September 2017 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2017:2577-1: moderate: Recommended update for openjpeg
by maintenance＠opensuse.org 27 Sep '17

27 Sep '17

openSUSE Recommended Update: Recommended update for openjpeg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2577-1 Rating: moderate References: #1029609 #1059440 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openjpeg fixes the following issue: - Programs linked with libopenjpeg1 would expose non-standard math behavior due to usage of -ffast-math in openjpeg (boo#1029609, boo#1059440) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1097=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libopenjpeg1-1.5.2-5.1 openjpeg-1.5.2-5.1 openjpeg-devel-1.5.2-5.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64_ilp32): libopenjpeg1-64bit-1.5.2-5.1 openjpeg-devel-64bit-1.5.2-5.1 References: https://bugzilla.suse.com/1029609 https://bugzilla.suse.com/1059440

1 0

openSUSE-SU-2017:2573-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 26 Sep '17

26 Sep '17

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2573-1 Rating: moderate References: #1059194 Cross-References: CVE-2017-0380 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for tor fixes the following issues: - CVE-2017-0380: hidden services with the SafeLogging option disabled could disclose the stack (boo#1059194) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1092=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1092=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): tor-0.3.0.11-3.1 tor-debuginfo-0.3.0.11-3.1 tor-debugsource-0.3.0.11-3.1 - openSUSE Leap 42.2 (i586 x86_64): tor-0.2.9.12-8.6.1 tor-debuginfo-0.2.9.12-8.6.1 tor-debugsource-0.2.9.12-8.6.1 References: https://www.suse.com/security/cve/CVE-2017-0380.html https://bugzilla.suse.com/1059194

1 0

openSUSE-SU-2017:2568-1: moderate: Recommended update for openjpeg
by opensuse-security＠opensuse.org 26 Sep '17

26 Sep '17

openSUSE Security Update: Recommended update for openjpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2568-1 Rating: moderate References: #1029609 #1059440 #999817 Cross-References: CVE-2016-7445 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for openjpeg fixes the following vulnerability: * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash (bsc#999817) The following bug was also fixed: - Programs linked with libopenjpeg1 would expose non-standard math behavior due to usage of -ffast-math in openjpeg (boo#1029609, boo#1059440)</description> Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1091=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libopenjpeg1-1.5.2-6.1 openjpeg-1.5.2-6.1 openjpeg-devel-1.5.2-6.1 References: https://www.suse.com/security/cve/CVE-2016-7445.html https://bugzilla.suse.com/1029609 https://bugzilla.suse.com/1059440 https://bugzilla.suse.com/999817

1 0

openSUSE-SU-2017:2567-1: important: Security update for openjpeg2
by opensuse-security＠opensuse.org 26 Sep '17

