June 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1536-1: Recommended update for shadow
by maintenance＠opensuse.org 12 Jun '17

12 Jun '17

openSUSE Recommended Update: Recommended update for shadow ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1536-1 Rating: low References: #1003978 #1031643 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for shadow fixes the following issues: - Dynamically added users via pam_group are not listed in groups databases but are still valid. (bsc#1031643) - useradd(8) and groupadd(8) performance issue when using SSSD. Previously the entire possible UID/GID was iterated to find an available UID/GID. This could take long time over a network device. Instead, find available UID/GID locally, and then check only those values over network. (bsc#1003978) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-681=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): shadow-4.2.1-6.3.1 shadow-debuginfo-4.2.1-6.3.1 shadow-debugsource-4.2.1-6.3.1 References: https://bugzilla.suse.com/1003978 https://bugzilla.suse.com/1031643

1 0

openSUSE-RU-2017:1535-1: Recommended update for python-pyasn1
by maintenance＠opensuse.org 12 Jun '17

12 Jun '17

openSUSE Recommended Update: Recommended update for python-pyasn1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1535-1 Rating: low References: #1002895 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The python-pyasn1 module was updated to version 0.1.9, which provides the following fixes and enhancements: - Wheel distribution format is now supported. - Fix to make uninitialized pyasn1 objects fail properly on hash(). - Fix to ObjectIdentifier initialization from unicode string. - Fix to CER/DER Boolean decoder: fail on non single-octet payload. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-679=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): python-pyasn1-0.1.9-11.3.1 References: https://bugzilla.suse.com/1002895

1 0

openSUSE-SU-2017:1534-1: Security update for wireshark
by opensuse-security＠opensuse.org 12 Jun '17

12 Jun '17

openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1534-1 Rating: low References: #1042298 #1042299 #1042300 #1042301 #1042302 #1042303 #1042304 #1042305 #1042306 #1042307 #1042308 #1042309 #1042330 Cross-References: CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346 CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350 CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has one errata is now available. Description: This update for wireshark fixes minor vulnerabilities that could be used to trigger dissector crashes, infinite loops, or cause excessive use of CPU resources by making Wireshark read specially crafted packages from the network or a capture file: - CVE-2017-9352: Bazaar dissector infinite loop (boo#1042304) - CVE-2017-9348: DOF dissector read overflow (boo#1042303) - CVE-2017-9351: DHCP dissector read overflow (boo#1042302) - CVE-2017-9346: SoulSeek dissector infinite loop (boo#1042301) - CVE-2017-9345: DNS dissector infinite loop (boo#1042300) - CVE-2017-9349: DICOM dissector infinite loop (boo#1042305) - CVE-2017-9350: openSAFETY dissector memory exhaustion (boo#1042299) - CVE-2017-9344: BT L2CAP dissector divide by zero (boo#1042298) - CVE-2017-9343: MSNIP dissector crash (boo#1042309) - CVE-2017-9347: ROS dissector crash (boo#1042308) - CVE-2017-9354: RGMP dissector crash (boo#1042307) - CVE-2017-9353: IPv6 dissector crash (boo#1042306) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-674=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): wireshark-2.2.7-14.6.1 wireshark-debuginfo-2.2.7-14.6.1 wireshark-debugsource-2.2.7-14.6.1 wireshark-devel-2.2.7-14.6.1 wireshark-ui-gtk-2.2.7-14.6.1 wireshark-ui-gtk-debuginfo-2.2.7-14.6.1 wireshark-ui-qt-2.2.7-14.6.1 wireshark-ui-qt-debuginfo-2.2.7-14.6.1 References: https://www.suse.com/security/cve/CVE-2017-9343.html https://www.suse.com/security/cve/CVE-2017-9344.html https://www.suse.com/security/cve/CVE-2017-9345.html https://www.suse.com/security/cve/CVE-2017-9346.html https://www.suse.com/security/cve/CVE-2017-9347.html https://www.suse.com/security/cve/CVE-2017-9348.html https://www.suse.com/security/cve/CVE-2017-9349.html https://www.suse.com/security/cve/CVE-2017-9350.html https://www.suse.com/security/cve/CVE-2017-9351.html https://www.suse.com/security/cve/CVE-2017-9352.html https://www.suse.com/security/cve/CVE-2017-9353.html https://www.suse.com/security/cve/CVE-2017-9354.html https://bugzilla.suse.com/1042298 https://bugzilla.suse.com/1042299 https://bugzilla.suse.com/1042300 https://bugzilla.suse.com/1042301 https://bugzilla.suse.com/1042302 https://bugzilla.suse.com/1042303 https://bugzilla.suse.com/1042304 https://bugzilla.suse.com/1042305 https://bugzilla.suse.com/1042306 https://bugzilla.suse.com/1042307 https://bugzilla.suse.com/1042308 https://bugzilla.suse.com/1042309 https://bugzilla.suse.com/1042330

