June 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1598-1: Recommended update for erlang
by maintenance＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Recommended Update: Recommended update for erlang ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1598-1 Rating: low References: #1042887 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides erlang 18.3.4.5 and fixes the following issues: - crypto: Key exchange algorithms diffie-hellman-group-exchange-sha- optimized, up to a factor of 11 for the slowest ( = biggest and safest) one. - erts: A bug has been fixed where if erlang was started +B on a unix platform it would be killed by a SIGUSR2 signal when creating a crash dump. - erts: Calls to erl_drv_send_term() or erl_drv_output_term() from a non-scheduler thread while the corresponding port was invalid caused the emulator to enter an inconsistent state which eventually caused an emulator crash. - erts: Driver and NIF operations accessing processes or ports could cause an emulator crash when used from non-scheduler threads. - erts: Fix bug in binary_to_term for binaries created by term_to_binary with option compressed. The bug can cause badarg exception for a valid binary when Erlang VM is linked against a zlib library of version 1.2.9 or newer. Bug exists since OTP 17.0. - inets: Shutdown gracefully on connection or TLS handshake errors - ssh: The key exchange algorithm diffie-hellman-group-exchange-sha- has a server-option {dh_gex_limits,{Min,Max}}. There was a hostkey signature validation error on the client side if the option was used and the Min or the Max differed fromthe corresponding values obtained from the client. - ssh: Key exchange algorithms diffie-hellman-group-exchange-sha- optimized, up to a factor of 11 for the slowest ( = biggest and safest) one. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-704=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 x86_64): erlang-18.3.4.5-6.1 erlang-debugger-18.3.4.5-6.1 erlang-debugger-src-18.3.4.5-6.1 erlang-debuginfo-18.3.4.5-6.1 erlang-debugsource-18.3.4.5-6.1 erlang-dialyzer-18.3.4.5-6.1 erlang-dialyzer-debuginfo-18.3.4.5-6.1 erlang-dialyzer-src-18.3.4.5-6.1 erlang-diameter-18.3.4.5-6.1 erlang-diameter-src-18.3.4.5-6.1 erlang-doc-18.3.4.5-6.1 erlang-epmd-18.3.4.5-6.1 erlang-epmd-debuginfo-18.3.4.5-6.1 erlang-et-18.3.4.5-6.1 erlang-et-src-18.3.4.5-6.1 erlang-gs-18.3.4.5-6.1 erlang-gs-src-18.3.4.5-6.1 erlang-jinterface-18.3.4.5-6.1 erlang-jinterface-src-18.3.4.5-6.1 erlang-observer-18.3.4.5-6.1 erlang-observer-src-18.3.4.5-6.1 erlang-reltool-18.3.4.5-6.1 erlang-reltool-src-18.3.4.5-6.1 erlang-src-18.3.4.5-6.1 erlang-wx-18.3.4.5-6.1 erlang-wx-debuginfo-18.3.4.5-6.1 erlang-wx-src-18.3.4.5-6.1 References: https://bugzilla.suse.com/1042887

