January 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0066-1: important: Security update for ucode-intel
by opensuse-security＠opensuse.org 11 Jan '18

11 Jan '18

openSUSE Security Update: Security update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0066-1 Rating: important References: #1075262 Cross-References: CVE-2017-5715 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ucode-intel fixes the following issues: Update to Intel CPU Microcode version 20180108 (boo#1075262) - The pre-released microcode fixing some important security issues is now officially published (and included in the added tarball). New firmware updates since last version (20170707) are available for these Intel processors: - IVT C0 (06-3e-04:ed) 428->42a - SKL-U/Y D0 (06-4e-03:c0) ba->c2 - BDW-U/Y E/F (06-3d-04:c0) 25->28 - HSW-ULT Cx/Dx (06-45-01:72) 20->21 - Crystalwell Cx (06-46-01:32) 17->18 - BDW-H E/G (06-47-01:22) 17->1b - HSX-EX E0 (06-3f-04:80) 0f->10 - SKL-H/S R0 (06-5e-03:36) ba->c2 - HSW Cx/Dx (06-3c-03:32) 22->23 - HSX C0 (06-3f-02:6f) 3a->3b - BDX-DE V0/V1 (06-56-02:10) 0f->14 - BDX-DE V2 (06-56-03:10) 700000d->7000011 - KBL-U/Y H0 (06-8e-09:c0) 62->80 - KBL Y0 / CFL D0 (06-8e-0a:c0) 70->80 - KBL-H/S B0 (06-9e-09:2a) 5e->80 - CFL U0 (06-9e-0a:22) 70->80 - CFL B0 (06-9e-0b:02) 72->80 - SKX H0 (06-55-04:b7) 2000035->200003c - GLK B0 (06-7a-01:01) 1e->22 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-24=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-24=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ucode-intel-20180108-16.1 ucode-intel-blob-20180108-16.1 ucode-intel-debuginfo-20180108-16.1 ucode-intel-debugsource-20180108-16.1 - openSUSE Leap 42.2 (i586 x86_64): ucode-intel-20180108-7.12.1 ucode-intel-blob-20180108-7.12.1 ucode-intel-debuginfo-20180108-7.12.1 ucode-intel-debugsource-20180108-7.12.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1075262

1 0

openSUSE-OU-2018:0064-1: moderate: Optional update to add gnuhealth-client
by maintenance＠opensuse.org 11 Jan '18

11 Jan '18

openSUSE Optional Update: Optional update to add gnuhealth-client ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0064-1 Rating: moderate References: #1075227 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update makes adds gnuhealth-client to the distribution. The package contains a client for the GNU Health Hospital system. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-23=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): gnuhealth-client-3.2.5-2.1 References: https://bugzilla.suse.com/1075227

1 0

openSUSE-SU-2018:0063-1: moderate: Security update for clamav-database
by opensuse-security＠opensuse.org 11 Jan '18

11 Jan '18

openSUSE Security Update: Security update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0063-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for clamav-database refreshes the database. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-21=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201801080006-54.127.1 References:

1 0

openSUSE-RU-2018:0062-1: moderate: Recommended update for multipath-tools
by maintenance＠opensuse.org 11 Jan '18

11 Jan '18

openSUSE Recommended Update: Recommended update for multipath-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0062-1 Rating: moderate References: #1033541 #1037533 #1047180 #1053515 #1055635 #1055638 #1066189 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update for multipath-tools provides the following fixes: - Adjust kpartx.rules so that the link priority is not increased when DM_UDEV_LOW_PRIORITY_FLAG is set. (bsc#1047180) - Fix timeout caused by a deadlock when processing "add map" commands. (bsc#1053515) - Fix segmentation fault when attempting to merge empty feature set. (bsc#1055635) - Fix segmentation fault caused by orphan_path() freeing memory is hasn't allocated. (bsc#1055638) - Backport several kpartx fixes and enhancements. (bsc#1037533, bsc#1033541) - Fix a problem that was causing multipathd to die with SIGABRT if a device is removed. (bsc#1066189) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-22=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): kpartx-0.6.2+suse20170912.f76643c6ada3-2.7.1 kpartx-debuginfo-0.6.2+suse20170912.f76643c6ada3-2.7.1 multipath-tools-0.6.2+suse20170912.f76643c6ada3-2.7.1 multipath-tools-debuginfo-0.6.2+suse20170912.f76643c6ada3-2.7.1 multipath-tools-debugsource-0.6.2+suse20170912.f76643c6ada3-2.7.1 multipath-tools-devel-0.6.2+suse20170912.f76643c6ada3-2.7.1 References: https://bugzilla.suse.com/1033541 https://bugzilla.suse.com/1037533 https://bugzilla.suse.com/1047180 https://bugzilla.suse.com/1053515 https://bugzilla.suse.com/1055635 https://bugzilla.suse.com/1055638 https://bugzilla.suse.com/1066189

