January 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0047-1: moderate: Security update for libvorbis
by opensuse-security＠opensuse.org 09 Jan '18

09 Jan '18

openSUSE Security Update: Security update for libvorbis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0047-1 Rating: moderate References: #1059809 #1059811 Cross-References: CVE-2017-14632 CVE-2017-14633 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libvorbis fixes the following issues: - CVE-2017-14633: out-of-bounds array read vulnerability exists in function mapping0_forward() could lead to remote denial of service (bsc#1059811) - CVE-2017-14632: Remote Code Execution upon freeing uninitialized memory in function vorbis_analysis_headerout(bsc#1059809) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-15=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-15=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libvorbis-debugsource-1.3.3-8.1 libvorbis-devel-1.3.3-8.1 libvorbis0-1.3.3-8.1 libvorbis0-debuginfo-1.3.3-8.1 libvorbisenc2-1.3.3-8.1 libvorbisenc2-debuginfo-1.3.3-8.1 libvorbisfile3-1.3.3-8.1 libvorbisfile3-debuginfo-1.3.3-8.1 - openSUSE Leap 42.3 (x86_64): libvorbis0-32bit-1.3.3-8.1 libvorbis0-debuginfo-32bit-1.3.3-8.1 libvorbisenc2-32bit-1.3.3-8.1 libvorbisenc2-debuginfo-32bit-1.3.3-8.1 libvorbisfile3-32bit-1.3.3-8.1 libvorbisfile3-debuginfo-32bit-1.3.3-8.1 - openSUSE Leap 42.3 (noarch): libvorbis-doc-1.3.3-8.1 - openSUSE Leap 42.2 (i586 x86_64): libvorbis-debugsource-1.3.3-5.3.1 libvorbis-devel-1.3.3-5.3.1 libvorbis0-1.3.3-5.3.1 libvorbis0-debuginfo-1.3.3-5.3.1 libvorbisenc2-1.3.3-5.3.1 libvorbisenc2-debuginfo-1.3.3-5.3.1 libvorbisfile3-1.3.3-5.3.1 libvorbisfile3-debuginfo-1.3.3-5.3.1 - openSUSE Leap 42.2 (noarch): libvorbis-doc-1.3.3-5.3.1 - openSUSE Leap 42.2 (x86_64): libvorbis0-32bit-1.3.3-5.3.1 libvorbis0-debuginfo-32bit-1.3.3-5.3.1 libvorbisenc2-32bit-1.3.3-5.3.1 libvorbisenc2-debuginfo-32bit-1.3.3-5.3.1 libvorbisfile3-32bit-1.3.3-5.3.1 libvorbisfile3-debuginfo-32bit-1.3.3-5.3.1 References: https://www.suse.com/security/cve/CVE-2017-14632.html https://www.suse.com/security/cve/CVE-2017-14633.html https://bugzilla.suse.com/1059809 https://bugzilla.suse.com/1059811

1 0

openSUSE-SU-2018:0044-1: moderate: Security update for gimp
by opensuse-security＠opensuse.org 09 Jan '18

09 Jan '18

openSUSE Security Update: Security update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0044-1 Rating: moderate References: #1050469 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for gimp fixes the following issues: - Don't build gimp with webkit1 support, as it is no longer maintained and has plenty of security bugs. This disables the GIMP's built-in help browser; it will use an external browser when configured this way. This works around a number of security vulnerabilities in Webkit1. This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-13=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-13=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): gimp-2.8.18-6.3 gimp-debuginfo-2.8.18-6.3 gimp-debugsource-2.8.18-6.3 gimp-devel-2.8.18-6.3 gimp-devel-debuginfo-2.8.18-6.3 gimp-plugin-aa-2.8.18-6.3 gimp-plugin-aa-debuginfo-2.8.18-6.3 gimp-plugins-python-2.8.18-6.3 gimp-plugins-python-debuginfo-2.8.18-6.3 libgimp-2_0-0-2.8.18-6.3 libgimp-2_0-0-debuginfo-2.8.18-6.3 libgimpui-2_0-0-2.8.18-6.3 libgimpui-2_0-0-debuginfo-2.8.18-6.3 - openSUSE Leap 42.3 (x86_64): libgimp-2_0-0-32bit-2.8.18-6.3 libgimp-2_0-0-debuginfo-32bit-2.8.18-6.3 libgimpui-2_0-0-32bit-2.8.18-6.3 libgimpui-2_0-0-debuginfo-32bit-2.8.18-6.3 - openSUSE Leap 42.3 (noarch): gimp-lang-2.8.18-6.3 - openSUSE Leap 42.2 (i586 x86_64): gimp-2.8.18-2.6.2 gimp-debuginfo-2.8.18-2.6.2 gimp-debugsource-2.8.18-2.6.2 gimp-devel-2.8.18-2.6.2 gimp-devel-debuginfo-2.8.18-2.6.2 gimp-plugin-aa-2.8.18-2.6.2 gimp-plugin-aa-debuginfo-2.8.18-2.6.2 gimp-plugins-python-2.8.18-2.6.2 gimp-plugins-python-debuginfo-2.8.18-2.6.2 libgimp-2_0-0-2.8.18-2.6.2 libgimp-2_0-0-debuginfo-2.8.18-2.6.2 libgimpui-2_0-0-2.8.18-2.6.2 libgimpui-2_0-0-debuginfo-2.8.18-2.6.2 - openSUSE Leap 42.2 (noarch): gimp-lang-2.8.18-2.6.2 - openSUSE Leap 42.2 (x86_64): libgimp-2_0-0-32bit-2.8.18-2.6.2 libgimp-2_0-0-debuginfo-32bit-2.8.18-2.6.2 libgimpui-2_0-0-32bit-2.8.18-2.6.2 libgimpui-2_0-0-debuginfo-32bit-2.8.18-2.6.2 References: https://bugzilla.suse.com/1050469

