July 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:1966-1: moderate: Security update for containerd, docker, runc
by opensuse-security＠opensuse.org 26 Jul '17

26 Jul '17

openSUSE Security Update: Security update for containerd, docker, runc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1966-1 Rating: moderate References: #1004490 #1009961 #1012568 #1015661 #1016307 #1019251 #988408 Cross-References: CVE-2016-9962 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has 6 fixes is now available. Description: This update for - containerd, - docker to version 1.12.6 and - runc fixes several issues. This security issues was fixed: - CVE-2016-9962: container escape vulnerability (bsc#1012568). Thsese non-security issues were fixed: - boo#1019251: Add a delay when starting docker service - Fixed bash-completion - boo#1015661: add the /usr/bin/docker-run symlink For additional details please see the changelog. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-181=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-181=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): containerd-0.2.5+gitr569_2a5e70c-8.1 containerd-ctr-0.2.5+gitr569_2a5e70c-8.1 containerd-ctr-debuginfo-0.2.5+gitr569_2a5e70c-8.1 containerd-debuginfo-0.2.5+gitr569_2a5e70c-8.1 containerd-debugsource-0.2.5+gitr569_2a5e70c-8.1 docker-1.12.6-25.2 docker-debuginfo-1.12.6-25.2 docker-debugsource-1.12.6-25.2 docker-test-1.12.6-25.2 docker-test-debuginfo-1.12.6-25.2 runc-0.1.1+gitr2819_50a19c6-8.1 runc-debuginfo-0.1.1+gitr2819_50a19c6-8.1 runc-debugsource-0.1.1+gitr2819_50a19c6-8.1 - openSUSE Leap 42.2 (noarch): containerd-test-0.2.5+gitr569_2a5e70c-8.1 docker-bash-completion-1.12.6-25.2 docker-zsh-completion-1.12.6-25.2 runc-test-0.1.1+gitr2819_50a19c6-8.1 - openSUSE Leap 42.1 (i586 x86_64): containerd-0.2.5+gitr569_2a5e70c-10.1 containerd-ctr-0.2.5+gitr569_2a5e70c-10.1 containerd-ctr-debuginfo-0.2.5+gitr569_2a5e70c-10.1 containerd-debuginfo-0.2.5+gitr569_2a5e70c-10.1 containerd-debugsource-0.2.5+gitr569_2a5e70c-10.1 runc-0.1.1+gitr2819_50a19c6-10.1 runc-debuginfo-0.1.1+gitr2819_50a19c6-10.1 runc-debugsource-0.1.1+gitr2819_50a19c6-10.1 - openSUSE Leap 42.1 (noarch): containerd-test-0.2.5+gitr569_2a5e70c-10.1 docker-bash-completion-1.12.6-27.1 docker-zsh-completion-1.12.6-27.1 runc-test-0.1.1+gitr2819_50a19c6-10.1 - openSUSE Leap 42.1 (x86_64): docker-1.12.6-27.1 docker-debuginfo-1.12.6-27.1 docker-debugsource-1.12.6-27.1 docker-test-1.12.6-27.1 docker-test-debuginfo-1.12.6-27.1 References: https://www.suse.com/security/cve/CVE-2016-9962.html https://bugzilla.suse.com/1004490 https://bugzilla.suse.com/1009961 https://bugzilla.suse.com/1012568 https://bugzilla.suse.com/1015661 https://bugzilla.suse.com/1016307 https://bugzilla.suse.com/1019251 https://bugzilla.suse.com/988408

1 0

openSUSE-SU-2017:1960-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 26 Jul '17

