August 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:2154-1: moderate: Recommended update for cyrus-sasl
by maintenance＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Recommended Update: Recommended update for cyrus-sasl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2154-1 Rating: moderate References: #1044840 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cyrus-sasl provides the following fixes: - Silence "GSSAPI client step 1" debug log message (bsc#1044840) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-913=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): cyrus-sasl-2.1.26-14.1 cyrus-sasl-crammd5-2.1.26-14.1 cyrus-sasl-crammd5-debuginfo-2.1.26-14.1 cyrus-sasl-debuginfo-2.1.26-14.1 cyrus-sasl-debugsource-2.1.26-14.1 cyrus-sasl-devel-2.1.26-14.1 cyrus-sasl-digestmd5-2.1.26-14.1 cyrus-sasl-digestmd5-debuginfo-2.1.26-14.1 cyrus-sasl-gs2-2.1.26-14.1 cyrus-sasl-gs2-debuginfo-2.1.26-14.1 cyrus-sasl-gssapi-2.1.26-14.1 cyrus-sasl-gssapi-debuginfo-2.1.26-14.1 cyrus-sasl-ldap-auxprop-2.1.26-14.1 cyrus-sasl-ldap-auxprop-debuginfo-2.1.26-14.1 cyrus-sasl-ntlm-2.1.26-14.1 cyrus-sasl-ntlm-debuginfo-2.1.26-14.1 cyrus-sasl-otp-2.1.26-14.1 cyrus-sasl-otp-debuginfo-2.1.26-14.1 cyrus-sasl-plain-2.1.26-14.1 cyrus-sasl-plain-debuginfo-2.1.26-14.1 cyrus-sasl-saslauthd-2.1.26-14.1 cyrus-sasl-saslauthd-debuginfo-2.1.26-14.1 cyrus-sasl-saslauthd-debugsource-2.1.26-14.1 cyrus-sasl-scram-2.1.26-14.1 cyrus-sasl-scram-debuginfo-2.1.26-14.1 cyrus-sasl-sqlauxprop-2.1.26-14.1 cyrus-sasl-sqlauxprop-debuginfo-2.1.26-14.1 libsasl2-3-2.1.26-14.1 libsasl2-3-debuginfo-2.1.26-14.1 - openSUSE Leap 42.3 (x86_64): cyrus-sasl-32bit-2.1.26-14.1 cyrus-sasl-crammd5-32bit-2.1.26-14.1 cyrus-sasl-crammd5-debuginfo-32bit-2.1.26-14.1 cyrus-sasl-debuginfo-32bit-2.1.26-14.1 cyrus-sasl-devel-32bit-2.1.26-14.1 cyrus-sasl-digestmd5-32bit-2.1.26-14.1 cyrus-sasl-digestmd5-debuginfo-32bit-2.1.26-14.1 cyrus-sasl-gssapi-32bit-2.1.26-14.1 cyrus-sasl-gssapi-debuginfo-32bit-2.1.26-14.1 cyrus-sasl-ldap-auxprop-32bit-2.1.26-14.1 cyrus-sasl-ldap-auxprop-debuginfo-32bit-2.1.26-14.1 cyrus-sasl-otp-32bit-2.1.26-14.1 cyrus-sasl-otp-debuginfo-32bit-2.1.26-14.1 cyrus-sasl-plain-32bit-2.1.26-14.1 cyrus-sasl-plain-debuginfo-32bit-2.1.26-14.1 cyrus-sasl-sqlauxprop-32bit-2.1.26-14.1 cyrus-sasl-sqlauxprop-debuginfo-32bit-2.1.26-14.1 libsasl2-3-32bit-2.1.26-14.1 libsasl2-3-debuginfo-32bit-2.1.26-14.1 References: https://bugzilla.suse.com/1044840

