarch): libressl-devel-doc-2.5.3-13.1 - openSUSE Leap 42.1 (x86_64): libcrypto41-32bit-2.5.3-13.1 libcrypto41-debuginfo-32bit-2.5.3-13.1 libressl-devel-32bit-2.5.3-13.1 libssl43-32bit-2.5.3-13.1 libssl43-debuginfo-32bit-2.5.3-13.1 libtls15-32bit-2.5.3-13.1 libtls15-debuginfo-32bit-2.5.3-13.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-7056.html https://bugzilla.suse.com/1019334 https://bugzilla.suse.com/968050

1 0

openSUSE-SU-2017:1211-1: moderate: Security update for libressl
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1211-1 Rating: moderate References: #1019334 #968050 Cross-References: CVE-2016-0702 CVE-2016-7056 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libressl to version 2.5.1 fixes the following issues: These security issues were fixed: - CVE-2016-0702: Prevent side channel attack on modular exponentiation (boo#968050). - CVE-2016-7056: Avoid a side-channel cache-timing attack that can leak the ECDSA private keys when signing (boo#1019334). These non-security issues were fixed: - Detect zero-length encrypted session data early - Curve25519 Key Exchange support. - Support for alternate chains for certificate verification. - Added EVP interface for MD5+SHA1 hashes - Fixed DTLS client failures when the server sends a certificate request. - Corrected handling of padding when upgrading an SSLv2 challenge into an SSLv3/TLS connection. - Allowed protocols and ciphers to be set on a TLS config object in libtls. For additional changes please refer to the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-561=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libcrypto41-2.5.3-5.3.1 libcrypto41-debuginfo-2.5.3-5.3.1 libressl-2.5.3-5.3.1 libressl-debuginfo-2.5.3-5.3.1 libressl-debugsource-2.5.3-5.3.1 libressl-devel-2.5.3-5.3.1 libssl43-2.5.3-5.3.1 libssl43-debuginfo-2.5.3-5.3.1 libtls15-2.5.3-5.3.1 libtls15-debuginfo-2.5.3-5.3.1 - openSUSE Leap 42.2 (noarch): libressl-devel-doc-2.5.3-5.3.1 - openSUSE Leap 42.2 (x86_64): libcrypto41-32bit-2.5.3-5.3.1 libcrypto41-debuginfo-32bit-2.5.3-5.3.1 libressl-devel-32bit-2.5.3-5.3.1 libssl43-32bit-2.5.3-5.3.1 libssl43-debuginfo-32bit-2.5.3-5.3.1 libtls15-32bit-2.5.3-5.3.1 libtls15-debuginfo-32bit-2.5.3-5.3.1 References: https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-7056.html https://bugzilla.suse.com/1019334 https://bugzilla.suse.com/968050