26 Sep '17

openSUSE Security Update: Security update for openjpeg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2567-1 Rating: important References: #1002414 #1007739 #1007740 #1007741 #1007742 #1007743 #1007744 #1007747 #1014543 #1014975 #979907 #997857 #999817 Cross-References: CVE-2015-8871 CVE-2016-7163 CVE-2016-7445 CVE-2016-8332 CVE-2016-9112 CVE-2016-9113 CVE-2016-9114 CVE-2016-9115 CVE-2016-9116 CVE-2016-9117 CVE-2016-9118 CVE-2016-9572 CVE-2016-9573 CVE-2016-9580 CVE-2016-9581 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for openjpeg2 fixes the following issues: * CVE-2016-9114: NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) could lead to crash [bsc#1007740] * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.c(jp2) [bsc#1007741] * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer overflow and infite loop [bsc#1014975] * CVE-2016-9117: NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 [bsc#1007743] * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c [bsc#1007744] * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523 [bsc#1007747] * CVE-2016-9116: NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) [bsc#1007742] * CVE-2016-9113: NULL point dereference in function imagetobmp of convertbmp.c could lead to crash [bsc#1007739] * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could lead to heap buffer overflow [bsc#1014543] * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to code execution [bsc#1002414] * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash [bsc#999817] * CVE 2016-7163: Integer Overflow could lead to remote code execution [bsc#997857] * CVE 2015-8871: Use-after-free in opj_j2k_write_mco function could lead to denial of service [bsc#979907] This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1090=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.1.0-5.1 libopenjp2-7-2.1.0-6.1 openjpeg2-2.1.0-5.1 openjpeg2-2.1.0-6.1 openjpeg2-devel-2.1.0-5.1 openjpeg2-devel-2.1.0-6.1 References: https://www.suse.com/security/cve/CVE-2015-8871.html https://www.suse.com/security/cve/CVE-2016-7163.html https://www.suse.com/security/cve/CVE-2016-7445.html https://www.suse.com/security/cve/CVE-2016-8332.html https://www.suse.com/security/cve/CVE-2016-9112.html https://www.suse.com/security/cve/CVE-2016-9113.html https://www.suse.com/security/cve/CVE-2016-9114.html https://www.suse.com/security/cve/CVE-2016-9115.html https://www.suse.com/security/cve/CVE-2016-9116.html https://www.suse.com/security/cve/CVE-2016-9117.html https://www.suse.com/security/cve/CVE-2016-9118.html https://www.suse.com/security/cve/CVE-2016-9572.html https://www.suse.com/security/cve/CVE-2016-9573.html https://www.suse.com/security/cve/CVE-2016-9580.html https://www.suse.com/security/cve/CVE-2016-9581.html https://bugzilla.suse.com/1002414 https://bugzilla.suse.com/1007739 https://bugzilla.suse.com/1007740 https://bugzilla.suse.com/1007741 https://bugzilla.suse.com/1007742 https://bugzilla.suse.com/1007743 https://bugzilla.suse.com/1007744 https://bugzilla.suse.com/1007747 https://bugzilla.suse.com/1014543 https://bugzilla.suse.com/1014975 https://bugzilla.suse.com/979907 https://bugzilla.suse.com/997857 https://bugzilla.suse.com/999817

1 0

openSUSE-RU-2017:2562-1: Recommended update for squidview
by maintenance＠opensuse.org 25 Sep '17

25 Sep '17

openSUSE Recommended Update: Recommended update for squidview ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2562-1 Rating: low References: #1057981 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for squidview fixes the following issues: - HOWTO link would be created incorrectly (boo#1057981) In addition squidview was updated to 0.86 with a number of upstream fixes and improvements: - add support for a number of squid result codes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1087=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1087=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): squidview-0.86-8.1 squidview-debuginfo-0.86-8.1 squidview-debugsource-0.86-8.1 - openSUSE Leap 42.2 (i586 x86_64): squidview-0.86-5.3.1 squidview-debuginfo-0.86-5.3.1 squidview-debugsource-0.86-5.3.1 References: https://bugzilla.suse.com/1057981

1 0

openSUSE-RU-2017:2561-1: moderate: Recommended update for plasma5-pk-updates
by maintenance＠opensuse.org 25 Sep '17

25 Sep '17

openSUSE Recommended Update: Recommended update for plasma5-pk-updates ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2561-1 Rating: moderate References: #951580 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for plasma5-pk-updates fixes the following issues: - The applet would not notify when an installed update required a reboot (boo#951580) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1088=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1088=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): plasma5-pk-updates-0.2-11.1 plasma5-pk-updates-debuginfo-0.2-11.1 plasma5-pk-updates-debugsource-0.2-11.1 - openSUSE Leap 42.3 (noarch): plasma5-pk-updates-lang-0.2-11.1 - openSUSE Leap 42.2 (x86_64): plasma5-pk-updates-0.2-8.3.1 plasma5-pk-updates-debuginfo-0.2-8.3.1 plasma5-pk-updates-debugsource-0.2-8.3.1 - openSUSE Leap 42.2 (noarch): plasma5-pk-updates-lang-0.2-8.3.1 References: https://bugzilla.suse.com/951580

1 0

openSUSE-RU-2017:2560-1: moderate: Recommended update for gnuhealth, trytond
by maintenance＠opensuse.org 25 Sep '17

