June 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1677-1: Recommended update for dump
by maintenance＠opensuse.org 26 Jun '17

26 Jun '17

openSUSE Recommended Update: Recommended update for dump ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1677-1 Rating: low References: #1034032 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dump fixes handling of files with leading zeros. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-736=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dump-0.4b43-19.3.1 dump-debuginfo-0.4b43-19.3.1 dump-debugsource-0.4b43-19.3.1 References: https://bugzilla.suse.com/1034032

1 0

openSUSE-SU-2017:1676-1: moderate: Security update for libmicrohttpd
by opensuse-security＠opensuse.org 26 Jun '17

26 Jun '17

openSUSE Security Update: Security update for libmicrohttpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1676-1 Rating: moderate References: #1041216 #854443 Cross-References: CVE-2013-7038 CVE-2013-7039 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libmicrohttpd fixes the following issues: - CVE-2013-7038: The MHD_http_unescape function in libmicrohttpd might have allowed remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read. (bsc#854443) - CVE-2013-7039: Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header. (bsc#854443) - Fixed various bugs found during a 2017 audit, which are more hardening measures and not security issues. (bsc#1041216) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-728=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libmicrohttpd-debugsource-0.9.30-5.3.1 libmicrohttpd-devel-0.9.30-5.3.1 libmicrohttpd10-0.9.30-5.3.1 libmicrohttpd10-debuginfo-0.9.30-5.3.1 libmicrospdy-devel-0.9.30-5.3.1 libmicrospdy0-0.9.30-5.3.1 libmicrospdy0-debuginfo-0.9.30-5.3.1 microspdy2http-0.9.30-5.3.1 microspdy2http-debuginfo-0.9.30-5.3.1 References: https://www.suse.com/security/cve/CVE-2013-7038.html https://www.suse.com/security/cve/CVE-2013-7039.html https://bugzilla.suse.com/1041216 https://bugzilla.suse.com/854443

1 0

openSUSE-RU-2017:1674-1: Recommended update for ocaml-gettext
by maintenance＠opensuse.org 26 Jun '17

26 Jun '17

openSUSE Recommended Update: Recommended update for ocaml-gettext ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1674-1 Rating: low References: #1031359 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ocaml-gettext fixes a dependency error in the stub-devel sub-package. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-739=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): ocaml-gettext-0.3.5-4.3.1 ocaml-gettext-camomile-0.3.5-4.3.1 ocaml-gettext-camomile-devel-0.3.5-4.3.1 ocaml-gettext-debuginfo-0.3.5-4.3.1 ocaml-gettext-debugsource-0.3.5-4.3.1 ocaml-gettext-devel-0.3.5-4.3.1 ocaml-gettext-stub-0.3.5-4.3.1 ocaml-gettext-stub-debuginfo-0.3.5-4.3.1 ocaml-gettext-stub-devel-0.3.5-4.3.1 References: https://bugzilla.suse.com/1031359

1 0

openSUSE-RU-2017:1673-1: moderate: Recommended update for links
by maintenance＠opensuse.org 26 Jun '17

26 Jun '17

openSUSE Recommended Update: Recommended update for links ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1673-1 Rating: moderate References: #1022468 #1022469 #946065 #992495 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for links fixes the following security and non-security issues: Links was updated to version 2.14: * Limit keepalive of ciphers with 64-bit block size to mitigate the SWEET32 attack boo#1022469 * Report home directory in the "Version" window * Improved tor hardening * Use keys 'P' and 'L' to scroll up and down * Fix a memory leak when copying the current url to clipboard * Fix crash when the user pressed Ctrl-G on a form field * Workaround for a bug in librsvg that makes mathematics on Wikipedia unreadable * Support fourth and fifth mouse button in gpm and framebuffer * Fixed bugs when downgrading SSL connection while https proxy or socks proxy is used * Security bug fixed: Do not load or render the content of "407 Proxy Authentication Required" reply when using https proxy. This avoids the FalseCONNECT attack. boo#1022468 Also, don't allow 401 and 407 responses to set cookies. * Pop openssl error stack on every error - make sure that SSL errors on one connection do not affect other connections * Never select directfb driver automatically unless started with the '-driver directfb' option previously patched: * Disable SSL compression to avoid the CRIME attack boo#1022469 drop links-nosslcomp.patch Links was updated to version 2.13: * Page up and page down scroll slightly less than a page * Use domain list from publicsuffix.org to prevent setting cookies on public domains. * Fix bug that allowed bla.com to register cookie for la.com or a.com * Fixed a bug in the X driver that characters with unicode codes 128-255 could not be entered with some locales * Security bug fixed: Use separate unix domain socket for anonymous instances, so that the anonymous instance won't connect to non-anonymous one [boo#992495] * <samp> element * In case of certification verification failure, don't pop up multiple dialog windows asking for the same server * Do not lookup .onion addresses directly, as specified by rfc7686 * Updated Polish Translation * Security enhancement: Warn if the SSL/TLS method was downgraded Links was updated to version 2.12: * Verify ssl certificates boo#946065 * Warn if server uses SSL2 or SSL3 protocol * Support SSL client certificates Links was updated to version 2.10: * SVG support using the rsvg library * Attach to existing links instance instead of creating a new instance * Detect image type based on the first few bytes rather than on content-type * Use OpenMP in the image scaler * Preallocate downloaded files on Linux * Support libevent and libev * SSL SNI now enabled upstream * Support keepalive on https connections Links was updated to 2.9: * Work around some screen-corruption bugs in the OpenVMS terminal driver * Support mouse wheel in framebuffer (unfortunatelly we can't support it in text mode because when we instruct gpm to send us the wheel event, gpm stops drawing the cursor when the mouse is moved). * Print "^" and "_" for <sub> and <sup> tags in text mode * An option to fake Firefox in the HTTP header. It modifies User-Agent and several other options to be more Firefox-like. This option is also automatically turned on when "Connect only via proxies or Socks (useful for tor)" is selected. It makes it safer to use Links with tor. * Fixed quadratic complexity in the text renderer when exteremely long lines were used * Do not print the character 0x9b if the display character set doesn't have it, because it is interpreted as a control character on the Linux console * An option to break long lines in <pre> sections * Consume less memory when 8-bit gamma correction is used * Updated the list of top level domains * Use malloc_trim to return unused memory to the system * Support RFC5987 for filenames * Support StaticColor in the X-window driver * Fix crash on OS/2 if image is wider than 10921 pixels * Use clock_gettime if available * The ability to set screen margins for text mode and framebuffer * Fix palette corruption on framebuffer when links instance was terminated while it was not active * Improve the gif decoder to accept more images * Increase the amount of data read from the socket, it improves speed when loading big images * Accept "text/xml" as html type Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-732=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): links-2.14-5.3.1 links-debuginfo-2.14-5.3.1 links-debugsource-2.14-5.3.1 References: https://bugzilla.suse.com/1022468 https://bugzilla.suse.com/1022469 https://bugzilla.suse.com/946065 https://bugzilla.suse.com/992495