1 0

openSUSE-RU-2017:1597-1: Recommended update for erlang
by maintenance＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Recommended Update: Recommended update for erlang ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1597-1 Rating: low References: #1042887 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides erlang 18.3.4.5 and fixes the following issues: - crypto: Key exchange algorithms diffie-hellman-group-exchange-sha- optimized, up to a factor of 11 for the slowest ( = biggest and safest) one. - erts: A bug has been fixed where if erlang was started +B on a unix platform it would be killed by a SIGUSR2 signal when creating a crash dump. - erts: Calls to erl_drv_send_term() or erl_drv_output_term() from a non-scheduler thread while the corresponding port was invalid caused the emulator to enter an inconsistent state which eventually caused an emulator crash. - erts: Driver and NIF operations accessing processes or ports could cause an emulator crash when used from non-scheduler threads. - erts: Fix bug in binary_to_term for binaries created by term_to_binary with option compressed. The bug can cause badarg exception for a valid binary when Erlang VM is linked against a zlib library of version 1.2.9 or newer. Bug exists since OTP 17.0. - inets: Shutdown gracefully on connection or TLS handshake errors - ssh: The key exchange algorithm diffie-hellman-group-exchange-sha- has a server-option {dh_gex_limits,{Min,Max}}. There was a hostkey signature validation error on the client side if the option was used and the Min or the Max differed fromthe corresponding values obtained from the client. - ssh: Key exchange algorithms diffie-hellman-group-exchange-sha- optimized, up to a factor of 11 for the slowest ( = biggest and safest) one. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-704=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): erlang-18.3.4.5-2.4.2 erlang-debugger-18.3.4.5-2.4.2 erlang-debugger-src-18.3.4.5-2.4.2 erlang-debuginfo-18.3.4.5-2.4.2 erlang-debugsource-18.3.4.5-2.4.2 erlang-dialyzer-18.3.4.5-2.4.2 erlang-dialyzer-debuginfo-18.3.4.5-2.4.2 erlang-dialyzer-src-18.3.4.5-2.4.2 erlang-diameter-18.3.4.5-2.4.2 erlang-diameter-src-18.3.4.5-2.4.2 erlang-doc-18.3.4.5-2.4.2 erlang-epmd-18.3.4.5-2.4.2 erlang-epmd-debuginfo-18.3.4.5-2.4.2 erlang-et-18.3.4.5-2.4.2 erlang-et-src-18.3.4.5-2.4.2 erlang-gs-18.3.4.5-2.4.2 erlang-gs-src-18.3.4.5-2.4.2 erlang-jinterface-18.3.4.5-2.4.2 erlang-jinterface-src-18.3.4.5-2.4.2 erlang-observer-18.3.4.5-2.4.2 erlang-observer-src-18.3.4.5-2.4.2 erlang-reltool-18.3.4.5-2.4.2 erlang-reltool-src-18.3.4.5-2.4.2 erlang-src-18.3.4.5-2.4.2 erlang-wx-18.3.4.5-2.4.2 erlang-wx-debuginfo-18.3.4.5-2.4.2 erlang-wx-src-18.3.4.5-2.4.2 References: https://bugzilla.suse.com/1042887

1 0

openSUSE-RU-2017:1596-1: Recommended update for virtualbox
by maintenance＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1596-1 Rating: low References: #1041137 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for virtualbox fixes the following issues: - Revise warning screen concerning USB passthrough. (boo#1041137) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-702=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): python-virtualbox-5.1.22-19.21.1 python-virtualbox-debuginfo-5.1.22-19.21.1 virtualbox-5.1.22-19.21.1 virtualbox-debuginfo-5.1.22-19.21.1 virtualbox-debugsource-5.1.22-19.21.1 virtualbox-devel-5.1.22-19.21.1 virtualbox-guest-kmp-default-5.1.22_k4.4.70_18.9-19.21.1 virtualbox-guest-kmp-default-debuginfo-5.1.22_k4.4.70_18.9-19.21.1 virtualbox-guest-tools-5.1.22-19.21.1 virtualbox-guest-tools-debuginfo-5.1.22-19.21.1 virtualbox-guest-x11-5.1.22-19.21.1 virtualbox-guest-x11-debuginfo-5.1.22-19.21.1 virtualbox-host-kmp-default-5.1.22_k4.4.70_18.9-19.21.1 virtualbox-host-kmp-default-debuginfo-5.1.22_k4.4.70_18.9-19.21.1 virtualbox-qt-5.1.22-19.21.1 virtualbox-qt-debuginfo-5.1.22-19.21.1 virtualbox-vnc-5.1.22-19.21.1 virtualbox-websrv-5.1.22-19.21.1 virtualbox-websrv-debuginfo-5.1.22-19.21.1 - openSUSE Leap 42.2 (noarch): virtualbox-guest-desktop-icons-5.1.22-19.21.1 virtualbox-guest-source-5.1.22-19.21.1 virtualbox-host-source-5.1.22-19.21.1 References: https://bugzilla.suse.com/1041137

