August 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2017:2184-1: moderate: Security update of potrace
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Security Update: Security update of potrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2184-1 Rating: moderate References: #1051634 Cross-References: CVE-2017-12067 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for potrace fixes the following security issues: - CVE-2017-12067: potential buffer overflows and arithmetic overflows (bsc#1051634) The update also fixes various bugs, including a bug triggered by very large bitmaps. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-934=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-934=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libpotrace0-1.15-13.1 libpotrace0-debuginfo-1.15-13.1 potrace-1.15-13.1 potrace-debuginfo-1.15-13.1 potrace-debugsource-1.15-13.1 potrace-devel-1.15-13.1 - openSUSE Leap 42.2 (i586 x86_64): libpotrace0-1.15-10.3.1 libpotrace0-debuginfo-1.15-10.3.1 potrace-1.15-10.3.1 potrace-debuginfo-1.15-10.3.1 potrace-debugsource-1.15-10.3.1 potrace-devel-1.15-10.3.1 References: https://www.suse.com/security/cve/CVE-2017-12067.html https://bugzilla.suse.com/1051634

1 0

openSUSE-SU-2017:2183-1: important: Security update for subversion
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Security Update: Security update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2183-1 Rating: important References: #1026936 #1049448 #1051362 Cross-References: CVE-2017-9800 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for subversion to 1.9.7 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-9800: A remote attacker could have caused svn clients to execute arbitrary code via specially crafted URLs in svn:externals and svn:sync-from-url properties. (boo#1051362) - CVE-2005-4900: SHA-1 collisions may cause repository inconsistencies (boo#1026936) The following bugfix changes are included: - Add instructions for running svnserve as a user different from "svn", and remove sysconfig variables that are no longer effective with the systemd unit. (boo#1049448) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-940=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-940=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.9.7-8.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.9.7-8.1 libsvn_auth_kwallet-1-0-1.9.7-8.1 libsvn_auth_kwallet-1-0-debuginfo-1.9.7-8.1 subversion-1.9.7-8.1 subversion-debuginfo-1.9.7-8.1 subversion-debugsource-1.9.7-8.1 subversion-devel-1.9.7-8.1 subversion-perl-1.9.7-8.1 subversion-perl-debuginfo-1.9.7-8.1 subversion-python-1.9.7-8.1 subversion-python-ctypes-1.9.7-8.1 subversion-python-debuginfo-1.9.7-8.1 subversion-ruby-1.9.7-8.1 subversion-ruby-debuginfo-1.9.7-8.1 subversion-server-1.9.7-8.1 subversion-server-debuginfo-1.9.7-8.1 subversion-tools-1.9.7-8.1 subversion-tools-debuginfo-1.9.7-8.1 - openSUSE Leap 42.3 (noarch): subversion-bash-completion-1.9.7-8.1 - openSUSE Leap 42.2 (x86_64): libsvn_auth_gnome_keyring-1-0-1.9.7-5.3.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.9.7-5.3.1 libsvn_auth_kwallet-1-0-1.9.7-5.3.1 libsvn_auth_kwallet-1-0-debuginfo-1.9.7-5.3.1 subversion-1.9.7-5.3.1 subversion-debuginfo-1.9.7-5.3.1 subversion-debugsource-1.9.7-5.3.1 subversion-devel-1.9.7-5.3.1 subversion-perl-1.9.7-5.3.1 subversion-perl-debuginfo-1.9.7-5.3.1 subversion-python-1.9.7-5.3.1 subversion-python-ctypes-1.9.7-5.3.1 subversion-python-debuginfo-1.9.7-5.3.1 subversion-ruby-1.9.7-5.3.1 subversion-ruby-debuginfo-1.9.7-5.3.1 subversion-server-1.9.7-5.3.1 subversion-server-debuginfo-1.9.7-5.3.1 subversion-tools-1.9.7-5.3.1 subversion-tools-debuginfo-1.9.7-5.3.1 - openSUSE Leap 42.2 (noarch): subversion-bash-completion-1.9.7-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-9800.html https://bugzilla.suse.com/1026936 https://bugzilla.suse.com/1049448 https://bugzilla.suse.com/1051362

