August 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:2222-1: Recommended update for k3b
by maintenance＠opensuse.org 21 Aug '17

21 Aug '17

openSUSE Recommended Update: Recommended update for k3b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2222-1 Rating: low References: #1050715 #1051338 #1051368 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for k3b fixes the following issues: - Fix for creating Video DVDs. (bnc#1051338) - k3b shows the system configuration problems dialog if disabled. (bnc#1051368) - k3b suggests to the user to install libburn on startup. The message is actually misleading as k3b would actually use cdrskin which is packaged separately in openSUSE. But let's stick to prefer the proven cdrecord for now, people can still install cdrskin if they'd prefer to use it. (bnc#1050715) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-959=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): k3b-17.04.2-4.1 k3b-debuginfo-17.04.2-4.1 k3b-debugsource-17.04.2-4.1 k3b-devel-17.04.2-4.1 - openSUSE Leap 42.3 (noarch): k3b-lang-17.04.2-4.1 References: https://bugzilla.suse.com/1050715 https://bugzilla.suse.com/1051338 https://bugzilla.suse.com/1051368

1 0

openSUSE-RU-2017:2218-1: moderate: Recommended update for fate
by maintenance＠opensuse.org 18 Aug '17

18 Aug '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2218-1 Rating: moderate References: #1049390 #1052391 #1052788 #1052799 #1053025 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for fate to version 1.6.0.3 fixes the following issues: - Standard approvers were not prepopulated in ECOs (boo#1049390) - Attachments were accepted, but not added / referenced (boo#1052788) - Crash when trying to approve an ECO (boo#1053025) - Engineering Manager could not be added (boo#1052391) - Priority could not be changed (boo#1052799) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-956=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-956=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): fate-1.6.0.3-29.1 fate-debuginfo-1.6.0.3-29.1 - openSUSE Leap 42.2 (x86_64): fate-1.6.0.3-23.12.1 fate-debuginfo-1.6.0.3-23.12.1 References: https://bugzilla.suse.com/1049390 https://bugzilla.suse.com/1052391 https://bugzilla.suse.com/1052788 https://bugzilla.suse.com/1052799 https://bugzilla.suse.com/1053025

1 0

openSUSE-RU-2017:2215-1: moderate: Recommended update for fate
by maintenance＠opensuse.org 18 Aug '17

18 Aug '17

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2215-1 Rating: moderate References: #1049390 #1052391 #1052788 #1052799 #1053025 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for fate to version 1.6.0.3 fixes the following issues: - Standard approvers were not prepopulated in ECOs (boo#1049390) - Attachments were accepted, but not added / referenced (boo#1052788) - Crash when trying to approve an ECO (boo#1053025) - Engineering Manager could not be added (boo#1052391) - Priority could not be changed (boo#1052799) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-956=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): fate-1.6.0.3-19.1 fate-debuginfo-1.6.0.3-19.1 References: https://bugzilla.suse.com/1049390 https://bugzilla.suse.com/1052391 https://bugzilla.suse.com/1052788 https://bugzilla.suse.com/1052799 https://bugzilla.suse.com/1053025

1 0

openSUSE-SU-2017:2209-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 18 Aug '17