1 0

openSUSE-SU-2018:0060-1: moderate: Security update for diffoscope
by opensuse-security＠opensuse.org 10 Jan '18

10 Jan '18

openSUSE Security Update: Security update for diffoscope ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0060-1 Rating: moderate References: #1025086 Cross-References: CVE-2017-0359 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for diffoscope to version 85 fixes one issues. This security issue was fixed: - CVE-2017-0359: Prevent write to arbitrary locations (boo#1025086). For other changes please see the GIT log. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-19=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): diffoscope-85-3.1 References: https://www.suse.com/security/cve/CVE-2017-0359.html https://bugzilla.suse.com/1025086

1 0

openSUSE-SU-2018:0059-1: important: Security update for qemu
by opensuse-security＠opensuse.org 10 Jan '18

10 Jan '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0059-1 Rating: important References: #1068032 Cross-References: CVE-2017-5715 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for qemu fixes the following issues: This update for qemu fixes the following issues: A mitigation for a security flaw has been applied: - CVE-2017-5715: QEMU was updated to allow passing through new MSR and CPUID flags from the host VM to the CPU, to allow enabling/disabling branch prediction features in the Intel CPU. (bsc#1068032) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-20=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): qemu-2.6.2-31.18.1 qemu-arm-2.6.2-31.18.1 qemu-arm-debuginfo-2.6.2-31.18.1 qemu-block-curl-2.6.2-31.18.1 qemu-block-curl-debuginfo-2.6.2-31.18.1 qemu-block-dmg-2.6.2-31.18.1 qemu-block-dmg-debuginfo-2.6.2-31.18.1 qemu-block-iscsi-2.6.2-31.18.1 qemu-block-iscsi-debuginfo-2.6.2-31.18.1 qemu-block-ssh-2.6.2-31.18.1 qemu-block-ssh-debuginfo-2.6.2-31.18.1 qemu-debugsource-2.6.2-31.18.1 qemu-extra-2.6.2-31.18.1 qemu-extra-debuginfo-2.6.2-31.18.1 qemu-guest-agent-2.6.2-31.18.1 qemu-guest-agent-debuginfo-2.6.2-31.18.1 qemu-kvm-2.6.2-31.18.1 qemu-lang-2.6.2-31.18.1 qemu-linux-user-2.6.2-31.18.1 qemu-linux-user-debuginfo-2.6.2-31.18.1 qemu-linux-user-debugsource-2.6.2-31.18.1 qemu-ppc-2.6.2-31.18.1 qemu-ppc-debuginfo-2.6.2-31.18.1 qemu-s390-2.6.2-31.18.1 qemu-s390-debuginfo-2.6.2-31.18.1 qemu-testsuite-2.6.2-31.18.1 qemu-tools-2.6.2-31.18.1 qemu-tools-debuginfo-2.6.2-31.18.1 qemu-x86-2.6.2-31.18.1 qemu-x86-debuginfo-2.6.2-31.18.1 - openSUSE Leap 42.2 (x86_64): qemu-block-rbd-2.6.2-31.18.1 qemu-block-rbd-debuginfo-2.6.2-31.18.1 - openSUSE Leap 42.2 (noarch): qemu-ipxe-1.0.0-31.18.1 qemu-seabios-1.9.1-31.18.1 qemu-sgabios-8-31.18.1 qemu-vgabios-1.9.1-31.18.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1068032

1 0

openSUSE-SU-2018:0058-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 09 Jan '18

09 Jan '18

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0058-1 Rating: moderate References: #1074958 Cross-References: CVE-2018-5205 CVE-2018-5206 CVE-2018-5207 CVE-2018-5208 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for irssi to version 1.0.6 fixes several issues that may affect the stability of irssi: - CVE-2018-5205: Data access beyond the end of the string when using incomplete escape codes - CVE-2018-5206: NULL pointer dereference when the channel topic is set without specifying a sender - CVE-2018-5207: When using an incomplete variable argument, Irssi may access data beyond the end of the string - CVE-2018-5208: Heap buffer overflow when completing certain strings Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-18=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-18=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.0.6-21.1 irssi-debuginfo-1.0.6-21.1 irssi-debugsource-1.0.6-21.1 irssi-devel-1.0.6-21.1 - openSUSE Leap 42.2 (i586 x86_64): irssi-1.0.6-14.18.1 irssi-debuginfo-1.0.6-14.18.1 irssi-debugsource-1.0.6-14.18.1 irssi-devel-1.0.6-14.18.1 References: https://www.suse.com/security/cve/CVE-2018-5205.html https://www.suse.com/security/cve/CVE-2018-5206.html https://www.suse.com/security/cve/CVE-2018-5207.html https://www.suse.com/security/cve/CVE-2018-5208.html https://bugzilla.suse.com/1074958