1 0

openSUSE-SU-2017:2182-1: important: Security update for git
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2182-1 Rating: important References: #1052481 Cross-References: CVE-2017-1000117 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following security issues: - CVE-2017-1000117: A malicious third-party could have caused a git client to execute arbitrary commands via crafted "ssh://..." URLs, including submodules (boo#1052481) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-939=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): git-2.13.5-3.1 git-arch-2.13.5-3.1 git-core-2.13.5-3.1 git-core-debuginfo-2.13.5-3.1 git-credential-gnome-keyring-2.13.5-3.1 git-credential-gnome-keyring-debuginfo-2.13.5-3.1 git-cvs-2.13.5-3.1 git-daemon-2.13.5-3.1 git-daemon-debuginfo-2.13.5-3.1 git-debugsource-2.13.5-3.1 git-email-2.13.5-3.1 git-gui-2.13.5-3.1 git-svn-2.13.5-3.1 git-svn-debuginfo-2.13.5-3.1 git-web-2.13.5-3.1 gitk-2.13.5-3.1 - openSUSE Leap 42.3 (noarch): git-doc-2.13.5-3.1 References: https://www.suse.com/security/cve/CVE-2017-1000117.html https://bugzilla.suse.com/1052481

1 0

openSUSE-SU-2017:2181-1: moderate: Security update for openldap2
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2181-1 Rating: moderate References: #1009470 #1031702 #1037396 #1041764 Cross-References: CVE-2017-9287 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for openldap2 fixes the following issues: * Let OpenLDAP read system wide certificate directory by default and avoid hiding the error if user specified CA location cannot be read (boo#1009470). * Fix CVE-2017-9287: openldap2: Double free vulnerability with patch (boo#1041764) * Fix an uninitialized variable that causes startup failure (boo#1037396) * Fix a regression in handling of non-blocking connection with (boo#1031702) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-936=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libldap-2_4-2-2.4.44-18.1 libldap-2_4-2-debuginfo-2.4.44-18.1 openldap2-2.4.44-18.1 openldap2-back-meta-2.4.44-18.1 openldap2-back-meta-debuginfo-2.4.44-18.1 openldap2-back-perl-2.4.44-18.1 openldap2-back-perl-debuginfo-2.4.44-18.1 openldap2-back-sock-2.4.44-18.1 openldap2-back-sock-debuginfo-2.4.44-18.1 openldap2-back-sql-2.4.44-18.1 openldap2-back-sql-debuginfo-2.4.44-18.1 openldap2-client-2.4.44-18.1 openldap2-client-debuginfo-2.4.44-18.1 openldap2-contrib-2.4.44-18.1 openldap2-contrib-debuginfo-2.4.44-18.1 openldap2-debuginfo-2.4.44-18.1 openldap2-debugsource-2.4.44-18.1 openldap2-devel-2.4.44-18.1 openldap2-devel-static-2.4.44-18.1 openldap2-ppolicy-check-password-1.2-18.1 openldap2-ppolicy-check-password-debuginfo-1.2-18.1 - openSUSE Leap 42.3 (x86_64): libldap-2_4-2-32bit-2.4.44-18.1 libldap-2_4-2-debuginfo-32bit-2.4.44-18.1 openldap2-devel-32bit-2.4.44-18.1 - openSUSE Leap 42.3 (noarch): libldap-data-2.4.44-18.1 openldap2-doc-2.4.44-18.1 References: https://www.suse.com/security/cve/CVE-2017-9287.html https://bugzilla.suse.com/1009470 https://bugzilla.suse.com/1031702 https://bugzilla.suse.com/1037396 https://bugzilla.suse.com/1041764

