July 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:1822-1: moderate: Security update for libgcrypt
by opensuse-security＠opensuse.org 08 Jul '17

08 Jul '17

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1822-1 Rating: moderate References: #1046607 Cross-References: CVE-2017-7526 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libgcrypt fixes the following issues: - CVE-2017-7526: Hardening against a local side-channel attack in RSA key handling has been added (bsc#1046607) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-796=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libgcrypt-cavs-1.6.1-34.6.1 libgcrypt-cavs-debuginfo-1.6.1-34.6.1 libgcrypt-debugsource-1.6.1-34.6.1 libgcrypt-devel-1.6.1-34.6.1 libgcrypt-devel-debuginfo-1.6.1-34.6.1 libgcrypt20-1.6.1-34.6.1 libgcrypt20-debuginfo-1.6.1-34.6.1 libgcrypt20-hmac-1.6.1-34.6.1 - openSUSE Leap 42.2 (x86_64): libgcrypt-devel-32bit-1.6.1-34.6.1 libgcrypt-devel-debuginfo-32bit-1.6.1-34.6.1 libgcrypt20-32bit-1.6.1-34.6.1 libgcrypt20-debuginfo-32bit-1.6.1-34.6.1 libgcrypt20-hmac-32bit-1.6.1-34.6.1 References: https://www.suse.com/security/cve/CVE-2017-7526.html https://bugzilla.suse.com/1046607

1 0

openSUSE-OU-2017:1818-1: Initial update for python-cached-property
by maintenance＠opensuse.org 07 Jul '17

07 Jul '17

openSUSE Optional Update: Initial update for python-cached-property ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:1818-1 Rating: low References: #1047468 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: Python-cached-property is a decorator for caching properties in classes. It makes caching of time or computational expensive properties quick and easy. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-795=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): python-cached-property-1.3.0-2.1 References: https://bugzilla.suse.com/1047468

1 0

openSUSE-RU-2017:1814-1: moderate: Recommended update for enigmail
by maintenance＠opensuse.org 07 Jul '17

07 Jul '17

openSUSE Recommended Update: Recommended update for enigmail ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1814-1 Rating: moderate References: #1047252 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for enigmail to version 1.9.8 fixes the following issues: - enigmail may have blocked in the mail sending process (boo#1047252) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-794=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): enigmail-1.9.8-2.6.1 References: https://bugzilla.suse.com/1047252

1 0

openSUSE-SU-2017:1811-1: moderate: Security update for vim
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for vim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1811-1 Rating: moderate References: #1018870 #1024724 #1027053 #1027057 Cross-References: CVE-2017-5953 CVE-2017-6349 CVE-2017-6350 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for vim fixes the following issues: Security issues fixed: - CVE-2017-5953: Fixed a possible overflow with corrupted spell file (bsc#1024724) - CVE-2017-6350: Fixed a possible overflow when reading a corrupted undo file (bsc#1027053) - CVE-2017-6349: Fixed a possible overflow when reading a corrupted undo file (bsc#1027057) Non security issues fixed: - Speed up YAML syntax highlighting (bsc#1018870) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-788=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gvim-7.4.326-10.3.1 gvim-debuginfo-7.4.326-10.3.1 vim-7.4.326-10.3.1 vim-debuginfo-7.4.326-10.3.1 vim-debugsource-7.4.326-10.3.1 - openSUSE Leap 42.2 (noarch): vim-data-7.4.326-10.3.1 References: https://www.suse.com/security/cve/CVE-2017-5953.html https://www.suse.com/security/cve/CVE-2017-6349.html https://www.suse.com/security/cve/CVE-2017-6350.html https://bugzilla.suse.com/1018870 https://bugzilla.suse.com/1024724 https://bugzilla.suse.com/1027053 https://bugzilla.suse.com/1027057

1 0

openSUSE-SU-2017:1810-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1810-1 Rating: moderate References: #1044887 #1044894 Cross-References: CVE-2017-7375 CVE-2017-7376 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libxml2 fixes the following issues: Security issues fixed: * CVE-2017-7376: Increase buffer space for port in HTTP redirect support (bsc#1044887) * CVE-2017-7375: Prevent unwanted external entity reference (bsc#1044894) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-793=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libxml2-2-2.9.4-5.10.1 libxml2-2-debuginfo-2.9.4-5.10.1 libxml2-debugsource-2.9.4-5.10.1 libxml2-devel-2.9.4-5.10.1 libxml2-tools-2.9.4-5.10.1 libxml2-tools-debuginfo-2.9.4-5.10.1 python-libxml2-2.9.4-5.10.1 python-libxml2-debuginfo-2.9.4-5.10.1 python-libxml2-debugsource-2.9.4-5.10.1 - openSUSE Leap 42.2 (x86_64): libxml2-2-32bit-2.9.4-5.10.1 libxml2-2-debuginfo-32bit-2.9.4-5.10.1 libxml2-devel-32bit-2.9.4-5.10.1 - openSUSE Leap 42.2 (noarch): libxml2-doc-2.9.4-5.10.1 References: https://www.suse.com/security/cve/CVE-2017-7375.html https://www.suse.com/security/cve/CVE-2017-7376.html https://bugzilla.suse.com/1044887 https://bugzilla.suse.com/1044894