26 Jul '17

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1960-1 Rating: moderate References: #1009994 #1010756 #1010757 #1010766 #1010774 #1010782 #1010968 #1010975 #1047958 Cross-References: CVE-2016-9262 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391 CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2017-1000050 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for jasper fixes the following issues: Security issues fixed: - CVE-2016-9262: Multiple integer overflows in the jas_realloc function in base/jas_malloc.c and mem_resize function in base/jas_stream.c allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (bsc#1009994) - CVE-2016-9388: The ras_getcmap function in ras_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010975) - CVE-2016-9389: The jpc_irct and jpc_iict functions in jpc_mct.c allow remote attackers to cause a denial of service (assertion failure). (bsc#1010968) - CVE-2016-9390: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010774) - CVE-2016-9391: The jpc_bitstream_getbits function in jpc_bs.c allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (bsc#1010782) - CVE-2017-1000050: The jp2_encode function in jp2_enc.c allows remote attackers to cause a denial of service. (bsc#1047958) CVEs already fixed with previous update: - CVE-2016-9392: The calcstepsizes function in jpc_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010757) - CVE-2016-9393: The jpc_pi_nextrpcl function in jpc_t2cod.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010766) - CVE-2016-9394: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010756) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-844=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-844=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): jasper-1.900.14-179.1 jasper-debuginfo-1.900.14-179.1 jasper-debugsource-1.900.14-179.1 libjasper-devel-1.900.14-179.1 libjasper1-1.900.14-179.1 libjasper1-debuginfo-1.900.14-179.1 - openSUSE Leap 42.3 (x86_64): libjasper1-32bit-1.900.14-179.1 libjasper1-debuginfo-32bit-1.900.14-179.1 - openSUSE Leap 42.2 (i586 x86_64): jasper-1.900.14-175.6.1 jasper-debuginfo-1.900.14-175.6.1 jasper-debugsource-1.900.14-175.6.1 libjasper-devel-1.900.14-175.6.1 libjasper1-1.900.14-175.6.1 libjasper1-debuginfo-1.900.14-175.6.1 - openSUSE Leap 42.2 (x86_64): libjasper1-32bit-1.900.14-175.6.1 libjasper1-debuginfo-32bit-1.900.14-175.6.1 References: https://www.suse.com/security/cve/CVE-2016-9262.html https://www.suse.com/security/cve/CVE-2016-9388.html https://www.suse.com/security/cve/CVE-2016-9389.html https://www.suse.com/security/cve/CVE-2016-9390.html https://www.suse.com/security/cve/CVE-2016-9391.html https://www.suse.com/security/cve/CVE-2016-9392.html https://www.suse.com/security/cve/CVE-2016-9393.html https://www.suse.com/security/cve/CVE-2016-9394.html https://www.suse.com/security/cve/CVE-2017-1000050.html https://bugzilla.suse.com/1009994 https://bugzilla.suse.com/1010756 https://bugzilla.suse.com/1010757 https://bugzilla.suse.com/1010766 https://bugzilla.suse.com/1010774 https://bugzilla.suse.com/1010782 https://bugzilla.suse.com/1010968 https://bugzilla.suse.com/1010975 https://bugzilla.suse.com/1047958

1 0

openSUSE-SU-2017:1959-1: moderate: Security update for catdoc
by opensuse-security＠opensuse.org 26 Jul '17

26 Jul '17

openSUSE Security Update: Security update for catdoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1959-1 Rating: moderate References: #1047877 Cross-References: CVE-2017-11110 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for catdoc fixes the following issues: - CVE-2017-11110: Attackers may have used specially crafted files to cause a denial of service through a heap-based buffer under-flow and application crash, or have unspecified other impact (boo#1047877) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-841=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): catdoc-0.95-10.1 catdoc-debuginfo-0.95-10.1 catdoc-debugsource-0.95-10.1 References: https://www.suse.com/security/cve/CVE-2017-11110.html https://bugzilla.suse.com/1047877

1 0

openSUSE-SU-2017:1958-1: moderate: Security update for Wireshark
by opensuse-security＠opensuse.org 26 Jul '17

26 Jul '17

openSUSE Security Update: Security update for Wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1958-1 Rating: moderate References: #1049255 #1049621 Cross-References: CVE-2017-11406 CVE-2017-11407 CVE-2017-11408 CVE-2017-11410 CVE-2017-11411 CVE-2017-7702 CVE-2017-9350 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update to Wireshark 2.2.8 fixes some minor vulnerabilities could be used to trigger dissector crashes, infinite loops, or cause excessive use of memory resources by making Wireshark read specially crafted packages from the network or a capture file: - CVE-2017-7702,CVE-2017-11410: WBMXL dissector infinite loop (wnpa-sec-2017-13) - CVE-2017-9350,CVE-2017-11411: openSAFETY dissector memory exhaustion (wnpa-sec-2017-28) - CVE-2017-11408: AMQP dissector crash (wnpa-sec-2017-34) - CVE-2017-11407: MQ dissector crash (wnpa-sec-2017-35) - CVE-2017-11406: DOCSIS infinite loop (wnpa-sec-2017-36) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-840=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-840=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): wireshark-2.2.8-17.1 wireshark-debuginfo-2.2.8-17.1 wireshark-debugsource-2.2.8-17.1 wireshark-devel-2.2.8-17.1 wireshark-ui-gtk-2.2.8-17.1 wireshark-ui-gtk-debuginfo-2.2.8-17.1 wireshark-ui-qt-2.2.8-17.1 wireshark-ui-qt-debuginfo-2.2.8-17.1 - openSUSE Leap 42.2 (x86_64): wireshark-2.2.8-14.9.1 wireshark-debuginfo-2.2.8-14.9.1 wireshark-debugsource-2.2.8-14.9.1 wireshark-devel-2.2.8-14.9.1 wireshark-ui-gtk-2.2.8-14.9.1 wireshark-ui-gtk-debuginfo-2.2.8-14.9.1 wireshark-ui-qt-2.2.8-14.9.1 wireshark-ui-qt-debuginfo-2.2.8-14.9.1 References: https://www.suse.com/security/cve/CVE-2017-11406.html https://www.suse.com/security/cve/CVE-2017-11407.html https://www.suse.com/security/cve/CVE-2017-11408.html https://www.suse.com/security/cve/CVE-2017-11410.html https://www.suse.com/security/cve/CVE-2017-11411.html https://www.suse.com/security/cve/CVE-2017-7702.html https://www.suse.com/security/cve/CVE-2017-9350.html https://bugzilla.suse.com/1049255 https://bugzilla.suse.com/1049621

