June 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-OU-2017:1586-1: Optional update for brise
by maintenance＠opensuse.org 16 Jun '17

16 Jun '17

openSUSE Optional Update: Optional update for brise ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:1586-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update for brise fixes the following issues: - Update to version 0.36+git20160221.7dbd56b - Make sure source code's LICENSE file install by default. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-695=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): brise-0.36+git20160221.7dbd56b-6.3.1 References:

1 0

openSUSE-RU-2017:1584-1: Recommended update for yast2-packager
by maintenance＠opensuse.org 16 Jun '17

16 Jun '17

openSUSE Recommended Update: Recommended update for yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1584-1 Rating: low References: #1014861 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-packager provides the following fix: - Fix SLES4SAP autoupgrade with SUSE Manager repositories (bsc#1014861) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-699=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): yast2-packager-3.1.122-5.3.1 References: https://bugzilla.suse.com/1014861

1 0

openSUSE-RU-2017:1583-1: Recommended update for gnome-settings-daemon
by maintenance＠opensuse.org 16 Jun '17

16 Jun '17

openSUSE Recommended Update: Recommended update for gnome-settings-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1583-1 Rating: low References: #1000599 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-settings-daemon provides the following fix: - Fix some keybindings become unavailable (bsc#1000599) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-696=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gnome-settings-daemon-3.20.1-9.6.1 gnome-settings-daemon-debuginfo-3.20.1-9.6.1 gnome-settings-daemon-debugsource-3.20.1-9.6.1 gnome-settings-daemon-devel-3.20.1-9.6.1 - openSUSE Leap 42.2 (noarch): gnome-settings-daemon-lang-3.20.1-9.6.1 References: https://bugzilla.suse.com/1000599

1 0

openSUSE-SU-2017:1579-1: moderate: Security update for Mozilla Thunderbird
by opensuse-security＠opensuse.org 16 Jun '17

16 Jun '17

openSUSE Security Update: Security update for Mozilla Thunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1579-1 Rating: moderate References: #1040105 #1042090 #1043960 Cross-References: CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7763 CVE-2017-7764 CVE-2017-7765 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: This update to Thunderbird 52.2 fixes security issues and bugs. The following vulnerabilities were fixed: * CVE-2017-5472: Use-after-free using destroyed node when regenerating trees * CVE-2017-7749: Use-after-free during docshell reloading * CVE-2017-7750: Use-after-free with track elements * CVE-2017-7751: Use-after-free with content viewer listeners * CVE-2017-7752: Use-after-free with IME input * CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object * CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors * CVE-2017-7757: Use-after-free in IndexedDB * CVE-2017-7778, CVE-2017-7778, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777: Vulnerabilities in the Graphite 2 library * CVE-2017-7758: Out-of-bounds read in Opus encoder * CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks * CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 Mozilla Thunderbird now requires NSS 3.28.5. The following bugs were fixed: * Embedded images not shown in email received from Hotmail/Outlook webmailer * Detection of non-ASCII font names in font selector * Attachment not forwarded correctly under certain circumstances * Multiple requests for master password when GMail OAuth2 is enabled * Large number of blank pages being printed under certain circumstances when invalid preferences were present * Messages sent via the Simple MAPI interface are forced to HTML * Calendar: Invitations can't be printed * Mailing list (group) not accessible from macOS or Outlook address book * Clicking on links with references/anchors where target doesn't exist in the message not opening in external browser Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-694=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): MozillaThunderbird-52.2-36.1 MozillaThunderbird-buildsymbols-52.2-36.1 MozillaThunderbird-devel-52.2-36.1 MozillaThunderbird-translations-common-52.2-36.1 MozillaThunderbird-translations-other-52.2-36.1 References: https://www.suse.com/security/cve/CVE-2017-5470.html https://www.suse.com/security/cve/CVE-2017-5472.html https://www.suse.com/security/cve/CVE-2017-7749.html https://www.suse.com/security/cve/CVE-2017-7750.html https://www.suse.com/security/cve/CVE-2017-7751.html https://www.suse.com/security/cve/CVE-2017-7752.html https://www.suse.com/security/cve/CVE-2017-7754.html https://www.suse.com/security/cve/CVE-2017-7756.html https://www.suse.com/security/cve/CVE-2017-7757.html https://www.suse.com/security/cve/CVE-2017-7758.html https://www.suse.com/security/cve/CVE-2017-7763.html https://www.suse.com/security/cve/CVE-2017-7764.html https://www.suse.com/security/cve/CVE-2017-7765.html https://www.suse.com/security/cve/CVE-2017-7771.html https://www.suse.com/security/cve/CVE-2017-7772.html https://www.suse.com/security/cve/CVE-2017-7773.html https://www.suse.com/security/cve/CVE-2017-7774.html https://www.suse.com/security/cve/CVE-2017-7775.html https://www.suse.com/security/cve/CVE-2017-7776.html https://www.suse.com/security/cve/CVE-2017-7777.html https://www.suse.com/security/cve/CVE-2017-7778.html https://bugzilla.suse.com/1040105 https://bugzilla.suse.com/1042090 https://bugzilla.suse.com/1043960

1 0

openSUSE-RU-2017:1574-1: Recommended update for clamav-database
by maintenance＠opensuse.org 15 Jun '17

15 Jun '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1574-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh June 12th 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-693=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201706120006-54.39.1 References:

1 0

openSUSE-RU-2017:1573-1: Recommended update for fate
by maintenance＠opensuse.org 15 Jun '17