1 0

openSUSE-SU-2017:1533-1: moderate: Security update for libnettle
by opensuse-security＠opensuse.org 12 Jun '17

12 Jun '17

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1533-1 Rating: moderate References: #991464 Cross-References: CVE-2016-6489 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libnettle fixes the following issues: - CVE-2016-6489: * Reject invalid RSA keys with even modulo. * Check for invalid keys, with even p, in dsa_sign(). * Use function mpz_powm_sec() instead of mpz_powm() (bsc#991464). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-675=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libhogweed2-2.7.1-10.3.1 libhogweed2-debuginfo-2.7.1-10.3.1 libnettle-debugsource-2.7.1-10.3.1 libnettle-devel-2.7.1-10.3.1 libnettle4-2.7.1-10.3.1 libnettle4-debuginfo-2.7.1-10.3.1 nettle-2.7.1-10.3.1 nettle-debuginfo-2.7.1-10.3.1 - openSUSE Leap 42.2 (x86_64): libhogweed2-32bit-2.7.1-10.3.1 libhogweed2-debuginfo-32bit-2.7.1-10.3.1 libnettle-devel-32bit-2.7.1-10.3.1 libnettle4-32bit-2.7.1-10.3.1 libnettle4-debuginfo-32bit-2.7.1-10.3.1 References: https://www.suse.com/security/cve/CVE-2016-6489.html https://bugzilla.suse.com/991464

1 0

openSUSE-SU-2017:1532-1: moderate: Security update for ffmpeg
by opensuse-security＠opensuse.org 11 Jun '17

11 Jun '17

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1532-1 Rating: moderate References: #1015120 #1022921 #1022922 #1034176 #1034177 #1034179 #980542 Cross-References: CVE-2016-10191 CVE-2016-10192 CVE-2016-9561 CVE-2017-7863 CVE-2017-7865 CVE-2017-7866 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: ffmpeg was updated to fix the following security issues: CVE-2016-10191: remote exploitaion results code execution ((bsc#1022921) CVE-2016-10192: remote exploitaion results code execution bsc#1022922) CVE-2017-7866: stack-based buffer overflow (bsc#1034176) CVE-2017-7865: heap-based buffer overflow (bsc#1034177) CVE-2017-7863: heap-based buffer overflow (bsc#1034179) CVE-2016-9561: Huge amount memory allocated, resulting in DoS (bsc#1015120) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-672=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ffmpeg2-devel-2.8.11-12.1 libavcodec56-2.8.11-12.1 libavdevice56-2.8.11-12.1 libavfilter5-2.8.11-12.1 libavformat56-2.8.11-12.1 libavresample2-2.8.11-12.1 libavutil54-2.8.11-12.1 libpostproc53-2.8.11-12.1 libswresample1-2.8.11-12.1 libswscale3-2.8.11-12.1 References: https://www.suse.com/security/cve/CVE-2016-10191.html https://www.suse.com/security/cve/CVE-2016-10192.html https://www.suse.com/security/cve/CVE-2016-9561.html https://www.suse.com/security/cve/CVE-2017-7863.html https://www.suse.com/security/cve/CVE-2017-7865.html https://www.suse.com/security/cve/CVE-2017-7866.html https://bugzilla.suse.com/1015120 https://bugzilla.suse.com/1022921 https://bugzilla.suse.com/1022922 https://bugzilla.suse.com/1034176 https://bugzilla.suse.com/1034177 https://bugzilla.suse.com/1034179 https://bugzilla.suse.com/980542

1 0

openSUSE-SU-2017:1531-1: moderate: Security update for ffmpeg
by opensuse-security＠opensuse.org 11 Jun '17

11 Jun '17

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1531-1 Rating: moderate References: #1015120 #1022921 #1022922 Cross-References: CVE-2016-10191 CVE-2016-10192 CVE-2016-9561 CVE-2017-5024 CVE-2017-5025 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update of ffmpeg to version 3.1.8 fixes the following security issues: - CVE-2016-9561: DoS through huge memory allocation (bsc#1015120) - CVE-2016-10191: remote code execution vulnerability (bsc#1022921) - CVE-2016-10192: remote code execution vulnerability (bsc#1022922) - CVE-2017-5024: Heap overflow - CVE-2017-5025: Heap overflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-673=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): ffmpeg-3.1.8-8.1 ffmpeg-debuginfo-3.1.8-8.1 ffmpeg-debugsource-3.1.8-8.1 libavcodec-devel-3.1.8-8.1 libavcodec57-3.1.8-8.1 libavcodec57-debuginfo-3.1.8-8.1 libavdevice-devel-3.1.8-8.1 libavdevice57-3.1.8-8.1 libavdevice57-debuginfo-3.1.8-8.1 libavfilter-devel-3.1.8-8.1 libavfilter6-3.1.8-8.1 libavfilter6-debuginfo-3.1.8-8.1 libavformat-devel-3.1.8-8.1 libavformat57-3.1.8-8.1 libavformat57-debuginfo-3.1.8-8.1 libavresample-devel-3.1.8-8.1 libavresample3-3.1.8-8.1 libavresample3-debuginfo-3.1.8-8.1 libavutil-devel-3.1.8-8.1 libavutil55-3.1.8-8.1 libavutil55-debuginfo-3.1.8-8.1 libpostproc-devel-3.1.8-8.1 libpostproc54-3.1.8-8.1 libpostproc54-debuginfo-3.1.8-8.1 libswresample-devel-3.1.8-8.1 libswresample2-3.1.8-8.1 libswresample2-debuginfo-3.1.8-8.1 libswscale-devel-3.1.8-8.1 libswscale4-3.1.8-8.1 libswscale4-debuginfo-3.1.8-8.1 References: https://www.suse.com/security/cve/CVE-2016-10191.html https://www.suse.com/security/cve/CVE-2016-10192.html https://www.suse.com/security/cve/CVE-2016-9561.html https://www.suse.com/security/cve/CVE-2017-5024.html https://www.suse.com/security/cve/CVE-2017-5025.html https://bugzilla.suse.com/1015120 https://bugzilla.suse.com/1022921 https://bugzilla.suse.com/1022922