1 0

openSUSE-SU-2017:1210-1: moderate: Security update for zziplib
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for zziplib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1210-1 Rating: moderate References: #1024517 #1024528 #1024531 #1024532 #1024533 #1024534 #1024535 #1024536 #1024537 #1024539 Cross-References: CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5977 CVE-2017-5978 CVE-2017-5979 CVE-2017-5980 CVE-2017-5981 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: This update for zziplib fixes the following issues: Secuirty issues fixed: - CVE-2017-5974: heap-based buffer overflow in __zzip_get32 (fetch.c) (bsc#1024517) - CVE-2017-5975: heap-based buffer overflow in __zzip_get64 (fetch.c) (bsc#1024528) - CVE-2017-5976: heap-based buffer overflow in zzip_mem_entry_extra_block (memdisk.c) (bsc#1024531) - CVE-2017-5977: invalid memory read in zzip_mem_entry_extra_block (memdisk.c) (bsc#1024534) - CVE-2017-5978: out of bounds read in zzip_mem_entry_new (memdisk.c) (bsc#1024533) - CVE-2017-5979: NULL pointer dereference in prescan_entry (fseeko.c) (bsc#1024535) - CVE-2017-5980: NULL pointer dereference in zzip_mem_entry_new (memdisk.c) (bsc#1024536) - CVE-2017-5981: assertion failure in seeko.c (bsc#1024539) - NULL pointer dereference in main (unzzipcat-mem.c) (bsc#1024532) - NULL pointer dereference in main (unzzipcat.c) (bsc#1024537) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-554=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-554=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libzzip-0-13-0.13.62-10.3.1 libzzip-0-13-debuginfo-0.13.62-10.3.1 zziplib-debugsource-0.13.62-10.3.1 zziplib-devel-0.13.62-10.3.1 zziplib-devel-debuginfo-0.13.62-10.3.1 - openSUSE Leap 42.2 (x86_64): libzzip-0-13-32bit-0.13.62-10.3.1 libzzip-0-13-debuginfo-32bit-0.13.62-10.3.1 zziplib-devel-32bit-0.13.62-10.3.1 zziplib-devel-debuginfo-32bit-0.13.62-10.3.1 - openSUSE Leap 42.1 (i586 x86_64): libzzip-0-13-0.13.62-10.1 libzzip-0-13-debuginfo-0.13.62-10.1 zziplib-debugsource-0.13.62-10.1 zziplib-devel-0.13.62-10.1 zziplib-devel-debuginfo-0.13.62-10.1 - openSUSE Leap 42.1 (x86_64): libzzip-0-13-32bit-0.13.62-10.1 libzzip-0-13-debuginfo-32bit-0.13.62-10.1 zziplib-devel-32bit-0.13.62-10.1 zziplib-devel-debuginfo-32bit-0.13.62-10.1 References: https://www.suse.com/security/cve/CVE-2017-5974.html https://www.suse.com/security/cve/CVE-2017-5975.html https://www.suse.com/security/cve/CVE-2017-5976.html https://www.suse.com/security/cve/CVE-2017-5977.html https://www.suse.com/security/cve/CVE-2017-5978.html https://www.suse.com/security/cve/CVE-2017-5979.html https://www.suse.com/security/cve/CVE-2017-5980.html https://www.suse.com/security/cve/CVE-2017-5981.html https://bugzilla.suse.com/1024517 https://bugzilla.suse.com/1024528 https://bugzilla.suse.com/1024531 https://bugzilla.suse.com/1024532 https://bugzilla.suse.com/1024533 https://bugzilla.suse.com/1024534 https://bugzilla.suse.com/1024535 https://bugzilla.suse.com/1024536 https://bugzilla.suse.com/1024537 https://bugzilla.suse.com/1024539