18 Aug '17

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2209-1 Rating: important References: #1052829 Cross-References: CVE-2017-7753 CVE-2017-7779 CVE-2017-7782 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7798 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7804 CVE-2017-7807 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with marquee during window resizing - CVE-2017-7784: Use-after-free with image observers - CVE-2017-7802: Use-after-free resizing image elements - CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM - CVE-2017-7786: Buffer overflow while painting non-displayable SVG - CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements# - CVE-2017-7787: Same-origin policy bypass with iframes through page reloads - CVE-2017-7807: Domain hijacking through AppCache fallback - CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID - CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher - CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts - CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections - CVE-2017-7803: CSP containing 'sandbox' improperly applied - CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3 The following bugs were fixed: - Unwanted inline images shown in rogue SPAM messages - Deleting message from the POP3 server not working when maildir storage was used - Message disposition flag (replied / forwarded) lost when reply or forwarded message was stored as draft and draft was sent later - Inline images not scaled to fit when printing - Selected text from another message sometimes included in a reply - No authorisation prompt displayed when inserting image into email body although image URL requires authentication - Large attachments taking a long time to open under some circumstances Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-955=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-955=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): MozillaThunderbird-52.3.0-44.1 MozillaThunderbird-buildsymbols-52.3.0-44.1 MozillaThunderbird-debuginfo-52.3.0-44.1 MozillaThunderbird-debugsource-52.3.0-44.1 MozillaThunderbird-devel-52.3.0-44.1 MozillaThunderbird-translations-common-52.3.0-44.1 MozillaThunderbird-translations-other-52.3.0-44.1 - openSUSE Leap 42.2 (i586 x86_64): MozillaThunderbird-52.3.0-41.15.1 MozillaThunderbird-buildsymbols-52.3.0-41.15.1 MozillaThunderbird-debuginfo-52.3.0-41.15.1 MozillaThunderbird-debugsource-52.3.0-41.15.1 MozillaThunderbird-devel-52.3.0-41.15.1 MozillaThunderbird-translations-common-52.3.0-41.15.1 MozillaThunderbird-translations-other-52.3.0-41.15.1 References: https://www.suse.com/security/cve/CVE-2017-7753.html https://www.suse.com/security/cve/CVE-2017-7779.html https://www.suse.com/security/cve/CVE-2017-7782.html https://www.suse.com/security/cve/CVE-2017-7784.html https://www.suse.com/security/cve/CVE-2017-7785.html https://www.suse.com/security/cve/CVE-2017-7786.html https://www.suse.com/security/cve/CVE-2017-7787.html https://www.suse.com/security/cve/CVE-2017-7791.html https://www.suse.com/security/cve/CVE-2017-7792.html https://www.suse.com/security/cve/CVE-2017-7798.html https://www.suse.com/security/cve/CVE-2017-7800.html https://www.suse.com/security/cve/CVE-2017-7801.html https://www.suse.com/security/cve/CVE-2017-7802.html https://www.suse.com/security/cve/CVE-2017-7803.html https://www.suse.com/security/cve/CVE-2017-7804.html https://www.suse.com/security/cve/CVE-2017-7807.html https://bugzilla.suse.com/1052829

1 0

openSUSE-SU-2017:2208-1: moderate: Security update for libplist
by opensuse-security＠opensuse.org 18 Aug '17

18 Aug '17

openSUSE Security Update: Security update for libplist ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2208-1 Rating: moderate References: #1029638 #1029639 #1029706 #1029707 #1029751 Cross-References: CVE-2017-6435 CVE-2017-6436 CVE-2017-6437 CVE-2017-6438 CVE-2017-6439 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libplist fixes the following issues: Security issues fixed: - CVE-2017-6439: Heap-based buffer overflow in the parse_string_node function. (bsc#1029638) - CVE-2017-6438: Heap-based buffer overflow in the parse_unicode_node function. (bsc#1029706) - CVE-2017-6437: The base64encode function in base64.c allows local users to cause denial of service (out-of-bounds read) via a crafted plist file. (bsc#1029707) - CVE-2017-6436: Integer overflow in parse_string_node. (bsc#1029751) - CVE-2017-6435: Crafted plist file could lead to Heap-buffer overflow. (bsc#1029639) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-953=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-953=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libplist++-devel-1.12-11.1 libplist++3-1.12-11.1 libplist++3-debuginfo-1.12-11.1 libplist-debugsource-1.12-11.1 libplist-devel-1.12-11.1 libplist3-1.12-11.1 libplist3-debuginfo-1.12-11.1 plistutil-1.12-11.1 plistutil-debuginfo-1.12-11.1 python-plist-1.12-11.1 python-plist-debuginfo-1.12-11.1 - openSUSE Leap 42.3 (x86_64): libplist++3-32bit-1.12-11.1 libplist++3-debuginfo-32bit-1.12-11.1 libplist3-32bit-1.12-11.1 libplist3-debuginfo-32bit-1.12-11.1 - openSUSE Leap 42.2 (i586 x86_64): libplist++-devel-1.12-7.6.1 libplist++3-1.12-7.6.1 libplist++3-debuginfo-1.12-7.6.1 libplist-debugsource-1.12-7.6.1 libplist-devel-1.12-7.6.1 libplist3-1.12-7.6.1 libplist3-debuginfo-1.12-7.6.1 plistutil-1.12-7.6.1 plistutil-debuginfo-1.12-7.6.1 python-plist-1.12-7.6.1 python-plist-debuginfo-1.12-7.6.1 - openSUSE Leap 42.2 (x86_64): libplist++3-32bit-1.12-7.6.1 libplist++3-debuginfo-32bit-1.12-7.6.1 libplist3-32bit-1.12-7.6.1 libplist3-debuginfo-32bit-1.12-7.6.1 References: https://www.suse.com/security/cve/CVE-2017-6435.html https://www.suse.com/security/cve/CVE-2017-6436.html https://www.suse.com/security/cve/CVE-2017-6437.html https://www.suse.com/security/cve/CVE-2017-6438.html https://www.suse.com/security/cve/CVE-2017-6439.html https://bugzilla.suse.com/1029638 https://bugzilla.suse.com/1029639 https://bugzilla.suse.com/1029706 https://bugzilla.suse.com/1029707 https://bugzilla.suse.com/1029751