1 0

openSUSE-RU-2017:1668-1: Recommended update for Opera
by maintenance＠opensuse.org 24 Jun '17

24 Jun '17

openSUSE Recommended Update: Recommended update for Opera ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1668-1 Rating: low References: Affected Products: openSUSE Leap 42.2:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides Opera 46.0.2597.26. For details see https://blogs.opera.com/desktop/changelog-for-46/#b2597.26 The following packaging changes are included: - Switch to unpacking RPM. - Recommend flash-player-ppapi instead of chromium-pepper-flash. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-725=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (x86_64): opera-46.0.2597.26-47.1 References:

1 0

openSUSE-SU-2017:1658-1: moderate: Security update for unrar
by opensuse-security＠opensuse.org 22 Jun '17

22 Jun '17

openSUSE Security Update: Security update for unrar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1658-1 Rating: moderate References: #1045315 Cross-References: CVE-2012-6706 Affected Products: openSUSE Leap 42.2:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for unrar to version 5.5 fixes the following issues: Version 5.5.5 * CVE-2012-6706: fixes VMSF_DELTA memory corruption (boo#1045315) see https://bugs.chromium.org/p/project-zero/issues/detail?id=1286&can=1&q=unra r&desc=2 Version 5.5.1 * Based on RAR 5.50 beta1 * Added extraction support for .LZ archives created by Lzip compressor. * Modern TAR tools can store high precision file times, lengthy file names and large file sizes in special PAX extended headers inside of TAR archive. Now WinRAR supports such PAX headers and uses them when extracting TAR archives. * unrar no longer fails to unpack files in ZIP archives compressed with XZ algorithm and encrypted with AES Version 5.4.5. * Based on final RAR 5.40. * If RAR recovery volumes (.rev files) are present in the same folder as usual RAR volumes, archive test command verifies .rev contents after completing testing .rar files. If you wish to test only .rev files without checking .rar volumes, you can run: `unrar t arcname.part1.rev`. * If -p switch is used without optional <pwd> parameter, a password can be also set with file redirection or pipe. * unrar treats 'arcname.partN' as 'arcname.partN.rar' if 'arcname.partN' does not exist and 'arcname.part#.rar' exists. For example, it is allowed to run: `unrar x arcname.part01` to start extraction from 'arcname.part01.rar'. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2:NonFree: zypper in -t patch openSUSE-2017-724=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2:NonFree (i586 x86_64): libunrar-devel-5.5.5-3.1 libunrar5_5_5-5.5.5-3.1 libunrar5_5_5-debuginfo-5.5.5-3.1 unrar-5.5.5-3.1 unrar-debuginfo-5.5.5-3.1 unrar-debugsource-5.5.5-3.1 References: https://www.suse.com/security/cve/CVE-2012-6706.html https://bugzilla.suse.com/1045315

1 0

openSUSE-RU-2017:1656-1: Recommended update for libosinfo, virt-manager
by maintenance＠opensuse.org 22 Jun '17

22 Jun '17

openSUSE Recommended Update: Recommended update for libosinfo, virt-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1656-1 Rating: low References: #1036935 #976796 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for libosinfo, virt-manager fixes the following issues: - virt-install(1) extra-args don't work because --location cannot validate install directory. (bsc#1036935) - virt-manager(1) does not show up in applications menu. (bsc#976796) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-720=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libosinfo-0.3.0-8.3.1 libosinfo-1_0-0-0.3.0-8.3.1 libosinfo-1_0-0-debuginfo-0.3.0-8.3.1 libosinfo-debuginfo-0.3.0-8.3.1 libosinfo-debugsource-0.3.0-8.3.1 libosinfo-devel-0.3.0-8.3.1 typelib-1_0-Libosinfo-1_0-0.3.0-8.3.1 - openSUSE Leap 42.2 (noarch): libosinfo-lang-0.3.0-8.3.1 virt-install-1.4.0-4.3.1 virt-manager-1.4.0-4.3.1 virt-manager-common-1.4.0-4.3.1 References: https://bugzilla.suse.com/1036935 https://bugzilla.suse.com/976796

1 0

openSUSE-RU-2017:1655-1: moderate: Recommended update for hwdata
by maintenance＠opensuse.org 22 Jun '17

22 Jun '17

openSUSE Recommended Update: Recommended update for hwdata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1655-1 Rating: moderate References: #1038809 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues: - Update to version 0.300. (bsc#1038809) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-721=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): hwdata-0.300-3.3.1 References: https://bugzilla.suse.com/1038809

1 0

openSUSE-RU-2017:1654-1: Recommended update for colord
by maintenance＠opensuse.org 22 Jun '17

22 Jun '17

openSUSE Recommended Update: Recommended update for colord ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1654-1 Rating: low References: #1024933 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for colord fixes its Apparmor profile (usr.lib.colord) to allow reading from and writing to /var/lib/colord/.cache. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-722=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): colord-1.3.3-2.3.1 colord-debuginfo-1.3.3-2.3.1 colord-debugsource-1.3.3-2.3.1 libcolord-devel-1.3.3-2.3.1 libcolord2-1.3.3-2.3.1 libcolord2-debuginfo-1.3.3-2.3.1 libcolorhug2-1.3.3-2.3.1 libcolorhug2-debuginfo-1.3.3-2.3.1 typelib-1_0-ColorHug-1_0-1.3.3-2.3.1 typelib-1_0-Colord-1_0-1.3.3-2.3.1 - openSUSE Leap 42.2 (noarch): colord-lang-1.3.3-2.3.1 - openSUSE Leap 42.2 (x86_64): libcolord2-32bit-1.3.3-2.3.1 libcolord2-debuginfo-32bit-1.3.3-2.3.1 References: https://bugzilla.suse.com/1024933

1 0

openSUSE-RU-2017:1651-1: Recommended update for cups
by maintenance＠opensuse.org 22 Jun '17