1 0

openSUSE-SU-2017:1209-1: important: Security update for mysql-community-server
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1209-1 Rating: important References: #1020976 #1022428 #1029014 #1029396 #1034850 #889126 Cross-References: CVE-2016-5483 CVE-2017-3302 CVE-2017-3305 CVE-2017-3308 CVE-2017-3309 CVE-2017-3329 CVE-2017-3450 CVE-2017-3452 CVE-2017-3453 CVE-2017-3456 CVE-2017-3461 CVE-2017-3462 CVE-2017-3463 CVE-2017-3464 CVE-2017-3599 CVE-2017-3600 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for mysql-community-server to version 5.6.36 fixes the following issues: These security issues were fixed: - CVE-2016-5483: Mysqldump failed to properly quote certain identifiers in SQL statements written to the dump output, allowing for execution of arbitrary commands (bsc#1029014) - CVE-2017-3305: MySQL client sent authentication request unencrypted even if SSL was required (aka Ridddle) (bsc#1029396). - CVE-2017-3308: Unspecified vulnerability in Server: DML (boo#1034850) - CVE-2017-3309: Unspecified vulnerability in Server: Optimizer (boo#1034850) - CVE-2017-3329: Unspecified vulnerability in Server: Thread (boo#1034850) - CVE-2017-3453: Unspecified vulnerability in Server: Optimizer (boo#1034850) - CVE-2017-3456: Unspecified vulnerability in Server: DML (boo#1034850) - CVE-2017-3461: Unspecified vulnerability in Server: Security (boo#1034850) - CVE-2017-3462: Unspecified vulnerability in Server: Security (boo#1034850) - CVE-2017-3463: Unspecified vulnerability in Server: Security (boo#1034850) - CVE-2017-3464: Unspecified vulnerability in Server: DDL (boo#1034850) - CVE-2017-3302: Crash in libmysqlclient.so (bsc#1022428). - CVE-2017-3450: Unspecified vulnerability Server: Memcached - CVE-2017-3452: Unspecified vulnerability Server: Optimizer - CVE-2017-3599: Unspecified vulnerability Server: Pluggable Auth - CVE-2017-3600: Unspecified vulnerability in Client: mysqldump (boo#1034850) - '--ssl-mode=REQUIRED' can be specified to require a secure connection (it fails if a secure connection cannot be obtained) These non-security issues were fixed: - Set the default umask to 077 in mysql-systemd-helper (boo#1020976) - Change permissions of the configuration dir/files to 755/644. Please note that storing the password in the /etc/my.cnf file is not safe. Use for example an option file that is accessible only by yourself (boo#889126) For more information please see http://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-36.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-555=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-555=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libmysql56client18-5.6.36-24.3.3 libmysql56client18-debuginfo-5.6.36-24.3.3 libmysql56client_r18-5.6.36-24.3.3 mysql-community-server-5.6.36-24.3.3 mysql-community-server-bench-5.6.36-24.3.3 mysql-community-server-bench-debuginfo-5.6.36-24.3.3 mysql-community-server-client-5.6.36-24.3.3 mysql-community-server-client-debuginfo-5.6.36-24.3.3 mysql-community-server-debuginfo-5.6.36-24.3.3 mysql-community-server-debugsource-5.6.36-24.3.3 mysql-community-server-errormessages-5.6.36-24.3.3 mysql-community-server-test-5.6.36-24.3.3 mysql-community-server-test-debuginfo-5.6.36-24.3.3 mysql-community-server-tools-5.6.36-24.3.3 mysql-community-server-tools-debuginfo-5.6.36-24.3.3 - openSUSE Leap 42.2 (x86_64): libmysql56client18-32bit-5.6.36-24.3.3 libmysql56client18-debuginfo-32bit-5.6.36-24.3.3 libmysql56client_r18-32bit-5.6.36-24.3.3 - openSUSE Leap 42.1 (i586 x86_64): libmysql56client18-5.6.36-25.3 libmysql56client18-debuginfo-5.6.36-25.3 libmysql56client_r18-5.6.36-25.3 mysql-community-server-5.6.36-25.3 mysql-community-server-bench-5.6.36-25.3 mysql-community-server-bench-debuginfo-5.6.36-25.3 mysql-community-server-client-5.6.36-25.3 mysql-community-server-client-debuginfo-5.6.36-25.3 mysql-community-server-debuginfo-5.6.36-25.3 mysql-community-server-debugsource-5.6.36-25.3 mysql-community-server-errormessages-5.6.36-25.3 mysql-community-server-test-5.6.36-25.3 mysql-community-server-test-debuginfo-5.6.36-25.3 mysql-community-server-tools-5.6.36-25.3 mysql-community-server-tools-debuginfo-5.6.36-25.3 - openSUSE Leap 42.1 (x86_64): libmysql56client18-32bit-5.6.36-25.3 libmysql56client18-debuginfo-32bit-5.6.36-25.3 libmysql56client_r18-32bit-5.6.36-25.3 References: https://www.suse.com/security/cve/CVE-2016-5483.html https://www.suse.com/security/cve/CVE-2017-3302.html https://www.suse.com/security/cve/CVE-2017-3305.html https://www.suse.com/security/cve/CVE-2017-3308.html https://www.suse.com/security/cve/CVE-2017-3309.html https://www.suse.com/security/cve/CVE-2017-3329.html https://www.suse.com/security/cve/CVE-2017-3450.html https://www.suse.com/security/cve/CVE-2017-3452.html https://www.suse.com/security/cve/CVE-2017-3453.html https://www.suse.com/security/cve/CVE-2017-3456.html https://www.suse.com/security/cve/CVE-2017-3461.html https://www.suse.com/security/cve/CVE-2017-3462.html https://www.suse.com/security/cve/CVE-2017-3463.html https://www.suse.com/security/cve/CVE-2017-3464.html https://www.suse.com/security/cve/CVE-2017-3599.html https://www.suse.com/security/cve/CVE-2017-3600.html https://bugzilla.suse.com/1020976 https://bugzilla.suse.com/1022428 https://bugzilla.suse.com/1029014 https://bugzilla.suse.com/1029396 https://bugzilla.suse.com/1034850 https://bugzilla.suse.com/889126

1 0

openSUSE-RU-2017:1208-1: moderate: Recommended update for mksh
by maintenance＠opensuse.org 08 May '17