1 0

openSUSE-SU-2017:1809-1: important: Security update for bind
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1809-1 Rating: important References: #1046554 #1046555 Cross-References: CVE-2017-3142 CVE-2017-3143 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - An attacker with the ability to send and receive messages to an authoritative DNS server was able to circumvent TSIG authentication of AXFR requests. A server that relied solely on TSIG keys for protection could be manipulated into (1) providing an AXFR of a zone to an unauthorized recipient and (2) accepting bogus Notify packets. [bsc#1046554, CVE-2017-3142] - An attacker who with the ability to send and receive messages to an authoritative DNS server and who had knowledge of a valid TSIG key name for the zone and service being targeted was able to manipulate BIND into accepting an unauthorized dynamic update. [bsc#1046555, CVE-2017-3143] This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-783=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): bind-9.9.9P1-48.6.1 bind-chrootenv-9.9.9P1-48.6.1 bind-debuginfo-9.9.9P1-48.6.1 bind-debugsource-9.9.9P1-48.6.1 bind-devel-9.9.9P1-48.6.1 bind-libs-9.9.9P1-48.6.1 bind-libs-debuginfo-9.9.9P1-48.6.1 bind-lwresd-9.9.9P1-48.6.1 bind-lwresd-debuginfo-9.9.9P1-48.6.1 bind-utils-9.9.9P1-48.6.1 bind-utils-debuginfo-9.9.9P1-48.6.1 - openSUSE Leap 42.2 (x86_64): bind-libs-32bit-9.9.9P1-48.6.1 bind-libs-debuginfo-32bit-9.9.9P1-48.6.1 - openSUSE Leap 42.2 (noarch): bind-doc-9.9.9P1-48.6.1 References: https://www.suse.com/security/cve/CVE-2017-3142.html https://www.suse.com/security/cve/CVE-2017-3143.html https://bugzilla.suse.com/1046554 https://bugzilla.suse.com/1046555

1 0

openSUSE-RU-2017:1808-1: Recommended update for dirmngr
by maintenance＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Recommended Update: Recommended update for dirmngr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1808-1 Rating: low References: #1045943 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dirmngr provides the following fix: - Change logrotate from Requires to Recommends (bsc#1045943) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-792=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dirmngr-1.1.1-16.3.1 dirmngr-debuginfo-1.1.1-16.3.1 dirmngr-debugsource-1.1.1-16.3.1 - openSUSE Leap 42.2 (noarch): dirmngr-lang-1.1.1-16.3.1 References: https://bugzilla.suse.com/1045943

1 0

openSUSE-SU-2017:1807-1: moderate: Security update for dovecot22
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for dovecot22 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1807-1 Rating: moderate References: #1032248 #854512 #932386 Cross-References: CVE-2017-2669 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for dovecot22 to version 2.2.30.2 fixes the following issues: This security issue was fixed: - CVE-2017-2669: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS (bsc#1032248) Additionally stronger SSL default ciphers are now used. This non-security issue was fixed: - Remove all references /etc/ssl/certs/. It should not be used anymore (bsc#932386) The version 2.2.30.2 also includes many fixes and enhancements: - Multiple failed authentications within short time caused crashes. - Use timing safe comparisons for everything related to passwords. - Master process now sends SIGQUIT to all running children at shutdown, which instructs them to close all the socket listeners immediately. Restarting Dovecot should no longer fail due to some processes keeping the listeners open for a long time. - Add passdb { mechanisms=none } to match separate passdb lookup. - Add passdb { username_filter } to use passdb only if user matches the filter. - Add dsync_commit_msgs_interval setting. It attempts to commit the transaction after saving this many new messages. - Support imapc_features=search without ESEARCH extension. - Add imapc_features=fetch-bodystructure to pass through remote server's FETCH BODY and BODYSTRUCTURE. - Add quota=imapc backend to use GETQUOTA/GETQUOTAROOT on the remote server. - Add allow_invalid_cert and ssl_ca_file parameters. - If dovecot.index.cache corruption is detected, reset only the one corrupted mail instead of the whole file. - Add "firstsaved" field to doveadm mailbox status. - Add old host's up/down and vhost count as parameters to director_flush_socket. - More fixes to automatically fix corruption in dovecot.list.index. - Fix support for dsync_features=empty-header-workaround. - IMAP NOTIFY wasn't working for non-INBOX if IMAP client hadn't enabled modseq tracking via CONDSTORE/QRESYNC. - Fix fts-lucene it to work again with mbox format. - Some internal error messages may have contained garbage in v2.2.29. - Re-encrypt when copying/moving mails and per-mailbox keys are used, otherwise the copied mails can't be opened. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-787=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dovecot22-2.2.30.2-5.4.1 dovecot22-backend-mysql-2.2.30.2-5.4.1 dovecot22-backend-mysql-debuginfo-2.2.30.2-5.4.1 dovecot22-backend-pgsql-2.2.30.2-5.4.1 dovecot22-backend-pgsql-debuginfo-2.2.30.2-5.4.1 dovecot22-backend-sqlite-2.2.30.2-5.4.1 dovecot22-backend-sqlite-debuginfo-2.2.30.2-5.4.1 dovecot22-debuginfo-2.2.30.2-5.4.1 dovecot22-debugsource-2.2.30.2-5.4.1 dovecot22-devel-2.2.30.2-5.4.1 dovecot22-fts-2.2.30.2-5.4.1 dovecot22-fts-debuginfo-2.2.30.2-5.4.1 dovecot22-fts-lucene-2.2.30.2-5.4.1 dovecot22-fts-lucene-debuginfo-2.2.30.2-5.4.1 dovecot22-fts-solr-2.2.30.2-5.4.1 dovecot22-fts-solr-debuginfo-2.2.30.2-5.4.1 dovecot22-fts-squat-2.2.30.2-5.4.1 dovecot22-fts-squat-debuginfo-2.2.30.2-5.4.1 References: https://www.suse.com/security/cve/CVE-2017-2669.html https://bugzilla.suse.com/1032248 https://bugzilla.suse.com/854512 https://bugzilla.suse.com/932386

