July 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:1804-1: Recommended update for OpenIPMI
by maintenance＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Recommended Update: Recommended update for OpenIPMI ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1804-1 Rating: low References: #1046174 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for OpenIPMI provides the following fix: - Fix pthread requirements in OpenIPMIpthread pkg-config settings. (bsc#1046174) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-791=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): OpenIPMI-2.0.21-7.3.1 OpenIPMI-debuginfo-2.0.21-7.3.1 OpenIPMI-debugsource-2.0.21-7.3.1 OpenIPMI-devel-2.0.21-7.3.1 OpenIPMI-python-2.0.21-7.3.1 OpenIPMI-python-debuginfo-2.0.21-7.3.1 References: https://bugzilla.suse.com/1046174

1 0

openSUSE-SU-2017:1803-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1803-1 Rating: moderate References: #1035829 #1041830 #1045060 #1045062 #1045065 Cross-References: CVE-2017-3167 CVE-2017-3169 CVE-2017-7679 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for apache2 provides the following fixes: Security issues fixed: - CVE-2017-3167: In Apache use of httpd ap_get_basic_auth_pw() outside of the authentication phase could lead to authentication requirements bypass (bsc#1045065) - CVE-2017-3169: In mod_ssl may have a dereference NULL pointer issue which could lead to denial of service (bsc#1045062) - CVE-2017-7679: In mod_mime can buffer over-read by 1 byte, potentially leading to a crash or information disclosure (bsc#1045060) Non-Security issues fixed: - Remove /usr/bin/http2 symlink only during apache2 package uninstall, not upgrade. (bsc#1041830) - In gensslcert, use hostname when fqdn is too long. (bsc#1035829) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-786=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-2.4.23-8.6.1 apache2-debuginfo-2.4.23-8.6.1 apache2-debugsource-2.4.23-8.6.1 apache2-devel-2.4.23-8.6.1 apache2-event-2.4.23-8.6.1 apache2-event-debuginfo-2.4.23-8.6.1 apache2-example-pages-2.4.23-8.6.1 apache2-prefork-2.4.23-8.6.1 apache2-prefork-debuginfo-2.4.23-8.6.1 apache2-utils-2.4.23-8.6.1 apache2-utils-debuginfo-2.4.23-8.6.1 apache2-worker-2.4.23-8.6.1 apache2-worker-debuginfo-2.4.23-8.6.1 - openSUSE Leap 42.2 (noarch): apache2-doc-2.4.23-8.6.1 References: https://www.suse.com/security/cve/CVE-2017-3167.html https://www.suse.com/security/cve/CVE-2017-3169.html https://www.suse.com/security/cve/CVE-2017-7679.html https://bugzilla.suse.com/1035829 https://bugzilla.suse.com/1041830 https://bugzilla.suse.com/1045060 https://bugzilla.suse.com/1045062 https://bugzilla.suse.com/1045065

1 0

openSUSE-SU-2017:1802-1: moderate: Security update for libXdmcp
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for libXdmcp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1802-1 Rating: moderate References: #1025046 Cross-References: CVE-2017-2625 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libXdmcp fixes the following issues: - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable (boo#1025046) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-789=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libXdmcp-debugsource-1.1.2-3.3.1 libXdmcp-devel-1.1.2-3.3.1 libXdmcp6-1.1.2-3.3.1 libXdmcp6-debuginfo-1.1.2-3.3.1 - openSUSE Leap 42.2 (x86_64): libXdmcp-devel-32bit-1.1.2-3.3.1 libXdmcp6-32bit-1.1.2-3.3.1 libXdmcp6-debuginfo-32bit-1.1.2-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-2625.html https://bugzilla.suse.com/1025046

1 0

openSUSE-SU-2017:1801-1: moderate: Security update for libICE
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for libICE ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1801-1 Rating: moderate References: #1025068 Cross-References: CVE-2017-2626 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libICE fixes the following issues: - CVE-2017-2626: Creation of the ICE auth session cookies used insufficient randomness, making these cookies predictable. A more random generation method has been implemented. (boo#1025068) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-784=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libICE-debugsource-1.0.9-5.3.1 libICE-devel-1.0.9-5.3.1 libICE6-1.0.9-5.3.1 libICE6-debuginfo-1.0.9-5.3.1 - openSUSE Leap 42.2 (x86_64): libICE-devel-32bit-1.0.9-5.3.1 libICE6-32bit-1.0.9-5.3.1 libICE6-debuginfo-32bit-1.0.9-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-2626.html https://bugzilla.suse.com/1025068