1 0

openSUSE-SU-2017:2153-1: important: Security update for libsoup
by opensuse-security＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Security Update: Security update for libsoup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2153-1 Rating: important References: #1052916 Cross-References: CVE-2017-2885 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libsoup fixes the following issues: - A bug in the HTTP Chunked Encoding code has been fixed that could have been exploited by attackers to cause a stack-based buffer overflow in client or server code running libsoup (bsc#1052916, CVE-2017-2885). This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-914=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-914=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libsoup-2_4-1-2.54.1-5.1 libsoup-2_4-1-debuginfo-2.54.1-5.1 libsoup-debugsource-2.54.1-5.1 libsoup-devel-2.54.1-5.1 typelib-1_0-Soup-2_4-2.54.1-5.1 - openSUSE Leap 42.3 (noarch): libsoup-lang-2.54.1-5.1 - openSUSE Leap 42.3 (x86_64): libsoup-2_4-1-32bit-2.54.1-5.1 libsoup-2_4-1-debuginfo-32bit-2.54.1-5.1 libsoup-devel-32bit-2.54.1-5.1 - openSUSE Leap 42.2 (i586 x86_64): libsoup-2_4-1-2.54.1-2.3.1 libsoup-2_4-1-debuginfo-2.54.1-2.3.1 libsoup-debugsource-2.54.1-2.3.1 libsoup-devel-2.54.1-2.3.1 typelib-1_0-Soup-2_4-2.54.1-2.3.1 - openSUSE Leap 42.2 (x86_64): libsoup-2_4-1-32bit-2.54.1-2.3.1 libsoup-2_4-1-debuginfo-32bit-2.54.1-2.3.1 libsoup-devel-32bit-2.54.1-2.3.1 - openSUSE Leap 42.2 (noarch): libsoup-lang-2.54.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-2885.html https://bugzilla.suse.com/1052916

1 0

openSUSE-RU-2017:2152-1: Recommended update for hawk2
by maintenance＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Recommended Update: Recommended update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2152-1 Rating: low References: #1010831 #1046820 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for hawk2 provides the following fixes: - Display times as UTC as consistently as possible in reports (bsc#1010831) - When generating SSL certificates, make sure the commonName is not too long, fixing it when necessary (bsc#1046820) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-916=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (x86_64): hawk2-2.0.0+git.1500187990.2e88c10c-9.3.1 hawk2-debuginfo-2.0.0+git.1500187990.2e88c10c-9.3.1 hawk2-debugsource-2.0.0+git.1500187990.2e88c10c-9.3.1 References: https://bugzilla.suse.com/1010831 https://bugzilla.suse.com/1046820

1 0

openSUSE-SU-2017:2151-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2151-1 Rating: important References: #1052829 Cross-References: CVE-2017-7753 CVE-2017-7779 CVE-2017-7782 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7798 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7804 CVE-2017-7807 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update to Mozilla Firefox 52.3esr fixes a number of security issues. The following vulnerabilities were advised upstream under MFSA 2017-19 (boo#1052829): - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with marquee during window resizing - CVE-2017-7784: Use-after-free with image observers - CVE-2017-7802: Use-after-free resizing image elements - CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM - CVE-2017-7786: Buffer overflow while painting non-displayable SVG - CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements# - CVE-2017-7787: Same-origin policy bypass with iframes through page reloads - CVE-2017-7807: Domain hijacking through AppCache fallback - CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID - CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher - CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts - CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections - CVE-2017-7803: CSP containing 'sandbox' improperly applied - CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-921=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-921=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): MozillaFirefox-52.3.0-60.1 MozillaFirefox-branding-upstream-52.3.0-60.1 MozillaFirefox-buildsymbols-52.3.0-60.1 MozillaFirefox-debuginfo-52.3.0-60.1 MozillaFirefox-debugsource-52.3.0-60.1 MozillaFirefox-devel-52.3.0-60.1 MozillaFirefox-translations-common-52.3.0-60.1 MozillaFirefox-translations-other-52.3.0-60.1 - openSUSE Leap 42.2 (x86_64): MozillaFirefox-52.3.0-57.15.1 MozillaFirefox-branding-upstream-52.3.0-57.15.1 MozillaFirefox-buildsymbols-52.3.0-57.15.1 MozillaFirefox-debuginfo-52.3.0-57.15.1 MozillaFirefox-debugsource-52.3.0-57.15.1 MozillaFirefox-devel-52.3.0-57.15.1 MozillaFirefox-translations-common-52.3.0-57.15.1 MozillaFirefox-translations-other-52.3.0-57.15.1 References: https://www.suse.com/security/cve/CVE-2017-7753.html https://www.suse.com/security/cve/CVE-2017-7779.html https://www.suse.com/security/cve/CVE-2017-7782.html https://www.suse.com/security/cve/CVE-2017-7784.html https://www.suse.com/security/cve/CVE-2017-7785.html https://www.suse.com/security/cve/CVE-2017-7786.html https://www.suse.com/security/cve/CVE-2017-7787.html https://www.suse.com/security/cve/CVE-2017-7791.html https://www.suse.com/security/cve/CVE-2017-7792.html https://www.suse.com/security/cve/CVE-2017-7798.html https://www.suse.com/security/cve/CVE-2017-7800.html https://www.suse.com/security/cve/CVE-2017-7801.html https://www.suse.com/security/cve/CVE-2017-7802.html https://www.suse.com/security/cve/CVE-2017-7803.html https://www.suse.com/security/cve/CVE-2017-7804.html https://www.suse.com/security/cve/CVE-2017-7807.html https://bugzilla.suse.com/1052829