1 0

openSUSE-SU-2017:1806-1: moderate: Security update for libquicktime
by opensuse-security＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Security Update: Security update for libquicktime ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1806-1 Rating: moderate References: #1044000 #1044002 #1044006 #1044008 #1044009 #1044077 #1044122 Cross-References: CVE-2017-9122 CVE-2017-9123 CVE-2017-9124 CVE-2017-9125 CVE-2017-9126 CVE-2017-9127 CVE-2017-9128 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libquicktime fixes the following issues: * CVE-2017-9122: A DoS in quicktime_read_moov function in moov.c via acrafted mp4 file was fixed. (boo#1044077) * CVE-2017-9123: An invalid memory read in lqt_frame_duration via a crafted mp4 file was fixed. (boo#1044009) * CVE-2017-9124: A NULL pointer dereference in quicktime_match_32 via a crafted mp4 file was fixed. (boo#1044008) * CVE-2017-9125: A DoS in lqt_frame_duration function in lqt_quicktime.c via crafted mp4 file was fixed. (boo#1044122) * CVE-2017-9126: A heap-based buffer overflow in quicktime_read_dref_table via a crafted mp4 file was fixed. (boo#1044006) * CVE-2017-9127: A heap-based buffer overflow in quicktime_user_atoms_read_atom via a crafted mp4 file was fixed. (boo#1044002) * CVE-2017-9128: A heap-based buffer over-read in quicktime_video_width via a crafted mp4 file was fixed. (boo#1044000) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-785=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libquicktime-debugsource-1.2.4cvs20150223-8.3.1 libquicktime-devel-1.2.4cvs20150223-8.3.1 libquicktime-tools-1.2.4cvs20150223-8.3.1 libquicktime-tools-debuginfo-1.2.4cvs20150223-8.3.1 libquicktime0-1.2.4cvs20150223-8.3.1 libquicktime0-debuginfo-1.2.4cvs20150223-8.3.1 - openSUSE Leap 42.2 (x86_64): libquicktime0-32bit-1.2.4cvs20150223-8.3.1 libquicktime0-debuginfo-32bit-1.2.4cvs20150223-8.3.1 References: https://www.suse.com/security/cve/CVE-2017-9122.html https://www.suse.com/security/cve/CVE-2017-9123.html https://www.suse.com/security/cve/CVE-2017-9124.html https://www.suse.com/security/cve/CVE-2017-9125.html https://www.suse.com/security/cve/CVE-2017-9126.html https://www.suse.com/security/cve/CVE-2017-9127.html https://www.suse.com/security/cve/CVE-2017-9128.html https://bugzilla.suse.com/1044000 https://bugzilla.suse.com/1044002 https://bugzilla.suse.com/1044006 https://bugzilla.suse.com/1044008 https://bugzilla.suse.com/1044009 https://bugzilla.suse.com/1044077 https://bugzilla.suse.com/1044122

1 0

openSUSE-RU-2017:1805-1: Recommended update for apache-commons-daemon
by maintenance＠opensuse.org 06 Jul '17

06 Jul '17

openSUSE Recommended Update: Recommended update for apache-commons-daemon ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1805-1 Rating: low References: #716139 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apache-commons-daemon provides the following fix: - Corrected error creating and using temporary files (bsc#716139) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-782=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): apache-commons-daemon-1.0.15-13.3.1 apache-commons-daemon-debugsource-1.0.15-13.3.1 apache-commons-daemon-jsvc-1.0.15-13.3.1 apache-commons-daemon-jsvc-debuginfo-1.0.15-13.3.1 - openSUSE Leap 42.2 (noarch): apache-commons-daemon-javadoc-1.0.15-13.3.1 References: https://bugzilla.suse.com/716139

1 0