1 0

openSUSE-SU-2017:2180-1: moderate: Security update for libheimdal
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2180-1 Rating: moderate References: #1048278 Cross-References: CVE-2017-11103 CVE-2017-6594 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libheimdal fixes the following issues: - Fix CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation. This is a critical vulnerability. In _krb5_extract_ticket() the KDC-REP service name must be obtained from encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unecrypted version provides an opportunity for successful server impersonation and other attacks. Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams. See https://www.orpheus-lyre.info/ for more details. (bsc#1048278) - Fix CVE-2017-6594: transit path validation inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With the bug some incomplete [capaths] worked, that should not have. These may now break authentication in some cross-realm configurations. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-937=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-937=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libheimdal-7.4.0-3.1 libheimdal-debuginfo-7.4.0-3.1 libheimdal-debugsource-7.4.0-3.1 libheimdal-devel-7.4.0-3.1 - openSUSE Leap 42.2 (i586 x86_64): libheimdal-7.4.0-2.3.1 libheimdal-debuginfo-7.4.0-2.3.1 libheimdal-debugsource-7.4.0-2.3.1 libheimdal-devel-7.4.0-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-11103.html https://www.suse.com/security/cve/CVE-2017-6594.html https://bugzilla.suse.com/1048278

1 0

openSUSE-SU-2017:2179-1: moderate: Security update for nodejs4, nodejs6
by opensuse-security＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Security Update: Security update for nodejs4, nodejs6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2179-1 Rating: moderate References: #1041282 #1041283 #1044946 #1048299 Cross-References: CVE-2017-1000381 CVE-2017-11499 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for nodejs4 and nodejs6 fixes the following issues: Security issues fixed: - CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. (bsc#1044946) - CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299) Non-security fixes: - GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282) - New upstream LTS release 6.11.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6 .11.1 - New upstream LTS release 6.11.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6 .11.0 - New upstream LTS release 6.10.3 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6 .10.3 - New upstream LTS release 6.10.2 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6 .10.2 - New upstream LTS release 6.10.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6 .10.1 - New upstream LTS release 6.10.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6 .10.0 - New upstream LTS release 4.8.4 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4 .8.4 - New upstream LTS release 4.8.3 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4 .8.3 - New upstream LTS release 4.8.2 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4 .8.2 - New upstream LTS release 4.8.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4 .8.1 - New upstream LTS release 4.8.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4 .8.0 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-948=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-948=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs4-4.8.4-8.1 nodejs4-debuginfo-4.8.4-8.1 nodejs4-debugsource-4.8.4-8.1 nodejs4-devel-4.8.4-8.1 nodejs6-6.11.1-3.1 nodejs6-debuginfo-6.11.1-3.1 nodejs6-debugsource-6.11.1-3.1 nodejs6-devel-6.11.1-3.1 npm4-4.8.4-8.1 npm6-6.11.1-3.1 - openSUSE Leap 42.3 (noarch): nodejs-common-1.0-2.1 nodejs4-docs-4.8.4-8.1 nodejs6-docs-6.11.1-3.1 - openSUSE Leap 42.2 (i586 x86_64): nodejs4-4.8.4-5.6.1 nodejs4-debuginfo-4.8.4-5.6.1 nodejs4-debugsource-4.8.4-5.6.1 nodejs4-devel-4.8.4-5.6.1 npm4-4.8.4-5.6.1 - openSUSE Leap 42.2 (noarch): nodejs-common-1.0-2.1 nodejs4-docs-4.8.4-5.6.1 References: https://www.suse.com/security/cve/CVE-2017-1000381.html https://www.suse.com/security/cve/CVE-2017-11499.html https://bugzilla.suse.com/1041282 https://bugzilla.suse.com/1041283 https://bugzilla.suse.com/1044946 https://bugzilla.suse.com/1048299

1 0

openSUSE-RU-2017:2178-1: Recommended update for clamav-database
by maintenance＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2178-1 Rating: low References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh August 14th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-946=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201708140006-54.67.1 References:

1 0

openSUSE-SU-2017:2171-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 15 Aug '17