1 0

openSUSE-SU-2017:1957-1: moderate: Recommended update for gsoap
by opensuse-security＠opensuse.org 26 Jul '17

26 Jul '17

openSUSE Security Update: Recommended update for gsoap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1957-1 Rating: moderate References: #1049348 Cross-References: CVE-2017-9765 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gsoap fixes the following security issue: - CVE-2017-9765: A remote attacker may have triggered a buffer overflow to cause a server crash (denial of service) after sending 2GB of a specially crafted XML message, or possibly have unspecified futher impact. (bsc#1049348) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-842=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-842=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gsoap-debugsource-2.8.46-3.1 gsoap-devel-2.8.46-3.1 gsoap-devel-debuginfo-2.8.46-3.1 libgsoap-2_8_46-2.8.46-3.1 libgsoap-2_8_46-debuginfo-2.8.46-3.1 - openSUSE Leap 42.3 (noarch): gsoap-doc-2.8.46-3.1 - openSUSE Leap 42.2 (i586 x86_64): gsoap-debugsource-2.8.33-2.3.1 gsoap-devel-2.8.33-2.3.1 gsoap-devel-debuginfo-2.8.33-2.3.1 libgsoap-2_8_33-2.8.33-2.3.1 libgsoap-2_8_33-debuginfo-2.8.33-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-9765.html https://bugzilla.suse.com/1049348

1 0

openSUSE-RU-2017:1956-1: Recommended update for clamav-database
by maintenance＠opensuse.org 26 Jul '17

26 Jul '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1956-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh July 24th 2017. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-843=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201707240005-54.57.1 References:

1 0

openSUSE-RU-2017:1949-1: Recommended update for smartmontools
by maintenance＠opensuse.org 24 Jul '17

24 Jul '17

openSUSE Recommended Update: Recommended update for smartmontools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1949-1 Rating: low References: #900099 #983938 #999541 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update provides a new version of smartmontools with various improvements and bug fixes: - Experimental support for NVMe devices on FreeBSD, Linux and Windows. (boo#999541) - smartctl '-i', '-c', '-H' and '-l error': NVMe support. - smartctl '-l nvmelog': New option for NVMe. - smartd.conf '-H', '-l error' and '-W': NVMe support. - Optional NVMe device scanning support on Linux and Windows. - Configure option '--with-nvme-devicescan' to include NVMe in default device scanning result. - Drop systemd dependency on syslog.target (boo#983938). - SCSI: Improved support of modern disks (SAS SSDs). - AACRAID fixes, SMART STATUS should work now. - '/dev/megaraid_sas_ioctl_node' fd leak fix. - Re-add /usr/sbin/rcsmards symlink (boo#900099). - Fix service restart in smartmontools.generate_smartd_opts.in (boo#900099). - re-add sysvinit support in specfile. - HDD, SSD and USB additions to drive database. - Build with large file support in 32 bit systems. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-836=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-836=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): smartmontools-6.5-8.1 smartmontools-debuginfo-6.5-8.1 smartmontools-debugsource-6.5-8.1 - openSUSE Leap 42.2 (i586 x86_64): smartmontools-6.5-5.3.1 smartmontools-debuginfo-6.5-5.3.1 smartmontools-debugsource-6.5-5.3.1 References: https://bugzilla.suse.com/900099 https://bugzilla.suse.com/983938 https://bugzilla.suse.com/999541

1 0

openSUSE-SU-2017:1948-1: important: Security update for rubygem-puppet
by opensuse-security＠opensuse.org 24 Jul '17