1 0

openSUSE-SU-2017:2149-1: Security update for librsvg
by opensuse-security＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Security Update: Security update for librsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2149-1 Rating: low References: #1049607 Cross-References: CVE-2017-11464 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update librsvg to version 2.40.18 fixes the following issues: Security issue fixed: - CVE-2017-11464: A SIGFPE is raised in the function box_blur_line of rsvg-filter.c. (bsc#1049607) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-915=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-915=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.40.18-12.1 gdk-pixbuf-loader-rsvg-debuginfo-2.40.18-12.1 librsvg-2-2-2.40.18-12.1 librsvg-2-2-debuginfo-2.40.18-12.1 librsvg-debugsource-2.40.18-12.1 librsvg-devel-2.40.18-12.1 rsvg-view-2.40.18-12.1 rsvg-view-debuginfo-2.40.18-12.1 typelib-1_0-Rsvg-2_0-2.40.18-12.1 - openSUSE Leap 42.3 (noarch): rsvg-thumbnailer-2.40.18-12.1 - openSUSE Leap 42.3 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.40.18-12.1 gdk-pixbuf-loader-rsvg-debuginfo-32bit-2.40.18-12.1 librsvg-2-2-32bit-2.40.18-12.1 librsvg-2-2-debuginfo-32bit-2.40.18-12.1 - openSUSE Leap 42.2 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.40.18-9.3.1 gdk-pixbuf-loader-rsvg-debuginfo-2.40.18-9.3.1 librsvg-2-2-2.40.18-9.3.1 librsvg-2-2-debuginfo-2.40.18-9.3.1 librsvg-debugsource-2.40.18-9.3.1 librsvg-devel-2.40.18-9.3.1 rsvg-view-2.40.18-9.3.1 rsvg-view-debuginfo-2.40.18-9.3.1 typelib-1_0-Rsvg-2_0-2.40.18-9.3.1 - openSUSE Leap 42.2 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.40.18-9.3.1 gdk-pixbuf-loader-rsvg-debuginfo-32bit-2.40.18-9.3.1 librsvg-2-2-32bit-2.40.18-9.3.1 librsvg-2-2-debuginfo-32bit-2.40.18-9.3.1 - openSUSE Leap 42.2 (noarch): rsvg-thumbnailer-2.40.18-9.3.1 References: https://www.suse.com/security/cve/CVE-2017-11464.html https://bugzilla.suse.com/1049607

1 0

openSUSE-RU-2017:2148-1: Recommended update for autoyast2
by maintenance＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Recommended Update: Recommended update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2148-1 Rating: low References: #1011489 #1012328 #1014859 #1014861 #1046738 #1047809 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for autoyast2 provides the following fixes: - Fix two crashes while writing settings to the system. (bnc#1047809, bnc#1046738) - If Btrfs subvolumes are not specified, the default set is created. (bsc#1012328) - Fix building on s390x. (bsc#1011489) - Improve the product selection for updates. (bnc#1014861) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-918=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): autoyast2-3.1.160-5.3.1 autoyast2-installation-3.1.160-5.3.1 References: https://bugzilla.suse.com/1011489 https://bugzilla.suse.com/1012328 https://bugzilla.suse.com/1014859 https://bugzilla.suse.com/1014861 https://bugzilla.suse.com/1046738 https://bugzilla.suse.com/1047809