15 Aug '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2171-1 Rating: important References: #1015337 #1019151 #1023175 #1037404 #1037994 #1038078 #1038792 #1039153 #1043652 #1043805 #1047027 #1048912 #1049298 #1051399 #1051556 #1051689 #1051979 #1052049 #1052204 #1052223 #1052311 #1052325 #1052365 #1052442 #1052533 #1052709 #1052773 #1052794 #1052899 #1052925 #1053043 #1053531 Cross-References: CVE-2017-1000111 CVE-2017-1000112 CVE-2017-8831 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 29 fixes is now available. Description: The openSUSE Leap 42.3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000111: Fixed a race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365). - CVE-2017-1000112: Fixed a race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311). - CVE-2017-8831: The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability (bnc#1037994). The following non-security bugs were fixed: - acpi/nfit: Add support of NVDIMM memory error notification in ACPI 6.2 (bsc#1052325). - acpi/nfit: Issue Start ARS to retrieve existing records (bsc#1052325). - bcache: force trigger gc (bsc#1038078). - bcache: only recovery I/O error for writethrough mode (bsc#1043652). - block: do not allow updates through sysfs until registration completes (bsc#1047027). - config: disable CONFIG_RT_GROUP_SCHED (bsc#1052204). - drivers: hv: : As a bandaid, increase HV_UTIL_TIMEOUT from 30 to 60 seconds (bnc#1039153) - drivers: hv: Fix a typo (fate#320485). - drivers: hv: util: Make hv_poll_channel() a little more efficient (fate#320485). - drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page (fate#320485). - drivers: hv: vmbus: Fix error code returned by vmbus_post_msg() (fate#320485). - Fix kABI breakage with CONFIG_RT_GROUP_SCHED=n (bsc#1052204). - hv_netvsc: change netvsc device default duplex to FULL (fate#320485). - hv_netvsc: Fix the carrier state error when data path is off (fate#320485). - hv_netvsc: Remove unnecessary var link_state from struct netvsc_device_info (fate#320485). - hyperv: fix warning about missing prototype (fate#320485). - hyperv: netvsc: Neaten netvsc_send_pkt by using a temporary (fate#320485). - hyperv: remove unnecessary return variable (fate#320485). - i40e/i40evf: Fix use after free in Rx cleanup path (bsc#1051689). - IB/hfi1: Wait for QSFP modules to initialize (bsc#1019151). - ibmvnic: Check for transport event on driver resume (bsc#1051556, bsc#1052709). - ibmvnic: Initialize SCRQ's during login renegotiation (bsc#1052223). - ibmvnic: Report rx buffer return codes as netdev_dbg (bsc#1052794). - iommu/amd: Enable ga_log_intr when enabling guest_mode (bsc1052533). - iommu/amd: Fix schedule-while-atomic BUG in initialization code (bsc1052533). - KABI protect struct acpi_nfit_desc (bsc#1052325). - kabi/severities: add drivers/scsi/hisi_sas to kabi severities - libnvdimm: fix badblock range handling of ARS range (bsc#1023175). - libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify (bsc#1023175). - net: add netdev_lockdep_set_classes() helper (fate#320485). - net: hyperv: use new api ethtool_{get|set}_link_ksettings (fate#320485). - net/mlx4_core: Fixes missing capability bit in flags2 