22 Jun '17

openSUSE Recommended Update: Recommended update for cups ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1651-1 Rating: low References: #1021133 #955432 #990045 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for cups fixes the following issues: - Avahi sends an ALL_FOR_NOW event when it finishes sending its cache contents. This patch makes cupsEnumDests finish when the signal is received so it doesn't block the caller until the timeout finishes. (bsc#955432, fate#322052) - The scheduler didn't log messages for jobs at LogLevel "info". (bsc#1021133, bsc#990045) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-723=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): cups-1.7.5-8.3.1 cups-client-1.7.5-8.3.1 cups-client-debuginfo-1.7.5-8.3.1 cups-ddk-1.7.5-8.3.1 cups-ddk-debuginfo-1.7.5-8.3.1 cups-debuginfo-1.7.5-8.3.1 cups-debugsource-1.7.5-8.3.1 cups-devel-1.7.5-8.3.1 cups-libs-1.7.5-8.3.1 cups-libs-debuginfo-1.7.5-8.3.1 - openSUSE Leap 42.2 (x86_64): cups-libs-32bit-1.7.5-8.3.1 cups-libs-debuginfo-32bit-1.7.5-8.3.1 References: https://bugzilla.suse.com/1021133 https://bugzilla.suse.com/955432 https://bugzilla.suse.com/990045

1 0

openSUSE-SU-2017:1650-1: moderate: Security update for go
by opensuse-security＠opensuse.org 22 Jun '17

22 Jun '17

openSUSE Security Update: Security update for go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1650-1 Rating: moderate References: #1040618 Cross-References: CVE-2017-8932 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for go fixes the following issues: - CVE-2017-8932: Add patch to fix carry bug in x86-64 P-256 implementation (boo#1040618) Please note that go applications will need to be rebuilt to get this fix, as all go applications are statically linked. As we are regulary releasing updates to our distribution go applications they are not specifically included here. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-719=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): go-1.6.2-23.3.3 go-debuginfo-1.6.2-23.3.3 go-debugsource-1.6.2-23.3.3 go-doc-1.6.2-23.3.3 References: https://www.suse.com/security/cve/CVE-2017-8932.html https://bugzilla.suse.com/1040618

1 0

openSUSE-SU-2017:1649-1: moderate: Security update for go
by opensuse-security＠opensuse.org 22 Jun '17

22 Jun '17

openSUSE Security Update: Security update for go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1649-1 Rating: moderate References: #1040618 Cross-References: CVE-2017-8932 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for go fixes the following issues: - CVE-2017-8932: Add patch to fix carry bug in x86-64 P-256 implementation (boo#1040618) Please note that go applications will need to be rebuilt to get this fix, as all go applications are statically linked. As we are regulary releasing updates to our distribution go applications they are not specifically included here. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-719=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): go-1.7.0-12.1 go-1.7.0-5.2 go-doc-1.7.0-12.1 go-doc-1.7.0-5.2 References: https://www.suse.com/security/cve/CVE-2017-8932.html https://bugzilla.suse.com/1040618

1 0

openSUSE-RU-2017:1647-1: Recommended update for tryton
by maintenance＠opensuse.org 21 Jun '17

21 Jun '17

openSUSE Recommended Update: Recommended update for tryton ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1647-1 Rating: low References: #1043757 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides tryton 3.8.15 and trytond 3.8.12 and various improvements and bug fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-718=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): tryton-3.8.15-10.6.1 trytond-3.8.12-9.9.1 References: https://bugzilla.suse.com/1043757

1 0

openSUSE-SU-2017:1638-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

openSUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1638-1 Rating: important References: #1038709 #1038711 #1038713 #995374 Cross-References: CVE-2016-6329 CVE-2017-7478 CVE-2017-7479 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for openvpn fixes the following issues: - CVE-2016-6329: Show which ciphers should no longer be used in openvpn --show-ciphers (bsc#995374) - CVE-2017-7478: openvpn: Authenticated user can DoS server by using a big payload in P_CONTROL (bsc#1038709) - CVE-2017-7479: openvpn: Denial of Service due to Exhaustion of Packet-ID counter (bsc#1038711) - Hardening measures found by internal audit (bsc#1038713) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-717=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): openvpn-2.3.8-8.6.1 openvpn-auth-pam-plugin-2.3.8-8.6.1 openvpn-auth-pam-plugin-debuginfo-2.3.8-8.6.1 openvpn-debuginfo-2.3.8-8.6.1 openvpn-debugsource-2.3.8-8.6.1 openvpn-devel-2.3.8-8.6.1 openvpn-down-root-plugin-2.3.8-8.6.1 openvpn-down-root-plugin-debuginfo-2.3.8-8.6.1 References: https://www.suse.com/security/cve/CVE-2016-6329.html https://www.suse.com/security/cve/CVE-2017-7478.html https://www.suse.com/security/cve/CVE-2017-7479.html https://bugzilla.suse.com/1038709 https://bugzilla.suse.com/1038711 https://bugzilla.suse.com/1038713 https://bugzilla.suse.com/995374