25 Sep '17

openSUSE Recommended Update: Recommended update for gnuhealth, trytond ______________________________________________________________________________ Announcement ID: openSUSE-RU-2017:2560-1 Rating: moderate References: #1054032 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnuhealth, trytond fixes the following issues: Changes in gnuhealth: - version 3.2.3 Fix bug #52038: Field history is repeated in the tree view of the prescription line - Documentation adapted Changes in trytond: - package documentation updated Changes in trytond_company: - bugfix update to 4.2.1 Changes in trytond_currency: - bugfix update to 4.2.1 changes in trytond_purchase: - bugfix update to 4.2.2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1089=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): gnuhealth-3.2.3-24.1 trytond-4.2.6-18.1 trytond_company-4.2.1-3.1 trytond_currency-4.2.1-3.1 trytond_purchase-4.2.2-3.1 References: https://bugzilla.suse.com/1054032

1 0

openSUSE-SU-2017:2559-1: moderate: Security update for libraw
by opensuse-security＠opensuse.org 24 Sep '17

24 Sep '17

openSUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2559-1 Rating: moderate References: #1058467 Cross-References: CVE-2017-14348 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libraw fixes the following issues: - CVE-2017-14348: A specially crafted file could have been used to trigger a heap-based buffer overflow (boo#1058467) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1086=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1086=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libraw-debugsource-0.17.1-6.1 libraw-devel-0.17.1-6.1 libraw-devel-static-0.17.1-6.1 libraw-tools-0.17.1-6.1 libraw-tools-debuginfo-0.17.1-6.1 libraw15-0.17.1-6.1 libraw15-debuginfo-0.17.1-6.1 - openSUSE Leap 42.2 (i586 x86_64): libraw-debugsource-0.17.1-2.6.1 libraw-devel-0.17.1-2.6.1 libraw-devel-static-0.17.1-2.6.1 libraw-tools-0.17.1-2.6.1 libraw-tools-debuginfo-0.17.1-2.6.1 libraw15-0.17.1-2.6.1 libraw15-debuginfo-0.17.1-2.6.1 References: https://www.suse.com/security/cve/CVE-2017-14348.html https://bugzilla.suse.com/1058467

1 0

openSUSE-SU-2017:2558-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 23 Sep '17

23 Sep '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2558-1 Rating: moderate References: #1060019 Cross-References: CVE-2017-5121 CVE-2017-5122 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to Chromium 61.0.3163.100 fixes the following vulnerabilities: - CVE-2017-5121: Out-of-bounds access in V8 - CVE-2017-5122: Out-of-bounds access in V8 - Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1085=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-61.0.3163.100-32.1 chromedriver-debuginfo-61.0.3163.100-32.1 chromium-61.0.3163.100-32.1 chromium-debuginfo-61.0.3163.100-32.1 chromium-debugsource-61.0.3163.100-32.1 References: https://www.suse.com/security/cve/CVE-2017-5121.html https://www.suse.com/security/cve/CVE-2017-5122.html https://bugzilla.suse.com/1060019

1 0

openSUSE-SU-2017:2557-1: moderate: Security update for Chromium
by opensuse-security＠opensuse.org 23 Sep '17

23 Sep '17

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:2557-1 Rating: moderate References: #1060019 Cross-References: CVE-2017-5121 CVE-2017-5122 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to Chromium 61.0.3163.100 fixes the following vulnerabilities: - CVE-2017-5121: Out-of-bounds access in V8 - CVE-2017-5122: Out-of-bounds access in V8 - Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1085=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1085=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-61.0.3163.100-113.1 chromedriver-debuginfo-61.0.3163.100-113.1 chromium-61.0.3163.100-113.1 chromium-debuginfo-61.0.3163.100-113.1 chromium-debugsource-61.0.3163.100-113.1 - openSUSE Leap 42.2 (x86_64): chromedriver-61.0.3163.100-104.27.1 chromedriver-debuginfo-61.0.3163.100-104.27.1 chromium-61.0.3163.100-104.27.1 chromium-debuginfo-61.0.3163.100-104.27.1 chromium-debugsource-61.0.3163.100-104.27.1 References: https://www.suse.com/security/cve/CVE-2017-5121.html https://www.suse.com/security/cve/CVE-2017-5122.html https://bugzilla.suse.com/1060019

1 0