capability dump (bsc#1015337). - net/mlx4_core: Fix namespace misalignment in QinQ VST support commit (bsc#1015337). - net/mlx4_core: Fix sl_to_vl_change bit offset in flags2 dump (bsc#1015337). - netsvc: Remove upstream commit e14b4db7a567 netvsc: fix race during initialization will be replaced by following changes - netsvc: Revert "netvsc: optimize calculation of number of slots" (fate#320485). - netvsc: add comments about callback's and NAPI (fate#320485). - netvsc: Add #include's for csum_* function declarations (fate#320485). - netvsc: add rtnl annotations in rndis (fate#320485). - netvsc: add some rtnl_dereference annotations (fate#320485). - netvsc: avoid race with callback (fate#320485). - netvsc: change logic for change mtu and set_queues (fate#320485). - netvsc: change max channel calculation (fate#320485). - netvsc: change order of steps in setting queues (fate#320485). - netvsc: Deal with rescinded channels correctly (fate#320485). - netvsc: do not access netdev->num_rx_queues directly (fate#320485). - netvsc: do not overload variable in same function (fate#320485). - netvsc: do not print pointer value in error message (fate#320485). - netvsc: eliminate unnecessary skb == NULL checks (fate#320485). - netvsc: enable GRO (fate#320485). - netvsc: Fix a bug in sub-channel handling (fate#320485). - netvsc: fix and cleanup rndis_filter_set_packet_filter (fate#320485). - netvsc: fix calculation of available send sections (fate#320485). - netvsc: fix dereference before null check errors (fate#320485). - netvsc: fix error unwind on device setup failure (fate#320485). - netvsc: fix hang on netvsc module removal (fate#320485). - netvsc: fix NAPI performance regression (fate#320485). - netvsc: fix net poll mode (fate#320485). - netvsc: fix netvsc_set_channels (fate#320485). - netvsc: fix ptr_ret.cocci warnings (fate#320485). - netvsc: fix rcu dereference warning from ethtool (fate#320485). - netvsc: fix RCU warning in get_stats (fate#320485). - netvsc: fix return value for set_channels (fate#320485). - netvsc: fix rtnl deadlock on unregister of vf (fate#320485, bsc#1052442). - netvsc: fix use after free on module removal (fate#320485). - netvsc: fix warnings reported by lockdep (fate#320485). - netvsc: fold in get_outbound_net_device (fate#320485). - netvsc: force link update after MTU change (fate#320485). - netvsc: handle offline mtu and channel change (fate#320485). - netvsc: implement NAPI (fate#320485). - netvsc: include rtnetlink.h (fate#320485). - netvsc: Initialize all channel related state prior to opening the channel (fate#320485). - netvsc: make sure and unregister datapath (fate#320485, bsc#1052899). - netvsc: make sure napi enabled before vmbus_open (fate#320485). - netvsc: mark error cases as unlikely (fate#320485). - netvsc: move filter setting to rndis_device (fate#320485). - netvsc: need napi scheduled during removal (fate#320485). - netvsc: need rcu_derefence when accessing internal device info (fate#320485). - netvsc: optimize calculation of number of slots (fate#320485). - netvsc: optimize receive completions (fate#320485). - netvsc: pass net_device to netvsc_init_buf and netvsc_connect_vsp (fate#320485). - netvsc: prefetch the first incoming ring element (fate#320485). - netvsc: Properly initialize the return value (fate#320485). - netvsc: remove bogus rtnl_unlock (fate#320485). - netvsc: remove no longer used max_num_rss queues (fate#320485). - netvsc: Remove redundant use of ipv6_hdr() (fate#320485). - netvsc: remove unnecessary indirection of page_buffer (fate#320485). - netvsc: remove unnecessary lock on shutdown (fate#320485). - netvsc: remove unused #define (fate#320485). - netvsc: replace netdev_alloc_skb_ip_align with napi_alloc_skb (fate#320485). - netvsc: save pointer to parent netvsc_device in channel table (fate#320485). - netvsc: signal host if receive ring is emptied (fate#320485). - netvsc: transparent VF management (fate#320485, bsc#1051979). - netvsc: use ERR_PTR to avoid dereference issues (fate#320485). - netvsc: use hv_get_bytes_to_read (fate#320485). - netvsc: use napi_consume_skb (fate#320485). - netvsc: use RCU to protect inner device structure (fate#320485). - netvsc: uses RCU instead of removal flag (fate#320485). - netvsc: use typed pointer for internal state (fate#320485). - nvme: fabrics commands should use the fctype field for data direction (bsc#1043805). - powerpc/perf: Fix SDAR_MODE value for continous sampling on Power9 (bsc#1053043 (git-fixes)). - powerpc/tm: Fix saving of TM SPRs in core dump (fate#318470, git-fixes 08e1c01d6aed). - qeth: fix L3 next-hop im xmit qeth hdr (bnc#1052773, LTC#157374). - rdma/bnxt_re: checking for NULL instead of IS_ERR() (bsc#1052925). - scsi: aacraid: fix PCI error recovery path (bsc#1048912). - scsi_devinfo: fixup string compare (bsc#1037404). - scsi_dh_alua: suppress errors from unsupported devices (bsc#1038792). - scsi: hisi_sas: add pci_dev in hisi_hba struct (bsc#1049298). - scsi: hisi_sas: add v2 hw internal abort timeout workaround (bsc#1049298). - scsi: hisi_sas: controller reset for multi-bits ECC and AXI fatal errors (bsc#1049298). - scsi: hisi_sas: fix NULL deference when TMF timeouts (bsc#1049298). - scsi: hisi_sas: fix timeout check in hisi_sas_internal_task_abort() (bsc#1049298). - scsi: hisi_sas: optimise DMA slot memory (bsc#1049298). - scsi: hisi_sas: optimise the usage of hisi_hba.lock (bsc#1049298). - scsi: hisi_sas: relocate get_ata_protocol() (bsc#1049298). - scsi: hisi_sas: workaround a SoC SATA IO processing bug (bsc#1049298). - scsi: hisi_sas: workaround SoC about abort timeout bug (bsc#1049298). - scsi: hisi_sas: workaround STP link SoC bug (bsc#1049298). - scsi: lpfc: do not double count abort errors (bsc#1048912). - scsi: lpfc: fix linking against modular NVMe support (bsc#1048912). - scsi: qedi: Fix return code in qedi_ep_connect() (bsc#1048912). - scsi: storvsc: Prefer kcalloc over kzalloc with multiply (fate#320485). - scsi: storvsc: remove return at end of void function (fate#320485). - tools: hv: Add clean up for included files in Ubuntu net config (fate#320485). - tools: hv: Add clean up function for Ubuntu config (fate#320485). - tools: hv: properly handle long paths (fate#320485). - tools: hv: set allow-hotplug for VF on Ubuntu (fate#320485). - tools: hv: set hotplug for VF on Suse (fate#320485). - tools: hv: vss: Thaw the filesystem and