1 0

openSUSE-SU-2017:1530-1: moderate: Security update for mysql-connector-cpp, mysql-workbench
by opensuse-security＠opensuse.org 10 Jun '17

10 Jun '17

openSUSE Security Update: Security update for mysql-connector-cpp, mysql-workbench ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1530-1 Rating: moderate References: #1035195 Cross-References: CVE-2017-3469 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mysql-connector-cpp and mysql-workbench fixes the following issues: Mysql-connector-cpp was updated to version 1.1.8: * See the news files on https://dev.mysql.com/doc/relnotes/connector-cpp/en/ Mysql-workbench was updated to version 6.3.9: * https://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-3-8.html * https://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-3-9.html * resolves CVE-2017-3469 (boo#1035195) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-671=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libmysqlcppconn-devel-1.1.8-5.3.2 libmysqlcppconn7-1.1.8-5.3.2 libmysqlcppconn7-debuginfo-1.1.8-5.3.2 mysql-connector-cpp-debugsource-1.1.8-5.3.2 - openSUSE Leap 42.2 (x86_64): mysql-workbench-6.3.9-2.5.2 mysql-workbench-debuginfo-6.3.9-2.5.2 mysql-workbench-debugsource-6.3.9-2.5.2 References: https://www.suse.com/security/cve/CVE-2017-3469.html https://bugzilla.suse.com/1035195

1 0

openSUSE-SU-2017:1521-1: moderate: Security update for rxvt-unicode
by opensuse-security＠opensuse.org 09 Jun '17

09 Jun '17

openSUSE Security Update: Security update for rxvt-unicode ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1521-1 Rating: moderate References: #1036456 Cross-References: CVE-2017-7483 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rxvt-unicode fixes the following issue: While urxvt is not directly affected by CVE-2017-7483 we have added a patch to harden urxvt to avoid similar bugs in the future. (boo#1036456) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-670=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): rxvt-unicode-9.21-6.3.1 rxvt-unicode-debuginfo-9.21-6.3.1 rxvt-unicode-debugsource-9.21-6.3.1 References: https://www.suse.com/security/cve/CVE-2017-7483.html https://bugzilla.suse.com/1036456

1 0

openSUSE-SU-2017:1520-1: moderate: Security update for catdoc
by opensuse-security＠opensuse.org 09 Jun '17

09 Jun '17

openSUSE Security Update: Security update for catdoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1520-1 Rating: moderate References: #919228 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: catdoc was updated to version 0.95 to fix the following issues: * Fix various issues found during fuzzing which may lead to an application crash or have unspecified further impact when the user is tricked into opening specially crafted files (boo#919228) * Replace charset tables with new ones, published by Unicode Consortium with more permissive license * Fix lot of segfaults on incorrect or corrupted data Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-669=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): catdoc-0.95-7.3.1 catdoc-debuginfo-0.95-7.3.1 catdoc-debugsource-0.95-7.3.1 References: https://bugzilla.suse.com/919228

1 0

openSUSE-SU-2017:1516-1: moderate: Security update for yodl
by opensuse-security＠opensuse.org 08 Jun '17

08 Jun '17

openSUSE Security Update: Security update for yodl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1516-1 Rating: moderate References: #1040917 Cross-References: CVE-2016-10375 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for yodl fixes the following issues: - CVE-2016-10375 invalid memory read in queue_push could lead to Denial of service (boo#1040917) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-667=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): yodl-3.05.01-3.3.1 yodl-debuginfo-3.05.01-3.3.1 yodl-debugsource-3.05.01-3.3.1 References: https://www.suse.com/security/cve/CVE-2016-10375.html https://bugzilla.suse.com/1040917

1 0