1 0

openSUSE-SU-2017:2207-1: moderate: Security update for shutter
by opensuse-security＠opensuse.org 18 Aug '17

18 Aug '17

openSUSE Security Update: Security update for shutter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2207-1 Rating: moderate References: #1017571 Cross-References: CVE-2016-10081 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shutter fixes one security issue: - CVE-2016-10081: Remote attackers could trick users into assisting them in executing arbitrary commands via a crafted image name that is mishandled during a "Run a plugin" action (boo#1017571) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-952=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-952=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): shutter-0.93.1-5.1 shutter-lang-0.93.1-5.1 - openSUSE Leap 42.2 (noarch): shutter-0.93.1-2.3.1 shutter-lang-0.93.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2016-10081.html https://bugzilla.suse.com/1017571

1 0

openSUSE-SU-2017:2205-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 18 Aug '17

18 Aug '17

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2205-1 Rating: moderate References: #1051643 #1051644 Cross-References: CVE-2017-1000100 CVE-2017-1000101 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2017-1000100: TFP sends more than buffer size and it could lead to a denial of service (bsc#1051644) - CVE-2017-1000101: URL globbing out of bounds read could lead to a denial of service (bsc#1051643) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-951=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-951=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): curl-7.37.0-20.1 curl-debuginfo-7.37.0-20.1 curl-debugsource-7.37.0-20.1 libcurl-devel-7.37.0-20.1 libcurl4-7.37.0-20.1 libcurl4-debuginfo-7.37.0-20.1 - openSUSE Leap 42.3 (x86_64): libcurl-devel-32bit-7.37.0-20.1 libcurl4-32bit-7.37.0-20.1 libcurl4-debuginfo-32bit-7.37.0-20.1 - openSUSE Leap 42.2 (i586 x86_64): curl-7.37.0-16.6.1 curl-debuginfo-7.37.0-16.6.1 curl-debugsource-7.37.0-16.6.1 libcurl-devel-7.37.0-16.6.1 libcurl4-7.37.0-16.6.1 libcurl4-debuginfo-7.37.0-16.6.1 - openSUSE Leap 42.2 (x86_64): libcurl-devel-32bit-7.37.0-16.6.1 libcurl4-32bit-7.37.0-16.6.1 libcurl4-debuginfo-32bit-7.37.0-16.6.1 References: https://www.suse.com/security/cve/CVE-2017-1000100.html https://www.suse.com/security/cve/CVE-2017-1000101.html https://bugzilla.suse.com/1051643 https://bugzilla.suse.com/1051644

1 0

openSUSE-RU-2017:2198-1: Recommended update for python3-requests
by maintenance＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Recommended Update: Recommended update for python3-requests ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2198-1 Rating: low References: #912903 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python3-requests fixes the following issues: - Prevent https connections from failing due to missing dependency on ca-certificates(-mozilla) (boo#912903) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-944=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-944=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python3-requests-2.7.0-11.1 - openSUSE Leap 42.2 (noarch): python3-requests-2.7.0-8.3.1 References: https://bugzilla.suse.com/912903

1 0

openSUSE-RU-2017:2197-1: Recommended update for messagelib
by maintenance＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Recommended Update: Recommended update for messagelib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2197-1 Rating: low References: #1052482 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for messagelib fixes the following issues: - Fix umlauts and other special characters when a mail is exported as html for print preview and printing via an external browser. (bnc#1052482) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-932=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): messagelib-17.04.2-3.1 messagelib-debuginfo-17.04.2-3.1 messagelib-debugsource-17.04.2-3.1 messagelib-devel-17.04.2-3.1 - openSUSE Leap 42.3 (noarch): messagelib-lang-17.04.2-3.1 References: https://bugzilla.suse.com/1052482

1 0

openSUSE-RU-2017:2196-1: Recommended update for messagelib
by maintenance＠opensuse.org 16 Aug '17

16 Aug '17

openSUSE Recommended Update: Recommended update for messagelib ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2196-1 Rating: low References: #1013838 #1052482 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for messagelib fixes the following issues: - Fix umlauts and other special characters when a mail is exported as html for print preview and printing via an external browser. (bnc#1052482) - Fix jumping to the next unread mail if the space key is pressed at the bottom of a mail. (bnc#1013838) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-933=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): messagelib-16.08.2-2.9.1 messagelib-debuginfo-16.08.2-2.9.1 messagelib-debugsource-16.08.2-2.9.1 messagelib-devel-16.08.2-2.9.1 References: https://bugzilla.suse.com/1013838 https://bugzilla.suse.com/1052482

1 0