1 0

openSUSE-SU-2017:1595-1: moderate: Security update for lynis
by opensuse-security＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Security Update: Security update for lynis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1595-1 Rating: moderate References: #1043463 Cross-References: CVE-2017-8108 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lynis fixes the following issues: Lynis 2.5.1: * Improved detection of SSL certificate files * Minor changes to improve logging and results * Firewall tests: Determine if CSF is in testing mode The Update also includes changes from Lynis 2.5.0: * CVE-2017-8108: symlink attack may have allowed arbitrary file overwrite or privilege escalation (boo#1043463) * Deleted unused tests from database file * Additional sysctls are tested * Extended test with Symantec components * Snort detection * Snort configuration file The update also includes Lynis 2.4.8 (Changelog from 2.4.1) * More PHP paths added * Minor changes to text * Show atomic test in report * Added FileInstalledByPackage function (dpkg and rpm supported) * Mark Arch Linux version as rolling release (instead of unknown) * Support for Manjaro Linux * Escape files when testing if they are readable * Code cleanups * Allow host alias to be specified in profile * Code readability enhancements * Solaris support has been improved * Fix for upload function to be used from profile * Reduce screen output for mail section, unless --verbose is used * Code cleanups and removed 'update release' command * Colored output can now be tuned with profile (colors=yes/no) * Allow data upload to be set as a profile option * Properly detect SSH daemon version * Generic code improvements * Improved the update check and display * Finish, Portuguese, and Turkish translation * Extended support and tests for DragonFlyBSD * Option to configure hostid and hostid2 in profile * Support for Trend Micro and Cylance (macOS) * Remove comments at end of nginx configuration * Used machine ID to create host ID when no SSH keys are available * Added detection of iptables-save to binaries And Lynis 2.4.0 * Mainly improved support for macOS users * Support for CoreOS * Support for clamconf utility * Support for chinese translation * More sysctl values in the default profile * New commands: "upload-only", "show hostids", "show environment", "show os" Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-705=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): lynis-2.5.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-8108.html https://bugzilla.suse.com/1043463

1 0

openSUSE-RU-2017:1594-1: Recommended update for shotwell
by maintenance＠opensuse.org 19 Jun '17

19 Jun '17

openSUSE Recommended Update: Recommended update for shotwell ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1594-1 Rating: low References: #943556 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for shotwell fixes support for publishing images to Facebook. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-703=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): shotwell-0.22.0+git.20160103-7.3.1 shotwell-debuginfo-0.22.0+git.20160103-7.3.1 shotwell-debugsource-0.22.0+git.20160103-7.3.1 - openSUSE Leap 42.2 (noarch): shotwell-lang-0.22.0+git.20160103-7.3.1 References: https://bugzilla.suse.com/943556

1 0

openSUSE-SU-2017:1593-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 18 Jun '17

18 Jun '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1593-1 Rating: moderate References: #1043420 #1044690 Cross-References: CVE-2017-5087 CVE-2017-5088 CVE-2017-5089 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to Chromium 59.0.3071.104 fixes the following security issues: * CVE-2017-5087: Sandbox Escape in IndexedDB * CVE-2017-5088: Out of bounds read in V8 * CVE-2017-5089: Domain spoofing in Omnibox * Various fixes from internal audits, fuzzing and other initiatives The following tracked packaging changes are included: * In about dialog, refer to the build as "openSUSE build" (boo#1043420) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-701=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-59.0.3071.104-23.1 chromium-59.0.3071.104-23.1 References: https://www.suse.com/security/cve/CVE-2017-5087.html https://www.suse.com/security/cve/CVE-2017-5088.html https://www.suse.com/security/cve/CVE-2017-5089.html https://bugzilla.suse.com/1043420 https://bugzilla.suse.com/1044690

1 0

openSUSE-RU-2017:1592-1: Recommended update for fate
by maintenance＠opensuse.org 18 Jun '17