1 0

openSUSE-SU-2018:0042-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 09 Jan '18

09 Jan '18

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0042-1 Rating: important References: #1049305 #1049306 #1049307 #1049309 #1049310 #1049311 #1049312 #1049313 #1049314 #1049315 #1049316 #1049317 #1049318 #1049319 #1049320 #1049321 #1049322 #1049323 #1049324 #1049325 #1049326 #1049327 #1049328 #1049329 #1049330 #1049331 #1049332 #1052318 #1064071 #1064072 #1064073 #1064075 #1064077 #1064078 #1064079 #1064080 #1064081 #1064082 #1064083 #1064084 #1064085 #1064086 Cross-References: CVE-2016-10165 CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843 CVE-2017-10053 CVE-2017-10067 CVE-2017-10074 CVE-2017-10081 CVE-2017-10086 CVE-2017-10087 CVE-2017-10089 CVE-2017-10090 CVE-2017-10096 CVE-2017-10101 CVE-2017-10102 CVE-2017-10105 CVE-2017-10107 CVE-2017-10108 CVE-2017-10109 CVE-2017-10110 CVE-2017-10111 CVE-2017-10114 CVE-2017-10115 CVE-2017-10116 CVE-2017-10118 CVE-2017-10125 CVE-2017-10135 CVE-2017-10176 CVE-2017-10193 CVE-2017-10198 CVE-2017-10243 CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 46 vulnerabilities is now available. Description: This update for java-1_7_0-openjdk fixes the following issues: Security issues fixed: - CVE-2017-10356: Fix issue inside subcomponent Security (bsc#1064084). - CVE-2017-10274: Fix issue inside subcomponent Smart Card IO (bsc#1064071). - CVE-2017-10281: Fix issue inside subcomponent Serialization (bsc#1064072). - CVE-2017-10285: Fix issue inside subcomponent RMI (bsc#1064073). - CVE-2017-10295: Fix issue inside subcomponent Networking (bsc#1064075). - CVE-2017-10388: Fix issue inside subcomponent Libraries (bsc#1064086). - CVE-2017-10346: Fix issue inside subcomponent Hotspot (bsc#1064078). - CVE-2017-10350: Fix issue inside subcomponent JAX-WS (bsc#1064082). - CVE-2017-10347: Fix issue inside subcomponent Serialization (bsc#1064079). - CVE-2017-10349: Fix issue inside subcomponent JAXP (bsc#1064081). - CVE-2017-10345: Fix issue inside subcomponent Serialization (bsc#1064077). - CVE-2017-10348: Fix issue inside subcomponent Libraries (bsc#1064080). - CVE-2017-10357: Fix issue inside subcomponent Serialization (bsc#1064085). - CVE-2017-10355: Fix issue inside subcomponent Networking (bsc#1064083). - CVE-2017-10102: Fix incorrect handling of references in DGC (bsc#1049316). - CVE-2017-10053: Fix reading of unprocessed image data in JPEGImageReader (bsc#1049305). - CVE-2017-10067: Fix JAR verifier incorrect handling of missing digest (bsc#1049306). - CVE-2017-10081: Fix incorrect bracket processing in function signature handling (bsc#1049309). - CVE-2017-10087: Fix insufficient access control checks in ThreadPoolExecutor (bsc#1049311). - CVE-2017-10089: Fix insufficient access control checks in ServiceRegistry (bsc#1049312). - CVE-2017-10090: Fix insufficient access control checks in AsynchronousChannelGroupImpl (bsc#1049313). - CVE-2017-10096: Fix insufficient access control checks in XML transformations (bsc#1049314). - CVE-2017-10101: Fix unrestricted access to com.sun.org.apache.xml.internal.resolver (bsc#1049315). - CVE-2017-10107: Fix insufficient access control checks in ActivationID (bsc#1049318). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10110: Fix insufficient access control checks in ImageWatched (bsc#1049321). - CVE-2017-10108: Fix unbounded memory allocation in BasicAttribute deserialization (bsc#1049319). - CVE-2017-10109: Fix unbounded memory allocation in CodeSource deserialization (bsc#1049320). - CVE-2017-10115: Fix unspecified vulnerability in subcomponent JCE (bsc#1049324). - CVE-2017-10118: Fix ECDSA implementation timing attack (bsc#1049326). - CVE-2017-10116: Fix LDAPCertStore following referrals to non-LDAP URL (bsc#1049325). - CVE-2017-10135: Fix PKCS#8 implementation timing attack (bsc#1049328). - CVE-2017-10176: Fix incorrect handling of certain EC points (bsc#1049329). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10074: Fix integer overflows in range check loop predicates (bsc#1049307). - CVE-2017-10111: Fix checks in LambdaFormEditor (bsc#1049322). - CVE-2017-10243: Fix unspecified vulnerability in subcomponent JAX-WS (bsc#1049332). - CVE-2017-10125: Fix unspecified vulnerability in subcomponent deployment (bsc#1049327). - CVE-2017-10114: Fix unspecified vulnerability in subcomponent JavaFX (bsc#1049323). - CVE-2017-10105: Fix unspecified vulnerability in subcomponent deployment (bsc#1049317). - CVE-2017-10086: Fix unspecified in subcomponent JavaFX (bsc#1049310). - CVE-2017-10198: Fix incorrect enforcement of certificate path restrictions (bsc#1049331). - CVE-2017-10193: Fix incorrect key size constraint check (bsc#1049330). Bug fixes: - Drop Exec Shield workaround to fix crashes on recent kernels, where Exec Shield is gone (bsc#1052318). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-14=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-14=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.161-45.1 java-1_7_0-openjdk-accessibility-1.7.0.161-45.1 java-1_7_0-openjdk-bootstrap-1.7.0.161-45.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.161-45.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.161-45.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.161-45.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.161-45.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.161-45.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.161-45.1 java-1_7_0-openjdk-debuginfo-1.7.0.161-45.1 java-1_7_0-openjdk-debugsource-1.7.0.161-45.1 java-1_7_0-openjdk-demo-1.7.0.161-45.