08 May '17

openSUSE Recommended Update: Recommended update for mksh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1208-1 Rating: moderate References: #1023419 #1029664 #1035233 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update provides mksh R50f, which brings several fixes and enhancements: - Fix printing of negative integer values with 'print -R'. (bsc#1023419) - Make unset HISTFILE actually work. (bsc#1029664) - Do not permit += from environment. (bsc#1029664) - Handle integer base out of band like ksh93 does. - Protect standard code (predefined aliases, internal code, aliases and functions in dot.mkshrc) from being overridden by aliases and, in some cases, shell functions. - Implement GNU bash's enable for dot.mkshrc using magic aliases to redirect the builtins to external utilities; this differs from GNU bash in that enable takes precedence over functions. - Move unaliasing an identifier when defining a POSIX-style function with the same name into lksh, for compatibility. - Korn shell style functions now have locally scoped shell options. - Fix read -n-1 to not be identical to read -N-1. - Several fixes and improvements to lksh(1) and mksh(1) man pages. - Fix issues with IFS='\' read. - Fix integer overflows related to file descriptor parsing, reduce memory usage for I/O redirs. - Fix miscalculating required memory for encoding the double-quoted parts of a here document or here string delimiter, leading to a buffer overflow. - Add options -a argv0 and -c to exec. - Prevent use-after-free when hitting multiple errors unwinding. - Fix use of $* and $@ in scalar context: within [[ ... ]] and after case and in here documents. - Fix set -x in PS4 expansion infinite loop. - Fix rare infinite loop with invalid UTF-8 in the edit buffer. - Make the cat(1) builtin also interruptible in the write loop, not just in the read loop. - We use update-alternatives so there is no need to obsolete ksh. For a comprehensive list of changes please refer to the package's change log. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-552=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-552=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): mksh-50f-6.3.1 mksh-debuginfo-50f-6.3.1 mksh-debugsource-50f-6.3.1 - openSUSE Leap 42.1 (i586 x86_64): mksh-50f-6.1 mksh-debuginfo-50f-6.1 mksh-debugsource-50f-6.1 References: https://bugzilla.suse.com/1023419 https://bugzilla.suse.com/1029664 https://bugzilla.suse.com/1035233

1 0

openSUSE-SU-2017:1205-1: moderate: Security update for dpkg
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for dpkg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1205-1 Rating: moderate References: #957160 Cross-References: CVE-2015-0860 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dpkg fixes the following issues: This security issue was fixed: - CVE-2015-0860: Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in dpkg allowed remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggered a stack-based buffer overflow (bsc#957160). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-549=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dpkg-1.16.10-14.1 dpkg-debuginfo-1.16.10-14.1 dpkg-debugsource-1.16.10-14.1 dpkg-devel-1.16.10-14.1 update-alternatives-1.16.10-14.1 update-alternatives-debuginfo-1.16.10-14.1 update-alternatives-debugsource-1.16.10-14.1 - openSUSE Leap 42.1 (noarch): dpkg-lang-1.16.10-14.1 References: https://www.suse.com/security/cve/CVE-2015-0860.html https://bugzilla.suse.com/957160

1 0

openSUSE-SU-2017:1203-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 08 May '17

08 May '17

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1203-1 Rating: important References: #1018128 #1030263 #1032114 #1032120 #1036453 Cross-References: CVE-2016-10220 CVE-2016-9601 CVE-2017-5951 CVE-2017-7207 CVE-2017-8291 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for ghostscript fixes the following security vulnerabilities: CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453) CVE-2016-9601: An integer overflow in the bundled jbig2dec library could have been misused to cause a Denial-of-Service. (bsc#1018128) CVE-2016-10220: A NULL pointer dereference in the PDF Transparency module allowed remote attackers to cause a Denial-of-Service. (bsc#1032120) CVE-2017-5951: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document. (bsc#1032114) CVE-2017-7207: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document. (bsc#1030263) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-558=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-558=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ghostscript-9.15-11.3.1 ghostscript-debuginfo-9.15-11.3.1 ghostscript-debugsource-9.15-11.3.1 ghostscript-devel-9.15-11.3.1 ghostscript-mini-9.15-11.3.1 ghostscript-mini-debuginfo-9.15-11.3.1 ghostscript-mini-debugsource-9.15-11.3.1 ghostscript-mini-devel-9.15-11.3.1 ghostscript-x11-9.15-11.3.1 ghostscript-x11-debuginfo-9.15-11.3.1 - openSUSE Leap 42.1 (i586 x86_64): ghostscript-9.15-17.1 ghostscript-debuginfo-9.15-17.1 ghostscript-debugsource-9.15-17.1 ghostscript-devel-9.15-17.1 ghostscript-mini-9.15-17.1 ghostscript-mini-debuginfo-9.15-17.1 ghostscript-mini-debugsource-9.15-17.1 ghostscript-mini-devel-9.15-17.1 ghostscript-x11-9.15-17.1 ghostscript-x11-debuginfo-9.15-17.1 References: https://www.suse.com/security/cve/CVE-2016-10220.html https://www.suse.com/security/cve/CVE-2016-9601.html https://www.suse.com/security/cve/CVE-2017-5951.html https://www.suse.com/security/cve/CVE-2017-7207.html https://www.suse.com/security/cve/CVE-2017-8291.html https://bugzilla.suse.com/1018128 https://bugzilla.suse.com/1030263 https://bugzilla.suse.com/1032114 https://bugzilla.suse.com/1032120 https://bugzilla.suse.com/1036453

1 0