18 Jun '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1592-1 Rating: low References: #1024737 #1032240 #1032321 #1032481 #1036753 #1039533 #1040654 #887741 #961147 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update provides fate 1.6 and various improvements and bug fixes: - Easier workflow fo Save/SaveAll features. (bsc#1036753) - Multiple changes at once. - Use class FeatureViewBase wherever appropriate. - Enhance presenting Diffs. (bsc#1039533 and more) - Refactor Simpleeditor. - Multiple FeatureView windows. - Make ECO code compliant to refactored class feature. - Refactor SimpleEditor to use new signals of class Feature. - New product&priority editor. - New ActorList Editor. - Configurable tabbed FeatureView. - Eliminate use of some KDE widgets including KTabWidget. - Refactor class Feature model alike. - Normal quit of fate client triggers KCrash. (bsc#887741) - Duplicate Person Box. (bsc#961147) - FATE: Does not show up in menu. (bsc#1024737) - Segfault when removing Info Provider. (bsc#1032240) - No save button after changing product. (bsc#1032321) - Unable to save a feature. (bsc#1032481) - Rename SLE-13-HPC to SLE-15-HPC. (bsc#1040654) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-700=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): fate-1.6.0-23.6.1 fate-debuginfo-1.6.0-23.6.1 References: https://bugzilla.suse.com/1024737 https://bugzilla.suse.com/1032240 https://bugzilla.suse.com/1032321 https://bugzilla.suse.com/1032481 https://bugzilla.suse.com/1036753 https://bugzilla.suse.com/1039533 https://bugzilla.suse.com/1040654 https://bugzilla.suse.com/887741 https://bugzilla.suse.com/961147

1 0

openSUSE-SU-2017:1591-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 18 Jun '17

18 Jun '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1591-1 Rating: moderate References: #1043420 #1044690 Cross-References: CVE-2017-5087 CVE-2017-5088 CVE-2017-5089 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to Chromium 59.0.3071.104 fixes the following security issues: * CVE-2017-5087: Sandbox Escape in IndexedDB * CVE-2017-5088: Out of bounds read in V8 * CVE-2017-5089: Domain spoofing in Omnibox * Various fixes from internal audits, fuzzing and other initiatives The following tracked packaging changes are included: * In about dialog, refer to the build as "openSUSE build" (boo#1043420) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-701=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): chromedriver-59.0.3071.104-104.18.2 chromedriver-debuginfo-59.0.3071.104-104.18.2 chromium-59.0.3071.104-104.18.2 chromium-debuginfo-59.0.3071.104-104.18.2 chromium-debugsource-59.0.3071.104-104.18.2 References: https://www.suse.com/security/cve/CVE-2017-5087.html https://www.suse.com/security/cve/CVE-2017-5088.html https://www.suse.com/security/cve/CVE-2017-5089.html https://bugzilla.suse.com/1043420 https://bugzilla.suse.com/1044690

1 0

openSUSE-RU-2017:1589-1: Recommended update for freetype2
by maintenance＠opensuse.org 16 Jun '17

16 Jun '17

openSUSE Recommended Update: Recommended update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1589-1 Rating: low References: #1038506 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for freetype2 fixes an issue within handling of very large fonts which could lead to corrupted characters in the boot splash screen of systems configured to use the Korean language. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-697=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): freetype2-debugsource-2.6.3-2.3.1 freetype2-devel-2.6.3-2.3.1 ft2demos-2.6.3-2.3.1 libfreetype6-2.6.3-2.3.1 libfreetype6-debuginfo-2.6.3-2.3.1 - openSUSE Leap 42.2 (x86_64): freetype2-devel-32bit-2.6.3-2.3.1 libfreetype6-32bit-2.6.3-2.3.1 libfreetype6-debuginfo-32bit-2.6.3-2.3.1 References: https://bugzilla.suse.com/1038506

1 0

openSUSE-RU-2017:1588-1: Recommended update for file-roller
by maintenance＠opensuse.org 16 Jun '17

16 Jun '17

openSUSE Recommended Update: Recommended update for file-roller ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1588-1 Rating: low References: #1022082 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for file-roller provides the following fixes: - Fix segmentation fault after extracting a file. (bsc#1022082) - Fix integer overflow when comparing large files/directories. - Show the 'open destination' dialog only when using --notify. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-698=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): file-roller-3.20.3-3.3.1 file-roller-debuginfo-3.20.3-3.3.1 file-roller-debugsource-3.20.3-3.3.1 nautilus-file-roller-3.20.3-3.3.1 nautilus-file-roller-debuginfo-3.20.3-3.3.1 - openSUSE Leap 42.2 (noarch): file-roller-lang-3.20.3-3.3.1 References: https://bugzilla.suse.com/1022082

1 0