24 Jul '17

openSUSE Security Update: Security update for rubygem-puppet ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1948-1 Rating: important References: #1040151 Cross-References: CVE-2017-2295 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-puppet fixes the following issues: - CVE-2017-2295: A remote attacker could have forced unsafe YAML deserialization which could have led to code execution (bsc#1040151) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-835=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-835=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ruby2.1-rubygem-puppet-3.8.7-20.1 ruby2.1-rubygem-puppet-doc-3.8.7-20.1 ruby2.1-rubygem-puppet-testsuite-3.8.7-20.1 ruby2.2-rubygem-puppet-3.8.7-20.1 ruby2.2-rubygem-puppet-doc-3.8.7-20.1 ruby2.2-rubygem-puppet-testsuite-3.8.7-20.1 ruby2.3-rubygem-puppet-3.8.7-20.1 ruby2.3-rubygem-puppet-doc-3.8.7-20.1 ruby2.3-rubygem-puppet-testsuite-3.8.7-20.1 ruby2.4-rubygem-puppet-3.8.7-20.1 ruby2.4-rubygem-puppet-doc-3.8.7-20.1 ruby2.4-rubygem-puppet-testsuite-3.8.7-20.1 rubygem-puppet-3.8.7-20.1 rubygem-puppet-master-3.8.7-20.1 - openSUSE Leap 42.3 (noarch): rubygem-puppet-emacs-3.8.7-20.1 rubygem-puppet-master-unicorn-3.8.7-20.1 rubygem-puppet-vim-3.8.7-20.1 - openSUSE Leap 42.2 (i586 x86_64): ruby2.1-rubygem-puppet-3.8.7-17.3.1 ruby2.1-rubygem-puppet-doc-3.8.7-17.3.1 ruby2.1-rubygem-puppet-testsuite-3.8.7-17.3.1 rubygem-puppet-3.8.7-17.3.1 rubygem-puppet-master-3.8.7-17.3.1 - openSUSE Leap 42.2 (noarch): rubygem-puppet-emacs-3.8.7-17.3.1 rubygem-puppet-master-unicorn-3.8.7-17.3.1 rubygem-puppet-vim-3.8.7-17.3.1 References: https://www.suse.com/security/cve/CVE-2017-2295.html https://bugzilla.suse.com/1040151

1 0

openSUSE-RU-2017:1947-1: moderate: Recommended update for coolkey
by maintenance＠opensuse.org 24 Jul '17

24 Jul '17

openSUSE Recommended Update: Recommended update for coolkey ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:1947-1 Rating: moderate References: #1049213 #996047 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for coolkey provides fixes and enhancements, including: - PK15 support. - Fix CAC card support. - Fix card removal issues. - Add PKCS11 module to p11-kit-32bit. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-839=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-839=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): coolkey-1.1.0-156.1 coolkey-debuginfo-1.1.0-156.1 coolkey-debugsource-1.1.0-156.1 coolkey-devel-1.1.0-156.1 - openSUSE Leap 42.3 (x86_64): coolkey-32bit-1.1.0-156.1 coolkey-debuginfo-32bit-1.1.0-156.1 - openSUSE Leap 42.2 (i586 x86_64): coolkey-1.1.0-153.3.1 coolkey-debuginfo-1.1.0-153.3.1 coolkey-debugsource-1.1.0-153.3.1 coolkey-devel-1.1.0-153.3.1 - openSUSE Leap 42.2 (x86_64): coolkey-32bit-1.1.0-153.3.1 coolkey-debuginfo-32bit-1.1.0-153.3.1 References: https://bugzilla.suse.com/1049213 https://bugzilla.suse.com/996047

1 0

openSUSE-SU-2017:1934-1: moderate: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 24 Jul '17

24 Jul '17

openSUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1934-1 Rating: moderate References: #1025084 #1047154 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Improve retrieval of entropy for generating random authentication cookies (bsc#1025084) - Fix rendering with glamor acceleration. (bsc#1047154) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-826=2 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): xorg-x11-server-7.6_1.18.3-22.1 xorg-x11-server-debuginfo-7.6_1.18.3-22.1 xorg-x11-server-debugsource-7.6_1.18.3-22.1 xorg-x11-server-extra-7.6_1.18.3-22.1 xorg-x11-server-extra-debuginfo-7.6_1.18.3-22.1 xorg-x11-server-sdk-7.6_1.18.3-22.1 xorg-x11-server-source-7.6_1.18.3-22.1 References: https://bugzilla.suse.com/1025084 https://bugzilla.suse.com/1047154

1 0