1 0

openSUSE-SU-2017:1633-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1633-1 Rating: important References: #1012060 #1012382 #1012422 #1012829 #1015452 #1022595 #1031796 #1032339 #1036638 #1037840 #1038085 #1039348 #1039900 #1040855 #1041242 #1041431 #1041810 #1042286 #1042356 #1042421 #1042517 #1042535 #1042536 #1042886 #1043014 #1043231 #1043236 #1043371 #1043467 #1043598 #1043935 #1044015 #1044125 #1044532 #863764 #966321 #966339 #971975 #995542 Cross-References: CVE-2017-1000364 CVE-2017-1000380 CVE-2017-7346 CVE-2017-9242 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has 35 fixes is now available. Description: The openSUSE Leap 42.2 kernel was updated to 4.4.72 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010) (bnc#1039348). - CVE-2017-1000380: sound/core/timer.c in the Linux kernel is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time (bnc#1044125). - CVE-2017-7346: The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate certain levels data, which allowed local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031796). - CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel is too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bnc#1041431). The following non-security bugs were fixed: - ASoC: Intel: Skylake: Uninitialized variable in probe_codec() (bsc#1043231). - IB/core: Fix kernel crash during fail to initialize device (bsc#1022595 FATE#322350). - IB/core: For multicast functions, verify that LIDs are multicast LIDs (bsc#1022595 FATE#322350). - IB/core: If the MGID/MLID pair is not on the list return an error (bsc#1022595 FATE#322350). - IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow (bsc#1022595 FATE#322350). - Make __xfs_xattr_put_listen preperly report errors (bsc#1041242). - NFS: Fix an LOCK/OPEN race when unlinking an open file (git-fixes). - NFSv4: Fix the underestimation of delegation XDR space reservation (git-fixes). - NFSv4: fix a reference leak caused WARNING messages (git-fixes). - PM / QoS: Fix memory leak on resume_latency.notifiers (bsc#1043231). - SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use (git-fixes). - SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() (git-fixes). - Update patches.fixes/xen-silence-efi-error-messge.patch (bnc#1039900). - [media] vb2: Fix an off by one error in 'vb2_plane_vaddr' (bsc#1043231). - bcache: fix calling ida_simple_remove() with incorrect minor (bsc#1038085). - bna: add missing per queue ethtool stat (bsc#966321 FATE#320156). - bna: integer overflow bug in debugfs (bsc#966321 FATE#320156). - bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal (bsc#1042286). - bonding: do not use stale speed and duplex information (bsc#1042286). - bonding: prevent out of bound accesses (bsc#1042286). - brcmfmac: add fallback for devices that do not report per-chain values (bsc#1043231). - brcmfmac: avoid writing channel out of allocated array (bsc#1043231). - ceph: fix potential use-after-free (bsc#1043371). - ceph: memory leak in ceph_direct_read_write callback (bsc#1041810). - cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode (bsc#1012829). - cgroup: remove redundant cleanup in css_create (bsc#1012829). - cifs: small underflow in cnvrtDosUnixTm() (bnc#1043935). - drm/mgag200: Fix to always set HiPri for G200e4 (bsc#1015452, bsc#995542). - drm/nouveau/tmr: fully separate alarm execution/pending lists (bsc#1043467). - efi: Do not issue error message when booted under Xen (bnc#1036638). - ext4: fix data corruption for mmap writes (bsc#1012829). - ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO (bsc#1012829). - fuse: fix clearing suid, sgid for chown() (bsc#1012829). - ibmvnic: Check adapter state during ibmvnic_poll (fate#322021, bsc#1040855). - ibmvnic: Deactivate RX pool buffer replenishment on H_CLOSED (fate#322021, bsc#1040855). - ibmvnic: Fix cleanup of SKB's on driver close (fate#322021, bsc#1040855). - ibmvnic: Halt TX and report carrier off on H_CLOSED return code (fate#322021, bsc#1040855). - ibmvnic: Handle failover after failed init crq (fate#322021, bsc#1040855). - ibmvnic: Non-fatal error handling (fate#322021, bsc#1040855). - ibmvnic: Reset sub-crqs during driver reset (fate#322021, bsc#1040855). - ibmvnic: Reset the CRQ queue during driver reset (fate#322021, bsc#1040855). - ibmvnic: Reset tx/rx pools on driver reset (fate#322021, bsc#1040855). - ibmvnic: Return failure on attempted mtu change (bsc#1043236). - ibmvnic: Send gratuitous arp on reset (fate#322021, bsc#1040855). - ibmvnic: Track state of adapter napis (fate#322021, bsc#1040855). - ipv6: Do not use ufo handling on later transformed packets (bsc#1042286). - ipv6: fix endianness error in icmpv6_err (bsc#1042286). - kABI: protect struct fib_info (kabi). - kABI: protect struct pglist_data (kabi). - kABI: protect struct xlog (bsc#1043598). - kernel-binary.spec: Propagate MAKE_ARGS to %build (bsc#1012422) - l2tp: fix race in l2tp_recv_common() (bsc#1042286). - libceph: NULL deref on crush_decode() error path (bsc#1044015). - md: allow creation of mdNNN arrays via md_mod/parameters/new_array (bsc#1032339). - md: support disabling of create-on-open semantics (bsc#1032339). - mm/hugetlb: check for reserved hugepages during memory offline (bnc#971975 VM -- git fixes). - mm/hugetlb: fix incorrect hugepages count during mem hotplug (bnc#971975 VM -- git fixes). - mmc: Downgrade error level (bsc#1042536). - module: fix memory leak on early load_module() failures (bsc#1043014). - net: bridge: start hello timer only if device is up (bnc#1012382). - net: fix compile error in skb_orphan_partial() (bnc#1012382). - net: ipv6: set route type for anycast routes (bsc#1042286). - netfilter: nf_conntrack_sip: extend request line validation (bsc#1042286). - netfilter: nf_ct_expect: remove the redundant slash when policy name is empty (bsc#1042286). - netfilter: nf_dup_ipv6: set again FLOWI_FLAG_KNOWN_NH at flowi6_flags (bsc#1042286). - netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register (bsc#1042286). - netfilter: nfnetlink_queue: reject verdict request from different portid (bsc#1042286). - netfilter: restart search if moved to other chain (bsc#1042286). - netfilter: use fwmark_reflect in nf_send_reset (bsc#1042286). - netxen_nic: set rcode to the return status from the call to netxen_issue_cmd (bsc#966339 FATE#320150). - nfs: Fix "Do not increment lock sequence ID after NFS4ERR_MOVED" (git-fixes). - nsfs: mark dentry with DCACHE_RCUACCESS (bsc#1012829). - nvme: submit nvme_admin_activate_fw to admin queue (bsc#1044532). - percpu: remove unused chunk_alloc parameter from pcpu_get_pages() (bnc#971975 VM -- git fixes). - perf/x86/intel/rapl: Make Knights Landings support functional (bsc#1042517). - powerpc/64: Fix flush_(d|i)cache_range() called from modules (bnc#863764 fate#315275, LTC#103998). - quota: fill in Q_XGETQSTAT inode information for inactive quotas (bsc#1042356). - radix-tree: fix radix_tree_iter_retry() for tagged iterators (bsc#1012829). - rpm/kernel-binary.spec: remove superfluous flags This should make build logs more readable and people adding more flags should have easier time finding a place to add them in the spec file. - rpm/kernel-spec-macros: Fix the check if there is no rebuild counter (bsc#1012060) - rtnl: reset calcit fptr in rtnl_unregister() (bsc#1042286). - series.conf: remove silly comment - tcp: account for ts offset only if tsecr not zero (bsc#1042286). - tcp: fastopen: accept data/FIN present in SYNACK message (bsc#1042286). - tcp: fastopen: avoid negative sk_forward_alloc (bsc#1042286). - tcp: fastopen: call tcp_fin() if FIN present in SYNACK (bsc#1042286). - tcp: fastopen: fix rcv_wup initialization for TFO server on SYN/data (bsc#1042286). - tpm: Downgrade error level (bsc#1042535). - udp: avoid ufo handling on IP payload compression packets (bsc#1042286). - udplite: call proper backlog handlers (bsc#1042286). - x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs (bsc#9048891). - xen/mce: do not issue error message for failed /dev/mcelog registration (bnc#1036638). - xen: add sysfs node for guest type (bnc#1037840). - xfrm: Fix memory leak of aead algorithm name (bsc#1042286). - xfs: add missing include dependencies to xfs_dir2.h (bsc#1042421). - xfs: do not warn on buffers not being recovered due to LSN (bsc#1043598). - xfs: fix xfs_mode_to_ftype() prototype (bsc#1043598). - xfs: log recovery tracepoints to track current lsn and buffer submission (bsc#1043598). - xfs: pass current lsn to log recovery buffer validation (bsc#1043598). - xfs: refactor log record unpack and data processing (bsc#1043598). - xfs: replace xfs_mode_to_ftype table with switch statement (bsc#1042421). - xfs: rework log recovery to submit buffers on LSN boundaries (bsc#1043598). - xfs: rework the inline directory verifiers (bsc#1042421). - xfs: sanity check directory inode di_size (bsc#1042421). - xfs: sanity check inode di_mode (bsc#1042421). - xfs: update metadata LSN in buffers during log recovery (bsc#1043598). - xfs: verify inline directory data forks (bsc#1042421). - zswap: do not param_set_charp while holding spinlock (VM Functionality, bsc#1042886). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-716=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): kernel-devel-4.4.72-18.12.1 kernel-docs-4.4.72-18.12.3 kernel-docs-html-4.4.72-18.12.3 kernel-docs-pdf-4.4.72-18.12.3 kernel-macros-4.4.72-18.12.1 kernel-source-4.4.72-18.12.1 kernel-source-vanilla-4.4.72-18.12.1 - openSUSE Leap 42.2 (x86_64): kernel-debug-4.4.72-18.12.2 kernel-debug-base-4.4.72-18.12.2 kernel-debug-base-debuginfo-4.4.72-18.12.2 kernel-debug-debuginfo-4.4.72-18.12.2 kernel-debug-debugsource-4.4.72-18.12.2 kernel-debug-devel-4.4.72-18.12.2 kernel-debug-devel-debuginfo-4.4.72-18.12.2 kernel-default-4.4.72-18.12.2 kernel-default-base-4.4.72-18.12.2 kernel-default-base-debuginfo-4.4.72-18.12.2 kernel-default-debuginfo-4.4.72-18.12.2 kernel-default-debugsource-4.4.72-18.12.2 kernel-default-devel-4.4.72-18.12.2 kernel-obs-build-4.4.72-18.12.2 kernel-obs-build-debugsource-4.4.72-18.12.2 kernel-obs-qa-4.4.72-18.12.1 kernel-syms-4.4.72-18.12.1 kernel-vanilla-4.4.72-18.12.2 kernel-vanilla-base-4.4.72-18.12.2 kernel-vanilla-base-debuginfo-4.4.72-18.12.2 kernel-vanilla-debuginfo-4.4.72-18.12.2 kernel-vanilla-debugsource-4.4.72-18.12.2 kernel-vanilla-devel-4.4.72-18.12.2 References: https://www.suse.com/security/cve/CVE-2017-1000364.html https://www.suse.com/security/cve/CVE-2017-1000380.html https://www.suse.com/security/cve/CVE-2017-7346.html https://www.suse.com/security/cve/CVE-2017-9242.html https://bugzilla.suse.com/1012060 https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1012422 https://bugzilla.suse.com/1012829 https://bugzilla.suse.com/1015452 https://bugzilla.suse.com/1022595 https://bugzilla.suse.com/1031796 https://bugzilla.suse.com/1032339 https://bugzilla.suse.com/1036638 https://bugzilla.suse.com/1037840 https://bugzilla.suse.com/1038085 https://bugzilla.suse.com/1039348 https://bugzilla.suse.com/1039900 https://bugzilla.suse.com/1040855 https://bugzilla.suse.com/1041242 https://bugzilla.suse.com/1041431 https://bugzilla.suse.com/1041810 https://bugzilla.suse.com/1042286 https://bugzilla.suse.com/1042356 https://bugzilla.suse.com/1042421 https://bugzilla.suse.com/1042517 https://bugzilla.suse.com/1042535 https://bugzilla.suse.com/1042536 https://bugzilla.suse.com/1042886 https://bugzilla.suse.com/1043014 https://bugzilla.suse.com/1043231 https://bugzilla.suse.com/1043236 https://bugzilla.suse.com/1043371 https://bugzilla.suse.com/1043467 https://bugzilla.suse.com/1043598 https://bugzilla.suse.com/1043935 https://bugzilla.suse.com/1044015 https://bugzilla.suse.com/1044125 https://bugzilla.suse.com/1044532 https://bugzilla.suse.com/863764 https://bugzilla.suse.com/966321 https://bugzilla.suse.com/966339 https://bugzilla.suse.com/971975 https://bugzilla.suse.com/995542