continue if freeze call has timed out (fate#320485). - vfs: fix missing inode_get_dev sites (bsc#1052049). - vmbus: cleanup header file style (fate#320485). - vmbus: expose debug info for drivers (fate#320485). - vmbus: fix spelling errors (fate#320485). - vmbus: introduce in-place packet iterator (fate#320485). - vmbus: only reschedule tasklet if time limit exceeded (fate#320485). - vmbus: re-enable channel tasklet (fate#320485). - vmbus: remove unnecessary initialization (fate#320485). - vmbus: remove useless return's (fate#320485). - x86/dmi: Switch dmi_remap() from ioremap() to ioremap_cache() (bsc#1051399). - x86/hyperv: Check frequency MSRs presence according to the specification (fate#320485). - The package release number was increased to be higher than the Leap 42.2 package (boo#1053531). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-930=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): kernel-debug-4.4.79-19.1 kernel-debug-base-4.4.79-19.1 kernel-debug-base-debuginfo-4.4.79-19.1 kernel-debug-debuginfo-4.4.79-19.1 kernel-debug-debugsource-4.4.79-19.1 kernel-debug-devel-4.4.79-19.1 kernel-debug-devel-debuginfo-4.4.79-19.1 kernel-default-4.4.79-19.1 kernel-default-base-4.4.79-19.1 kernel-default-base-debuginfo-4.4.79-19.1 kernel-default-debuginfo-4.4.79-19.1 kernel-default-debugsource-4.4.79-19.1 kernel-default-devel-4.4.79-19.1 kernel-obs-build-4.4.79-19.1 kernel-obs-build-debugsource-4.4.79-19.1 kernel-obs-qa-4.4.79-19.1 kernel-syms-4.4.79-19.1 kernel-vanilla-4.4.79-19.1 kernel-vanilla-base-4.4.79-19.1 kernel-vanilla-base-debuginfo-4.4.79-19.1 kernel-vanilla-debuginfo-4.4.79-19.1 kernel-vanilla-debugsource-4.4.79-19.1 kernel-vanilla-devel-4.4.79-19.1 - openSUSE Leap 42.3 (noarch): kernel-devel-4.4.79-19.1 kernel-docs-4.4.79-19.2 kernel-docs-html-4.4.79-19.2 kernel-docs-pdf-4.4.79-19.2 kernel-macros-4.4.79-19.1 kernel-source-4.4.79-19.1 kernel-source-vanilla-4.4.79-19.1 References: https://www.suse.com/security/cve/CVE-2017-1000111.html https://www.suse.com/security/cve/CVE-2017-1000112.html https://www.suse.com/security/cve/CVE-2017-8831.html https://bugzilla.suse.com/1015337 https://bugzilla.suse.com/1019151 https://bugzilla.suse.com/1023175 https://bugzilla.suse.com/1037404 https://bugzilla.suse.com/1037994 https://bugzilla.suse.com/1038078 https://bugzilla.suse.com/1038792 https://bugzilla.suse.com/1039153 https://bugzilla.suse.com/1043652 https://bugzilla.suse.com/1043805 https://bugzilla.suse.com/1047027 https://bugzilla.suse.com/1048912 https://bugzilla.suse.com/1049298 https://bugzilla.suse.com/1051399 https://bugzilla.suse.com/1051556 https://bugzilla.suse.com/1051689 https://bugzilla.suse.com/1051979 https://bugzilla.suse.com/1052049 https://bugzilla.suse.com/1052204 https://bugzilla.suse.com/1052223 https://bugzilla.suse.com/1052311 https://bugzilla.suse.com/1052325 https://bugzilla.suse.com/1052365 https://bugzilla.suse.com/1052442 https://bugzilla.suse.com/1052533 https://bugzilla.suse.com/1052709 https://bugzilla.suse.com/1052773 https://bugzilla.suse.com/1052794 https://bugzilla.suse.com/1052899 https://bugzilla.suse.com/1052925 https://bugzilla.suse.com/1053043 https://bugzilla.suse.com/1053531