1 0

openSUSE-RU-2017:2139-1: Recommended update for python-uritemplate
by maintenance＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Recommended Update: Recommended update for python-uritemplate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2139-1 Rating: low References: #1002895 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update python-uritemplate 3.0.0 with many fixes and improvements. This package is a dependency for an upcoming update for google-cloud-sdk. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-904=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-904=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-uritemplate-3.0.0-10.1 - openSUSE Leap 42.2 (noarch): python-uritemplate-3.0.0-7.3.1 References: https://bugzilla.suse.com/1002895

1 0

openSUSE-OU-2017:2138-1: Optional update for python-httpretty
by maintenance＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Optional Update: Optional update for python-httpretty ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2138-1 Rating: low References: #1002895 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: python-httpretty did not ship the license file. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-906=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-906=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-httpretty-0.8.8-7.1 - openSUSE Leap 42.2 (noarch): python-httpretty-0.8.8-4.3.1 References: https://bugzilla.suse.com/1002895

1 0

openSUSE-OU-2017:2137-1: Initial release of python-google-apitools
by maintenance＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Optional Update: Initial release of python-google-apitools ______________________________________________________________________________ Announcement ID: openSUSE-OU-2017:2137-1 Rating: low References: #1002895 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: google-apitools is a collection of utilities to make it easier to build client-side tools, especially those that talk to Google APIs. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-909=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-909=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-google-apitools-0.5.6-2.1 - openSUSE Leap 42.2 (noarch): python-google-apitools-0.5.6-2.1 References: https://bugzilla.suse.com/1002895

1 0

openSUSE-RU-2017:2136-1: Recommended update for python-oauth2client
by maintenance＠opensuse.org 11 Aug '17

11 Aug '17

openSUSE Recommended Update: Recommended update for python-oauth2client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2136-1 Rating: low References: #1002895 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides python-oauth2client version 3.0.0, which brings many fixes and enhancements: - Move GCE metadata interface to a separate module. - Populate scopes and token_expiry for GCE credentials. - Fix Python 3.5 compatibility. - Add oauth2client.contrib.sqlalchemy, a SQLAlchemy-based credential store. - Improve error when an invalid client secret is provided. - Add oauth2client.contrib.multiprocess_storage. - Pull httplib2 usage into a separate transport module. - Fix application default credentials resolution order. - Add configurable timeout for GCE metadata server check. - Add warnings when using deprecated approval_prompt='force'. - Add deprecation warning to oauth2client.contrib.multistore_file. - Add support to override token_uri and revoke_uri in oauth2client.service_account.ServiceAccountCredentials. - Add basic support for JWT access credentials. - Fix oauth2client.client.DeviceFlowInfo to use UTC instead of the system timezone when calculating code expiration. - Fix issue where flask_util.UserOAuth2.required would accept expired credentials. - Fix issue where flask_util would fill the session with Flow objects. - Remove 'oauth2client.util.dict_to_tuple_key()' from public interface. - Implement 'ServiceAccountCredentials.from_p12_keyfile_buffer()' to allow passing a file-like object in addition to the factory constructor that uses a filename directly. - Implement 'ServiceAccountCredentials.create_delegated()' to allow upgrading a credential to one that acts on behalf of a given subject. - Avoid OAuth2Credentials 'id_token' going out of sync after a token refresh. - Added 'to_json' and 'from_json' methods to all 'Credentials' classes. - Fall back to read-only credentials on EACCES errors. - Add access token refresh error class that includes HTTP status. - Fix incremental auth in flask_util. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-907=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-907=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-oauth2client-3.0.0-7.1 python-oauth2client-django-3.0.0-7.1 python-oauth2client-flask-3.0.0-7.1 python-oauth2client-gce-3.0.0-7.1 python-oauth2client-test-3.0.0-7.1 - openSUSE Leap 42.2 (noarch): python-oauth2client-3.0.0-2.5.1 python-oauth2client-django-3.0.0-2.5.1 python-oauth2client-flask-3.0.0-2.5.1 python-oauth2client-gce-3.0.0-2.5.1 python-oauth2client-test-3.0.0-2.5.1 References: https://bugzilla.suse.com/1002895

1 0