1 0

openSUSE-SU-2017:1629-1: important: Security update for glibc
by opensuse-security＠opensuse.org 21 Jun '17

21 Jun '17

openSUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1629-1 Rating: important References: #1039357 #1040043 Cross-References: CVE-2017-1000366 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. [bsc#1039357] - A bug in glibc that could result in deadlocks between malloc() and fork() has been fixed. [bsc#1040043] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-715=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 i686 x86_64): glibc-2.22-4.9.1 glibc-debuginfo-2.22-4.9.1 glibc-debugsource-2.22-4.9.1 glibc-devel-2.22-4.9.1 glibc-devel-debuginfo-2.22-4.9.1 glibc-devel-static-2.22-4.9.1 glibc-locale-2.22-4.9.1 glibc-locale-debuginfo-2.22-4.9.1 glibc-profile-2.22-4.9.1 - openSUSE Leap 42.2 (i586 x86_64): glibc-extra-2.22-4.9.1 glibc-extra-debuginfo-2.22-4.9.1 glibc-utils-2.22-4.9.1 glibc-utils-debuginfo-2.22-4.9.1 glibc-utils-debugsource-2.22-4.9.1 nscd-2.22-4.9.1 nscd-debuginfo-2.22-4.9.1 - openSUSE Leap 42.2 (x86_64): glibc-32bit-2.22-4.9.1 glibc-debuginfo-32bit-2.22-4.9.1 glibc-devel-32bit-2.22-4.9.1 glibc-devel-debuginfo-32bit-2.22-4.9.1 glibc-devel-static-32bit-2.22-4.9.1 glibc-locale-32bit-2.22-4.9.1 glibc-locale-debuginfo-32bit-2.22-4.9.1 glibc-profile-32bit-2.22-4.9.1 glibc-utils-32bit-2.22-4.9.1 glibc-utils-debuginfo-32bit-2.22-4.9.1 - openSUSE Leap 42.2 (noarch): glibc-html-2.22-4.9.1 glibc-i18ndata-2.22-4.9.1 glibc-info-2.22-4.9.1 - openSUSE Leap 42.2 (i586): glibc-obsolete-2.22-4.9.1 glibc-obsolete-debuginfo-2.22-4.9.1 References: https://www.suse.com/security/cve/CVE-2017-1000366.html https://bugzilla.suse.com/1039357 https://bugzilla.suse.com/1040043

1 0

openSUSE-SU-2017:1625-1: important: Security update for exim
by opensuse-security＠opensuse.org 20 Jun '17

20 Jun '17

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1625-1 Rating: important References: #1044692 Cross-References: CVE-2017-1000369 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for exim fixes the following issues: - CVE-2017-1000369: Fixed a memory leak in exim commandline handling, which could be used to exhaust memory and make "stack crash" attacks likely. (boo#1044692) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-714=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): exim-4.86.2-10.3.1 exim-debuginfo-4.86.2-10.3.1 exim-debugsource-4.86.2-10.3.1 eximon-4.86.2-10.3.1 eximon-debuginfo-4.86.2-10.3.1 eximstats-html-4.86.2-10.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000369.html https://bugzilla.suse.com/1044692

1 0

openSUSE-RU-2017:1623-1: moderate: Recommended update for phpMyAdmin
by maintenance＠opensuse.org 20 Jun '17

20 Jun '17

openSUSE Recommended Update: Recommended update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1623-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for phpMyAdmin fixes a number of bugs: - Always execute tracking queries as controluser - Focus on SQL editor after inserting field name - Fixed broken links in setup - Database list Tooltips: Show wrong value - Fixed pagination while browsing resuls - Fixed outbound links in changelog.php - Do not include devel dependencies in the release - Do not show New as a database in database dropdown - Fixed handling of errors in AJAX requests - Fixed PHP error in case of invalid table preferences - Fixed PHP error on password change - Fix Refresh of Process List - Fix refresh of long queries - Improved handling of logout with disabled LoginCookieDeleteAll - Add support for MySQL 8.0 collations - Fixed rendering of phpMyAdmin logos - Properly report not working sessions - Fixed password check on server replication - Fixed grid editing time column - Fixed detection of Amazon RDS - Redirect user to last page that has any tables to display - Fix link to User accounts overview page - Fix error in query builder - Grid editing repeats action after error Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-713=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): phpMyAdmin-4.7.1-5.1 References:

1 0

openSUSE-SU-2017:1620-1: important: Security update for Mozilla based packages
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Security Update: Security update for Mozilla based packages ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1620-1 Rating: important References: #1040105 #1043960 Cross-References: CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7755 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7760 CVE-2017-7761 CVE-2017-7764 CVE-2017-7765 CVE-2017-7766 CVE-2017-7767 CVE-2017-7768 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for Mozilla Firefox, Thunderbird, and NSS fixes the following issues: Mozilla Firefox was updated to 52.2esr (boo#1043960) MFSA 2017-16: * CVE-2017-5472 (bmo#1365602) Use-after-free using destroyed node when regenerating trees * CVE-2017-7749 (bmo#1355039) Use-after-free during docshell reloading * CVE-2017-7750 (bmo#1356558) Use-after-free with track elements * CVE-2017-7751 (bmo#1363396) Use-after-free with content viewer listeners * CVE-2017-7752 (bmo#1359547) Use-after-free with IME input * CVE-2017-7754 (bmo#1357090) Out-of-bounds read in WebGL with ImageInfo object * CVE-2017-7755 (bmo#1361326) Privilege escalation through Firefox Installer with same directory DLL files (Windows only) * CVE-2017-7756 (bmo#1366595) Use-after-free and use-after-scope logging XHR header errors * CVE-2017-7757 (bmo#1356824) Use-after-free in IndexedDB * CVE-2017-7778, CVE-2017-7778, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777 Vulnerabilities in the Graphite 2 library * CVE-2017-7758 (bmo#1368490) Out-of-bounds read in Opus encoder * CVE-2017-7760 (bmo#1348645) File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service (Windows only) * CVE-2017-7761 (bmo#1215648) File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application (Windows only) * CVE-2017-7764 (bmo#1364283) Domain spoofing with combination of Canadian Syllabics and other unicode blocks * CVE-2017-7765 (bmo#1273265) Mark of the Web bypass when saving executable files (Windows only) * CVE-2017-7766 (bmo#1342742) File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service (Windows only) * CVE-2017-7767 (bmo#1336964) Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service (Windows only) * CVE-2017-7768 (bmo#1336979) 32 byte arbitrary file read through Mozilla Maintenance Service (Windows only) * CVE-2017-5470 Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 - remove -fno-inline-small-functions and explicitely optimize with -O2 for openSUSE > 13.2/Leap 42 to work with gcc7 (boo#1040105) Mozilla NSS was updated to NSS 3.28.5 * Implemented domain name constraints for CA: TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1. (bmo#1350859) * March 2017 batch of root CA changes (bmo#1350859) (version 2.14) CA certificates removed: O = Japanese Government, OU = ApplicationCA CN = WellsSecure Public Root Certificate Authority CN = TURKTRUST Elektronik Sertifika Hizmet H6 CN = Microsec e-Szigno Root CA certificates added: CN = D-TRUST Root CA 3 2013 CN = TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 java-1_8_0-openjdk was rebuild against NSS 3.28.5 to satisfy a runtime dependency. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-712=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): MozillaFirefox-52.2-57.12.2 MozillaFirefox-branding-upstream-52.2-57.12.2 MozillaFirefox-buildsymbols-52.2-57.12.2 MozillaFirefox-debuginfo-52.2-57.12.2 MozillaFirefox-debugsource-52.2-57.12.2 MozillaFirefox-devel-52.2-57.12.2 MozillaFirefox-translations-common-52.2-57.12.2 MozillaFirefox-translations-other-52.2-57.12.2 MozillaThunderbird-52.2-41.9.2 MozillaThunderbird-buildsymbols-52.2-41.9.2 MozillaThunderbird-debuginfo-52.2-41.9.2 MozillaThunderbird-debugsource-52.2-41.9.2 MozillaThunderbird-devel-52.2-41.9.2 MozillaThunderbird-translations-common-52.2-41.9.2 MozillaThunderbird-translations-other-52.2-41.9.2 java-1_8_0-openjdk-1.8.0.131-10.10.3 java-1_8_0-openjdk-accessibility-1.8.0.131-10.10.3 java-1_8_0-openjdk-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-debugsource-1.8.0.131-10.10.3 java-1_8_0-openjdk-demo-1.8.0.131-10.10.3 java-1_8_0-openjdk-demo-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-devel-1.8.0.131-10.10.3 java-1_8_0-openjdk-devel-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-headless-1.8.0.131-10.10.3 java-1_8_0-openjdk-headless-debuginfo-1.8.0.131-10.10.3 java-1_8_0-openjdk-src-1.8.0.131-10.10.3 libfreebl3-3.28.5-40.6.1 libfreebl3-debuginfo-3.28.5-40.6.1 libsoftokn3-3.28.5-40.6.1 libsoftokn3-debuginfo-3.28.5-40.6.1 mozilla-nss-3.28.5-40.6.1 mozilla-nss-certs-3.28.5-40.6.1 mozilla-nss-certs-debuginfo-3.28.5-40.6.1 mozilla-nss-debuginfo-3.28.5-40.6.1 mozilla-nss-debugsource-3.28.5-40.6.1 mozilla-nss-devel-3.28.5-40.6.1 mozilla-nss-sysinit-3.28.5-40.6.1 mozilla-nss-sysinit-debuginfo-3.28.5-40.6.1 mozilla-nss-tools-3.28.5-40.6.1 mozilla-nss-tools-debuginfo-3.28.5-40.6.1 - openSUSE Leap 42.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.131-10.10.3 - openSUSE Leap 42.2 (x86_64): libfreebl3-32bit-3.28.5-40.6.1 libfreebl3-debuginfo-32bit-3.28.5-40.6.1 libsoftokn3-32bit-3.28.5-40.6.1 libsoftokn3-debuginfo-32bit-3.28.5-40.6.1 mozilla-nss-32bit-3.28.5-40.6.1 mozilla-nss-certs-32bit-3.28.5-40.6.1 mozilla-nss-certs-debuginfo-32bit-3.28.5-40.6.1 mozilla-nss-debuginfo-32bit-3.28.5-40.6.1 mozilla-nss-sysinit-32bit-3.28.5-40.6.1 mozilla-nss-sysinit-debuginfo-32bit-3.28.5-40.6.1 References: https://www.suse.com/security/cve/CVE-2017-5470.html https://www.suse.com/security/cve/CVE-2017-5472.html https://www.suse.com/security/cve/CVE-2017-7749.html https://www.suse.com/security/cve/CVE-2017-7750.html https://www.suse.com/security/cve/CVE-2017-7751.html https://www.suse.com/security/cve/CVE-2017-7752.html https://www.suse.com/security/cve/CVE-2017-7754.html https://www.suse.com/security/cve/CVE-2017-7755.html https://www.suse.com/security/cve/CVE-2017-7756.html https://www.suse.com/security/cve/CVE-2017-7757.html https://www.suse.com/security/cve/CVE-2017-7758.html https://www.suse.com/security/cve/CVE-2017-7760.html https://www.suse.com/security/cve/CVE-2017-7761.html https://www.suse.com/security/cve/CVE-2017-7764.html https://www.suse.com/security/cve/CVE-2017-7765.html https://www.suse.com/security/cve/CVE-2017-7766.html https://www.suse.com/security/cve/CVE-2017-7767.html https://www.suse.com/security/cve/CVE-2017-7768.html https://www.suse.com/security/cve/CVE-2017-7771.html https://www.suse.com/security/cve/CVE-2017-7772.html https://www.suse.com/security/cve/CVE-2017-7773.html https://www.suse.com/security/cve/CVE-2017-7774.html https://www.suse.com/security/cve/CVE-2017-7775.html https://www.suse.com/security/cve/CVE-2017-7776.html https://www.suse.com/security/cve/CVE-2017-7777.html https://www.suse.com/security/cve/CVE-2017-7778.html https://bugzilla.suse.com/1040105 https://bugzilla.suse.com/1043960

1 0

openSUSE-SU-2017:1612-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1612-1 Rating: moderate References: #1039063 #1039064 #1039066 #1039069 #1039661 Cross-References: CVE-2017-9047 CVE-2017-9048 CVE-2017-9049 CVE-2017-9050 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for libxml2 fixes the following security issues: * CVE-2017-9050: A heap-based buffer over-read in xmlDictAddString (bsc#1039069, bsc#1039661) * CVE-2017-9049: A heap-based buffer overflow in xmlDictComputeFastKey (bsc#1039066) * CVE-2017-9048: A stack overflow vulnerability in xmlSnprintfElementContent (bsc#1039063) * CVE-2017-9047: A stack overflow vulnerability in xmlSnprintfElementContent (bsc#1039064) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-711=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libxml2-2-2.9.4-5.6.1 libxml2-2-debuginfo-2.9.4-5.6.1 libxml2-debugsource-2.9.4-5.6.1 libxml2-devel-2.9.4-5.6.1 libxml2-tools-2.9.4-5.6.1 libxml2-tools-debuginfo-2.9.4-5.6.1 python-libxml2-2.9.4-5.6.1 python-libxml2-debuginfo-2.9.4-5.6.1 python-libxml2-debugsource-2.9.4-5.6.1 - openSUSE Leap 42.2 (x86_64): libxml2-2-32bit-2.9.4-5.6.1 libxml2-2-debuginfo-32bit-2.9.4-5.6.1 libxml2-devel-32bit-2.9.4-5.6.1 - openSUSE Leap 42.2 (noarch): libxml2-doc-2.9.4-5.6.1 References: https://www.suse.com/security/cve/CVE-2017-9047.html https://www.suse.com/security/cve/CVE-2017-9048.html https://www.suse.com/security/cve/CVE-2017-9049.html https://www.suse.com/security/cve/CVE-2017-9050.html https://bugzilla.suse.com/1039063 https://bugzilla.suse.com/1039064 https://bugzilla.suse.com/1039066 https://bugzilla.suse.com/1039069 https://bugzilla.suse.com/1039661