1 0

openSUSE-SU-2017:1800-1: moderate: Security update for php7
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1800-1 Rating: moderate References: #1032155 #1035111 #1040883 #1040889 #1040891 Cross-References: CVE-2016-6294 CVE-2017-6441 CVE-2017-9224 CVE-2017-9226 CVE-2017-9227 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for php7 fixes the following security issues: - CVE-2017-9224: stack out-of-bounds read occurs in match_at() could lead to Denial of service (bsc#1040891) - CVE-2017-9226: heap out-of-bounds write orread occurs in next_state_val() could lead to Denial of service(bsc#1040889) - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len() could lead to Denial of service (bsc#1040883) - CVE-2017-6441: The _zval_get_long_func_ex in Zend/zend_operators.c in PHP allowed attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script (bsc#1032155). - CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods.c did not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument (bsc#1035111). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-790=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache2-mod_php7-7.0.7-14.6.1 apache2-mod_php7-debuginfo-7.0.7-14.6.1 php7-7.0.7-14.6.1 php7-bcmath-7.0.7-14.6.1 php7-bcmath-debuginfo-7.0.7-14.6.1 php7-bz2-7.0.7-14.6.1 php7-bz2-debuginfo-7.0.7-14.6.1 php7-calendar-7.0.7-14.6.1 php7-calendar-debuginfo-7.0.7-14.6.1 php7-ctype-7.0.7-14.6.1 php7-ctype-debuginfo-7.0.7-14.6.1 php7-curl-7.0.7-14.6.1 php7-curl-debuginfo-7.0.7-14.6.1 php7-dba-7.0.7-14.6.1 php7-dba-debuginfo-7.0.7-14.6.1 php7-debuginfo-7.0.7-14.6.1 php7-debugsource-7.0.7-14.6.1 php7-devel-7.0.7-14.6.1 php7-dom-7.0.7-14.6.1 php7-dom-debuginfo-7.0.7-14.6.1 php7-enchant-7.0.7-14.6.1 php7-enchant-debuginfo-7.0.7-14.6.1 php7-exif-7.0.7-14.6.1 php7-exif-debuginfo-7.0.7-14.6.1 php7-fastcgi-7.0.7-14.6.1 php7-fastcgi-debuginfo-7.0.7-14.6.1 php7-fileinfo-7.0.7-14.6.1 php7-fileinfo-debuginfo-7.0.7-14.6.1 php7-firebird-7.0.7-14.6.1 php7-firebird-debuginfo-7.0.7-14.6.1 php7-fpm-7.0.7-14.6.1 php7-fpm-debuginfo-7.0.7-14.6.1 php7-ftp-7.0.7-14.6.1 php7-ftp-debuginfo-7.0.7-14.6.1 php7-gd-7.0.7-14.6.1 php7-gd-debuginfo-7.0.7-14.6.1 php7-gettext-7.0.7-14.6.1 php7-gettext-debuginfo-7.0.7-14.6.1 php7-gmp-7.0.7-14.6.1 php7-gmp-debuginfo-7.0.7-14.6.1 php7-iconv-7.0.7-14.6.1 php7-iconv-debuginfo-7.0.7-14.6.1 php7-imap-7.0.7-14.6.1 php7-imap-debuginfo-7.0.7-14.6.1 php7-intl-7.0.7-14.6.1 php7-intl-debuginfo-7.0.7-14.6.1 php7-json-7.0.7-14.6.1 php7-json-debuginfo-7.0.7-14.6.1 php7-ldap-7.0.7-14.6.1 php7-ldap-debuginfo-7.0.7-14.6.1 php7-mbstring-7.0.7-14.6.1 php7-mbstring-debuginfo-7.0.7-14.6.1 php7-mcrypt-7.0.7-14.6.1 php7-mcrypt-debuginfo-7.0.7-14.6.1 php7-mysql-7.0.7-14.6.1 php7-mysql-debuginfo-7.0.7-14.6.1 php7-odbc-7.0.7-14.6.1 php7-odbc-debuginfo-7.0.7-14.6.1 php7-opcache-7.0.7-14.6.1 php7-opcache-debuginfo-7.0.7-14.6.1 php7-openssl-7.0.7-14.6.1 php7-openssl-debuginfo-7.0.7-14.6.1 php7-pcntl-7.0.7-14.6.1 php7-pcntl-debuginfo-7.0.7-14.6.1 php7-pdo-7.0.7-14.6.1 php7-pdo-debuginfo-7.0.7-14.6.1 php7-pgsql-7.0.7-14.6.1 php7-pgsql-debuginfo-7.0.7-14.6.1 php7-phar-7.0.7-14.6.1 php7-phar-debuginfo-7.0.7-14.6.1 php7-posix-7.0.7-14.6.1 php7-posix-debuginfo-7.0.7-14.6.1 php7-pspell-7.0.7-14.6.1 php7-pspell-debuginfo-7.0.7-14.6.1 php7-readline-7.0.7-14.6.1 php7-readline-debuginfo-7.0.7-14.6.1 php7-shmop-7.0.7-14.6.1 php7-shmop-debuginfo-7.0.7-14.6.1 php7-snmp-7.0.7-14.6.1 php7-snmp-debuginfo-7.0.7-14.6.1 php7-soap-7.0.7-14.6.1 php7-soap-debuginfo-7.0.7-14.6.1 php7-sockets-7.0.7-14.6.1 php7-sockets-debuginfo-7.0.7-14.6.1 php7-sqlite-7.0.7-14.6.1 php7-sqlite-debuginfo-7.0.7-14.6.1 php7-sysvmsg-7.0.7-14.6.1 php7-sysvmsg-debuginfo-7.0.7-14.6.1 php7-sysvsem-7.0.7-14.6.1 php7-sysvsem-debuginfo-7.0.7-14.6.1 php7-sysvshm-7.0.7-14.6.1 php7-sysvshm-debuginfo-7.0.7-14.6.1 php7-tidy-7.0.7-14.6.1 php7-tidy-debuginfo-7.0.7-14.6.1 php7-tokenizer-7.0.7-14.6.1 php7-tokenizer-debuginfo-7.0.7-14.6.1 php7-wddx-7.0.7-14.6.1 php7-wddx-debuginfo-7.0.7-14.6.1 php7-xmlreader-7.0.7-14.6.1 php7-xmlreader-debuginfo-7.0.7-14.6.1 php7-xmlrpc-7.0.7-14.6.1 php7-xmlrpc-debuginfo-7.0.7-14.6.1 php7-xmlwriter-7.0.7-14.6.1 php7-xmlwriter-debuginfo-7.0.7-14.6.1 php7-xsl-7.0.7-14.6.1 php7-xsl-debuginfo-7.0.7-14.6.1 php7-zip-7.0.7-14.6.1 php7-zip-debuginfo-7.0.7-14.6.1 php7-zlib-7.0.7-14.6.1 php7-zlib-debuginfo-7.0.7-14.6.1 - openSUSE Leap 42.2 (noarch): php7-pear-7.0.7-14.6.1 php7-pear-Archive_Tar-7.0.7-14.6.1 References: https://www.suse.com/security/cve/CVE-2016-6294.html https://www.suse.com/security/cve/CVE-2017-6441.html https://www.suse.com/security/cve/CVE-2017-9224.html https://www.suse.com/security/cve/CVE-2017-9226.html https://www.suse.com/security/cve/CVE-2017-9227.html https://bugzilla.suse.com/1032155 https://bugzilla.suse.com/1035111 https://bugzilla.suse.com/1040883 https://bugzilla.suse.com/1040889 https://bugzilla.suse.com/1040891