1 0

openSUSE-SU-2018:0057-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 09 Jan '18

09 Jan '18

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0057-1 Rating: moderate References: #1074958 Cross-References: CVE-2018-5205 CVE-2018-5206 CVE-2018-5207 CVE-2018-5208 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for irssi to version 1.0.6 fixes several issues that may affect the stability of irssi: - CVE-2018-5205: Data access beyond the end of the string when using incomplete escape codes - CVE-2018-5206: NULL pointer dereference when the channel topic is set without specifying a sender - CVE-2018-5207: When using an incomplete variable argument, Irssi may access data beyond the end of the string - CVE-2018-5208: Heap buffer overflow when completing certain strings Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-18=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.0.6-36.1 irssi-debuginfo-1.0.6-36.1 irssi-debugsource-1.0.6-36.1 irssi-devel-1.0.6-36.1 References: https://www.suse.com/security/cve/CVE-2018-5205.html https://www.suse.com/security/cve/CVE-2018-5206.html https://www.suse.com/security/cve/CVE-2018-5207.html https://www.suse.com/security/cve/CVE-2018-5208.html https://bugzilla.suse.com/1074958

1 0

openSUSE-OU-2018:0049-1: moderate: Optional update to add pdns to the SUSE PackageHub
by maintenance＠opensuse.org 09 Jan '18

09 Jan '18

openSUSE Optional Update: Optional update to add pdns to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0049-1 Rating: moderate References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update makes PowerDNS available in the SUSE PackageHub. PowerDNS implements a authoritative (pnds) and recursing/non authoritative (pdns-recursor) nameserver. As a dependency, libsodium, a NaCl-based crypto library was added. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-16=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libsodium-debugsource-1.0.16-2.1 libsodium-devel-1.0.16-2.1 libsodium23-1.0.16-2.1 libsodium23-debuginfo-1.0.16-2.1 pdns-4.1.0-2.1 pdns-backend-godbc-4.1.0-2.1 pdns-backend-godbc-debuginfo-4.1.0-2.1 pdns-backend-ldap-4.1.0-2.1 pdns-backend-ldap-debuginfo-4.1.0-2.1 pdns-backend-lua-4.1.0-2.1 pdns-backend-lua-debuginfo-4.1.0-2.1 pdns-backend-mydns-4.1.0-2.1 pdns-backend-mydns-debuginfo-4.1.0-2.1 pdns-backend-mysql-4.1.0-2.1 pdns-backend-mysql-debuginfo-4.1.0-2.1 pdns-backend-postgresql-4.1.0-2.1 pdns-backend-postgresql-debuginfo-4.1.0-2.1 pdns-backend-remote-4.1.0-2.1 pdns-backend-remote-debuginfo-4.1.0-2.1 pdns-backend-sqlite3-4.1.0-2.1 pdns-backend-sqlite3-debuginfo-4.1.0-2.1 pdns-debuginfo-4.1.0-2.1 pdns-debugsource-4.1.0-2.1 pdns-recursor-4.1.0-2.1 pdns-recursor-debuginfo-4.1.0-2.1 pdns-recursor-debugsource-4.1.0-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): pdns-common-4.0-2.1 References:

1 0

openSUSE-OU-2018:0048-1: Optional update to add cunit, libpqxx to the SUSE PackageHub
by maintenance＠opensuse.org 09 Jan '18

09 Jan '18

openSUSE Optional Update: Optional update to add cunit, libpqxx to the SUSE PackageHub ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0048-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update adds cunit, libpqxx to the SUSE PackageHub. libpqxx is a client library for PostgeSQL. cunit provides basic unit testing functionality for C. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-17=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cunit-devel-2.1.3-2.1 cunit-doc-2.1.3-2.1 libcunit1-2.1.3-2.1 libpqxx-5_0-5.0.1-2.1 libpqxx-devel-5.0.1-2.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): libpqxx-doc-5.0.1-2.1 References:

1 0