1 0

openSUSE-SU-2017:1610-1: moderate: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1610-1 Rating: moderate References: #1025029 #1025035 #1025084 Cross-References: CVE-2017-2624 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for xorg-x11-server fixes the following security issues: - CVE-2017-2624: Prevent timing attack against MIT cookie. (boo#1025029) - Use arc4random to generate cookies with more randomness. (boo#1025084) - Remove unused function with use-after-free issue. (boo#1025035) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-710=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xorg-x11-server-7.6_1.18.3-12.15.2 xorg-x11-server-debuginfo-7.6_1.18.3-12.15.2 xorg-x11-server-debugsource-7.6_1.18.3-12.15.2 xorg-x11-server-extra-7.6_1.18.3-12.15.2 xorg-x11-server-extra-debuginfo-7.6_1.18.3-12.15.2 xorg-x11-server-sdk-7.6_1.18.3-12.15.2 xorg-x11-server-source-7.6_1.18.3-12.15.2 References: https://www.suse.com/security/cve/CVE-2017-2624.html https://bugzilla.suse.com/1025029 https://bugzilla.suse.com/1025035 https://bugzilla.suse.com/1025084

1 0

openSUSE-SU-2017:1609-1: moderate: Security update for freeradius-server
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1609-1 Rating: moderate References: #1041445 Cross-References: CVE-2017-9148 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for freeradius-server fixes the following issues: - CVE-2017-9148: Disable OpenSSL's internal session cache to mitigate authentication bypass. (boo#1041445) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-709=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): freeradius-server-3.0.12-2.3.1 freeradius-server-debuginfo-3.0.12-2.3.1 freeradius-server-debugsource-3.0.12-2.3.1 freeradius-server-devel-3.0.12-2.3.1 freeradius-server-doc-3.0.12-2.3.1 freeradius-server-krb5-3.0.12-2.3.1 freeradius-server-krb5-debuginfo-3.0.12-2.3.1 freeradius-server-ldap-3.0.12-2.3.1 freeradius-server-ldap-debuginfo-3.0.12-2.3.1 freeradius-server-libs-3.0.12-2.3.1 freeradius-server-libs-debuginfo-3.0.12-2.3.1 freeradius-server-mysql-3.0.12-2.3.1 freeradius-server-mysql-debuginfo-3.0.12-2.3.1 freeradius-server-perl-3.0.12-2.3.1 freeradius-server-perl-debuginfo-3.0.12-2.3.1 freeradius-server-postgresql-3.0.12-2.3.1 freeradius-server-postgresql-debuginfo-3.0.12-2.3.1 freeradius-server-python-3.0.12-2.3.1 freeradius-server-python-debuginfo-3.0.12-2.3.1 freeradius-server-sqlite-3.0.12-2.3.1 freeradius-server-sqlite-debuginfo-3.0.12-2.3.1 freeradius-server-utils-3.0.12-2.3.1 freeradius-server-utils-debuginfo-3.0.12-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-9148.html https://bugzilla.suse.com/1041445

1 0

openSUSE-RU-2017:1607-1: Recommended update for gnome-system-monitor, libgtop
by maintenance＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Recommended Update: Recommended update for gnome-system-monitor, libgtop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1607-1 Rating: low References: #1020294 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-system-monitor and libgtop provides the following fixes: - Add a scrollbar to the resources tab. (bsc#1020294) - Dynamically allocate memory for buffer when reading /proc/cpuinfo. (bsc#1020294) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-708=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gnome-system-monitor-3.20.1-2.3.1 gnome-system-monitor-debuginfo-3.20.1-2.3.1 gnome-system-monitor-debugsource-3.20.1-2.3.1 libgtop-2_0-10-2.34.1-2.3.1 libgtop-2_0-10-debuginfo-2.34.1-2.3.1 libgtop-debugsource-2.34.1-2.3.1 libgtop-devel-2.34.1-2.3.1 libgtop-doc-2.34.1-2.3.1 typelib-1_0-GTop-2_0-2.34.1-2.3.1 - openSUSE Leap 42.2 (noarch): gnome-system-monitor-lang-3.20.1-2.3.1 libgtop-lang-2.34.1-2.3.1 - openSUSE Leap 42.2 (x86_64): libgtop-2_0-10-32bit-2.34.1-2.3.1 libgtop-2_0-10-debuginfo-32bit-2.34.1-2.3.1 References: https://bugzilla.suse.com/1020294

1 0

openSUSE-RU-2017:1604-1: Recommended update for gnome-control-center
by maintenance＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Recommended Update: Recommended update for gnome-control-center ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1604-1 Rating: low References: #1037234 #890385 #993381 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gnome-control-center brings back the "shutdown" and "interactive" power key actions in "Power" panel. Additionally, the total disc size of btrfs sub-volumes is now displayed correctly in the information panel. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-707=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): gnome-control-center-3.20.1-14.3.1 gnome-control-center-color-3.20.1-14.3.1 gnome-control-center-debuginfo-3.20.1-14.3.1 gnome-control-center-debugsource-3.20.1-14.3.1 gnome-control-center-devel-3.20.1-14.3.1 gnome-control-center-goa-3.20.1-14.3.1 gnome-control-center-user-faces-3.20.1-14.3.1 - openSUSE Leap 42.2 (noarch): gnome-control-center-lang-3.20.1-14.3.1 References: https://bugzilla.suse.com/1037234 https://bugzilla.suse.com/890385 https://bugzilla.suse.com/993381

1 0

openSUSE-RU-2017:1601-1: Recommended update for cups-pk-helper
by maintenance＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Recommended Update: Recommended update for cups-pk-helper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1601-1 Rating: low References: #1033742 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cups-pk-helper adds support for handling printers names containing UTF-8 characters. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-706=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): cups-pk-helper-0.2.5-7.3.1 cups-pk-helper-debuginfo-0.2.5-7.3.1 cups-pk-helper-debugsource-0.2.5-7.3.1 - openSUSE Leap 42.2 (noarch): cups-pk-helper-lang-0.2.5-7.3.1 References: https://bugzilla.suse.com/1033742

1 0