1 0

openSUSE-SU-2017:2169-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 15 Aug '17

15 Aug '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2169-1 Rating: important References: #1019151 #1023175 #1037404 #1037994 #1038078 #1038792 #1043652 #1047027 #1051399 #1051556 #1052049 #1052223 #1052311 #1052365 #1052533 #1052709 #1052773 #1052794 Cross-References: CVE-2017-1000111 CVE-2017-1000112 CVE-2017-8831 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 15 fixes is now available. Description: The openSUSE Leap 42.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000111: Fixed a race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365). - CVE-2017-1000112: Fixed a race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311). - CVE-2017-8831: The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability (bnc#1037994). The following non-security bugs were fixed: - IB/hfi1: Wait for QSFP modules to initialize (bsc#1019151). - bcache: force trigger gc (bsc#1038078). - bcache: only recovery I/O error for writethrough mode (bsc#1043652). - block: do not allow updates through sysfs until registration completes (bsc#1047027). - ibmvnic: Check for transport event on driver resume (bsc#1051556, bsc#1052709). - ibmvnic: Initialize SCRQ's during login renegotiation (bsc#1052223). - ibmvnic: Report rx buffer return codes as netdev_dbg (bsc#1052794). - iommu/amd: Fix schedule-while-atomic BUG in initialization code (bsc1052533). - libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify (bsc#1023175). - libnvdimm: fix badblock range handling of ARS range (bsc#1023175). - qeth: fix L3 next-hop im xmit qeth hdr (bnc#1052773, LTC#157374). - scsi_devinfo: fixup string compare (bsc#1037404). - scsi_dh_alua: suppress errors from unsupported devices (bsc#1038792). - vfs: fix missing inode_get_dev sites (bsc#1052049). - x86/dmi: Switch dmi_remap() from ioremap() to ioremap_cache() (bsc#1051399). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-929=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): kernel-debug-4.4.79-18.26.2 kernel-debug-base-4.4.79-18.26.2 kernel-debug-base-debuginfo-4.4.79-18.26.2 kernel-debug-debuginfo-4.4.79-18.26.2 kernel-debug-debugsource-4.4.79-18.26.2 kernel-debug-devel-4.4.79-18.26.2 kernel-debug-devel-debuginfo-4.4.79-18.26.2 kernel-default-4.4.79-18.26.2 kernel-default-base-4.4.79-18.26.2 kernel-default-base-debuginfo-4.4.79-18.26.2 kernel-default-debuginfo-4.4.79-18.26.2 kernel-default-debugsource-4.4.79-18.26.2 kernel-default-devel-4.4.79-18.26.2 kernel-obs-build-4.4.79-18.26.2 kernel-obs-build-debugsource-4.4.79-18.26.2 kernel-obs-qa-4.4.79-18.26.1 kernel-syms-4.4.79-18.26.1 kernel-vanilla-4.4.79-18.26.2 kernel-vanilla-base-4.4.79-18.26.2 kernel-vanilla-base-debuginfo-4.4.79-18.26.2 kernel-vanilla-debuginfo-4.4.79-18.26.2 kernel-vanilla-debugsource-4.4.79-18.26.2 kernel-vanilla-devel-4.4.79-18.26.2 - openSUSE Leap 42.2 (noarch): kernel-devel-4.4.79-18.26.1 kernel-docs-4.4.79-18.26.3 kernel-docs-html-4.4.79-18.26.3 kernel-docs-pdf-4.4.79-18.26.3 kernel-macros-4.4.79-18.26.1 kernel-source-4.4.79-18.26.1 kernel-source-vanilla-4.4.79-18.26.1 References: https://www.suse.com/security/cve/CVE-2017-1000111.html https://www.suse.com/security/cve/CVE-2017-1000112.html https://www.suse.com/security/cve/CVE-2017-8831.html https://bugzilla.suse.com/1019151 https://bugzilla.suse.com/1023175 https://bugzilla.suse.com/1037404 https://bugzilla.suse.com/1037994 https://bugzilla.suse.com/1038078 https://bugzilla.suse.com/1038792 https://bugzilla.suse.com/1043652 https://bugzilla.suse.com/1047027 https://bugzilla.suse.com/1051399 https://bugzilla.suse.com/1051556 https://bugzilla.suse.com/1052049 https://bugzilla.suse.com/1052223 https://bugzilla.suse.com/1052311 https://bugzilla.suse.com/1052365 https://bugzilla.suse.com/1052533 https://bugzilla.suse.com/1052709 https://bugzilla.suse.com/1052773 https://bugzilla.suse.com/1052794

1 0

openSUSE-RU-2017:2167-1: Recommended update for WindowMaker-applets
by maintenance＠opensuse.org 15 Aug '17

15 Aug '17

openSUSE Recommended Update: Recommended update for WindowMaker-applets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2167-1 Rating: low References: #1046193 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for WindowMaker-applets fixes the following issues: - Fix invalid XPM icon paths in /etc/wmmount. (boo#1046193) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-927=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-927=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): WindowMaker-applets-1.0.1-7.1 WindowMaker-applets-debuginfo-1.0.1-7.1 WindowMaker-applets-debugsource-1.0.1-7.1 - openSUSE Leap 42.2 (x86_64): WindowMaker-applets-1.0.1-4.3.1 WindowMaker-applets-debuginfo-1.0.1-4.3.1 WindowMaker-applets-debugsource-1.0.1-4.3.1 References: https://bugzilla.suse.com/1046193

1 0