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.161-45.1 java-1_7_0-openjdk-devel-1.7.0.161-45.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.161-45.1 java-1_7_0-openjdk-headless-1.7.0.161-45.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.161-45.1 java-1_7_0-openjdk-src-1.7.0.161-45.1 - openSUSE Leap 42.3 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.161-45.1 - openSUSE Leap 42.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.161-42.6.1 java-1_7_0-openjdk-accessibility-1.7.0.161-42.6.1 java-1_7_0-openjdk-bootstrap-1.7.0.161-42.6.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.161-42.6.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.161-42.6.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.161-42.6.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.161-42.6.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.161-42.6.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.161-42.6.1 java-1_7_0-openjdk-debuginfo-1.7.0.161-42.6.1 java-1_7_0-openjdk-debugsource-1.7.0.161-42.6.1 java-1_7_0-openjdk-demo-1.7.0.161-42.6.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.161-42.6.1 java-1_7_0-openjdk-devel-1.7.0.161-42.6.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.161-42.6.1 java-1_7_0-openjdk-headless-1.7.0.161-42.6.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.161-42.6.1 java-1_7_0-openjdk-src-1.7.0.161-42.6.1 - openSUSE Leap 42.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.161-42.6.1 References: https://www.suse.com/security/cve/CVE-2016-10165.html https://www.suse.com/security/cve/CVE-2016-9840.html https://www.suse.com/security/cve/CVE-2016-9841.html https://www.suse.com/security/cve/CVE-2016-9842.html https://www.suse.com/security/cve/CVE-2016-9843.html https://www.suse.com/security/cve/CVE-2017-10053.html https://www.suse.com/security/cve/CVE-2017-10067.html https://www.suse.com/security/cve/CVE-2017-10074.html https://www.suse.com/security/cve/CVE-2017-10081.html https://www.suse.com/security/cve/CVE-2017-10086.html https://www.suse.com/security/cve/CVE-2017-10087.html https://www.suse.com/security/cve/CVE-2017-10089.html https://www.suse.com/security/cve/CVE-2017-10090.html https://www.suse.com/security/cve/CVE-2017-10096.html https://www.suse.com/security/cve/CVE-2017-10101.html https://www.suse.com/security/cve/CVE-2017-10102.html https://www.suse.com/security/cve/CVE-2017-10105.html https://www.suse.com/security/cve/CVE-2017-10107.html https://www.suse.com/security/cve/CVE-2017-10108.html https://www.suse.com/security/cve/CVE-2017-10109.html https://www.suse.com/security/cve/CVE-2017-10110.html https://www.suse.com/security/cve/CVE-2017-10111.html https://www.suse.com/security/cve/CVE-2017-10114.html https://www.suse.com/security/cve/CVE-2017-10115.html https://www.suse.com/security/cve/CVE-2017-10116.html https://www.suse.com/security/cve/CVE-2017-10118.html https://www.suse.com/security/cve/CVE-2017-10125.html https://www.suse.com/security/cve/CVE-2017-10135.html https://www.suse.com/security/cve/CVE-2017-10176.html https://www.suse.com/security/cve/CVE-2017-10193.html https://www.suse.com/security/cve/CVE-2017-10198.html https://www.suse.com/security/cve/CVE-2017-10243.html https://www.suse.com/security/cve/CVE-2017-10274.html https://www.suse.com/security/cve/CVE-2017-10281.html https://www.suse.com/security/cve/CVE-2017-10285.html https://www.suse.com/security/cve/CVE-2017-10295.html https://www.suse.com/security/cve/CVE-2017-10345.html https://www.suse.com/security/cve/CVE-2017-10346.html https://www.suse.com/security/cve/CVE-2017-10347.html https://www.suse.com/security/cve/CVE-2017-10348.html https://www.suse.com/security/cve/CVE-2017-10349.html https://www.suse.com/security/cve/CVE-2017-10350.html https://www.suse.com/security/cve/CVE-2017-10355.html https://www.suse.com/security/cve/CVE-2017-10356.html https://www.suse.com/security/cve/CVE-2017-10357.html https://www.suse.com/security/cve/CVE-2017-10388.html https://bugzilla.suse.com/1049305 https://bugzilla.suse.com/1049306 https://bugzilla.suse.com/1049307 https://bugzilla.suse.com/1049309 https://bugzilla.suse.com/1049310 https://bugzilla.suse.com/1049311 https://bugzilla.suse.com/1049312 https://bugzilla.suse.com/1049313 https://bugzilla.suse.com/1049314 https://bugzilla.suse.com/1049315 https://bugzilla.suse.com/1049316 https://bugzilla.suse.com/1049317 https://bugzilla.suse.com/1049318 https://bugzilla.suse.com/1049319 https://bugzilla.suse.com/1049320 https://bugzilla.suse.com/1049321 https://bugzilla.suse.com/1049322 https://bugzilla.suse.com/1049323 https://bugzilla.suse.com/1049324 https://bugzilla.suse.com/1049325 https://bugzilla.suse.com/1049326 https://bugzilla.suse.com/1049327 https://bugzilla.suse.com/1049328 https://bugzilla.suse.com/1049329 https://bugzilla.suse.com/1049330 https://bugzilla.suse.com/1049331 https://bugzilla.suse.com/1049332 https://bugzilla.suse.com/1052318 https://bugzilla.suse.com/1064071 https://bugzilla.suse.com/1064072 https://bugzilla.suse.com/1064073 https://bugzilla.suse.com/1064075 https://bugzilla.suse.com/1064077 https://bugzilla.suse.com/1064078 https://bugzilla.suse.com/1064079 https://bugzilla.suse.com/1064080 https://bugzilla.suse.com/1064081 https://bugzilla.suse.com/1064082 https://bugzilla.suse.com/1064083 https://bugzilla.suse.com/1064084 https://bugzilla.suse.com/1064085 https://bugzilla.suse.com/1064086