1 0

openSUSE-SU-2017:1798-1: moderate: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1798-1 Rating: moderate References: #1036985 Cross-References: CVE-2017-8350 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2017-8350: an additional fix for a denial of service memory leak in the JNG decoder was done. [boo#1036985 c13-c21] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-781=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.12.3 GraphicsMagick-debuginfo-1.3.25-11.12.3 GraphicsMagick-debugsource-1.3.25-11.12.3 GraphicsMagick-devel-1.3.25-11.12.3 libGraphicsMagick++-Q16-12-1.3.25-11.12.3 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.12.3 libGraphicsMagick++-devel-1.3.25-11.12.3 libGraphicsMagick-Q16-3-1.3.25-11.12.3 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.12.3 libGraphicsMagick3-config-1.3.25-11.12.3 libGraphicsMagickWand-Q16-2-1.3.25-11.12.3 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.12.3 perl-GraphicsMagick-1.3.25-11.12.3 perl-GraphicsMagick-debuginfo-1.3.25-11.12.3 References: https://www.suse.com/security/cve/CVE-2017-8350.html https://bugzilla.suse.com/1036985

1 0

openSUSE-SU-2017:1797-1: important: Security update for clamav
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1797-1 Rating: important References: #1045490 Cross-References: CVE-2012-6706 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for clamav fixes the following security issue: - CVE-2012-6706: Fixed an arbitrary memory write in VMSF_DELTA filter in libclamunrar (bsc#1045490) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-779=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): clamav-0.99.2-16.3.1 clamav-debuginfo-0.99.2-16.3.1 clamav-debugsource-0.99.2-16.3.1 References: https://www.suse.com/security/cve/CVE-2012-6706.html https://bugzilla.suse.com/1045490

1 0

openSUSE-RU-2017:1796-1: Recommended update for clamav-database
by maintenance＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1796-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh July 3rd 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-778=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201707030006-54.48.1 References:

1 0

openSUSE-RU-2017:1791-1: moderate: Recommended update for espeak-gui
by maintenance＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Recommended Update: Recommended update for espeak-gui ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1791-1 Rating: moderate References: #910900 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for espeak-gui fixes the following issues: - Espeak-gui did not use selected language to speech (bsc#910900) The following changes are included: - Add Lithuanian translation Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-775=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): espeak-gui-0.4-11.3.1 espeak-gui-lang-0.4-11.3.1 References: https://bugzilla.suse.com/910900

1 0

openSUSE-OU-2017:1789-1: moderate: Optional update for live-fat-stick
by maintenance＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Optional Update: Optional update for live-fat-stick ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:1789-1 Rating: moderate References: #1046499 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for live-fat-stick contains some improvements to create live USB media on FAT devices more reliably. - more various checks before and after writing ISO to ensure non-broken LiveUSB - check iso size as vfat does not support file larger than 4G. - Support also non-vfat partitions (e.g. ntfs) via new live-grub-stick script - fix GRUB2 installation Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-776=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): live-fat-stick-0.4.2-6.3.1 live-grub-stick-0.4.2-6.3.1 live-usb-gui-0.4.2-6.3.1 References: https://bugzilla.suse.com/1046499

1 0