15 Jun '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1573-1 Rating: low References: #1024737 #1032240 #1032321 #1032481 #1036753 #1039533 #1040654 #887741 #961147 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update provides fate 1.6 and various improvements and bug fixes: - Easier workflow fo Save/SaveAll features. (bsc#1036753) - Multiple changes at once. - Use class FeatureViewBase wherever appropriate. - Enhance presenting Diffs. (bsc#1039533 and more) - Refactor Simpleeditor. - Multiple FeatureView windows. - Make ECO code compliant to refactored class feature. - Refactor SimpleEditor to use new signals of class Feature. - New product&priority editor. - New ActorList Editor. - Configurable tabbed FeatureView. - Eliminate use of some KDE widgets including KTabWidget. - Refactor class Feature model alike. - Normal quit of fate client triggers KCrash. (bsc#887741) - Duplicate Person Box. (bsc#961147) - FATE: Does not show up in menu. (bsc#1024737) - Segfault when removing Info Provider. (bsc#1032240) - No save button after changing product. (bsc#1032321) - Unable to save a feature. (bsc#1032481) - Rename SLE-13-HPC to SLE-15-HPC. (bsc#1040654) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-692=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): fate-1.6.0-13.1 References: https://bugzilla.suse.com/1024737 https://bugzilla.suse.com/1032240 https://bugzilla.suse.com/1032321 https://bugzilla.suse.com/1032481 https://bugzilla.suse.com/1036753 https://bugzilla.suse.com/1039533 https://bugzilla.suse.com/1040654 https://bugzilla.suse.com/887741 https://bugzilla.suse.com/961147

1 0

openSUSE-SU-2017:1572-1: important: Security update for mercurial
by opensuse-security＠opensuse.org 15 Jun '17

15 Jun '17

openSUSE Security Update: Security update for mercurial ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1572-1 Rating: important References: #1043063 #1043502 Cross-References: CVE-2017-9462 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for mercurial fixes the following issues: - CVE-2017-9462: Fix the arbitrary code exec by remote users via "hg serve --stdio" (boo#1043063) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-689=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): mercurial-3.8.3-2.5.1 mercurial-debuginfo-3.8.3-2.5.1 mercurial-debugsource-3.8.3-2.5.1 - openSUSE Leap 42.2 (noarch): mercurial-lang-3.8.3-2.5.1 References: https://www.suse.com/security/cve/CVE-2017-9462.html https://bugzilla.suse.com/1043063 https://bugzilla.suse.com/1043502

1 0

openSUSE-SU-2017:1571-1: moderate: Security update for otrs
by opensuse-security＠opensuse.org 15 Jun '17

15 Jun '17

openSUSE Security Update: Security update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1571-1 Rating: moderate References: #1043086 #1043244 Cross-References: CVE-2017-9324 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for otrs fixes the following issues: - CVE-2017-9324: Incorrect Access Control in OTRS - Improved SecureMode detection in Installer (OSA-2017-03, bsc#1043086) - bsc#1043244: Reflected cross-site scripting in OTRS, customer search should not return results for internal (OSA-2017-02) In addition, OTRS was updated to 3.3.17 with the following fixes: - Function "SystemDataGroupGet" has problems with empty values in oracle - Base64 encoded image does not display in article - Chrome could not display attached PDF files Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-691=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): otrs-3.3.17-5.3.1 otrs-doc-3.3.17-5.3.1 otrs-itsm-3.3.14-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-9324.html https://bugzilla.suse.com/1043086 https://bugzilla.suse.com/1043244

1 0

openSUSE-SU-2017:1569-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 15 Jun '17

15 Jun '17

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1569-1 Rating: moderate References: #1043455 #1043456 Cross-References: CVE-2017-0375 CVE-2017-0376 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to tor 0.2.9.11 fixes the following vulnerabilities: - CVE-2017-0375: remotely triggerable assertion failure when a hidden service handles a malformed BEGIN cell (bsc#1043455) - CVE-2017-0376: remotely triggerable assertion failure caused by receiving a BEGIN_DIR cell on a hidden service rendezvous circuit (bsc#1043456) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-690=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): tor-0.2.9.11-8.3.1 tor-debuginfo-0.2.9.11-8.3.1 tor-debugsource-0.2.9.11-8.3.1 References: https://www.suse.com/security/cve/CVE-2017-0375.html https://www.suse.com/security/cve/CVE-2017-0376.html https://bugzilla.suse.com/1043455 https://bugzilla.suse.com/1043456

1 0

openSUSE-RU-2017:1562-1: Recommended update for vte
by maintenance＠opensuse.org 14 Jun '17

14 Jun '17

openSUSE Recommended Update: Recommended update for vte ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1562-1 Rating: low References: #1021684 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for vte fixes the following issues: - Memory leaks in gnome-terminal-server (bsc#1021684) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-688=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): glade-catalog-vte-0.44.2-3.3.1 libvte-2_91-0-0.44.2-3.3.1 libvte-2_91-0-debuginfo-0.44.2-3.3.1 typelib-1_0-Vte-2.91-0.44.2-3.3.1 vte-debugsource-0.44.2-3.3.1 vte-devel-0.44.2-3.3.1 vte-tools-0.44.2-3.3.1 vte-tools-debuginfo-0.44.2-3.3.1 - openSUSE Leap 42.2 (noarch): vte-lang-0.44.2-3.3.1 References: https://bugzilla.suse.com/1021684

1 0