1 0

openSUSE-RU-2018:0037-1: important: Recommended update for fate
by maintenance＠opensuse.org 08 Jan '18

08 Jan '18

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0037-1 Rating: important References: #1047302 #1054023 #1059515 #1071535 #962999 #984459 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for fate to version 1.6.0.4 fixes the following issues: - Changes to Dev/QA in ECO tab are not recognized or saved (bsc#1071535) - CSS: Font size 8pt too small for reading (bsc#962999) - Fate repeatedly crashing (bsc#1059515) - Can change ECO fields after initial save (bsc#1054023) - Duplicated features not visible in FATE (bsc#1047302) - Crash after not saving new entry and quitting (bsc#984459) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-12=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): fate-1.6.0.4-22.1 fate-debuginfo-1.6.0.4-22.1 References: https://bugzilla.suse.com/1047302 https://bugzilla.suse.com/1054023 https://bugzilla.suse.com/1059515 https://bugzilla.suse.com/1071535 https://bugzilla.suse.com/962999 https://bugzilla.suse.com/984459

1 0

openSUSE-RU-2018:0035-1: important: Recommended update for fate
by maintenance＠opensuse.org 08 Jan '18

08 Jan '18

openSUSE Recommended Update: Recommended update for fate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0035-1 Rating: important References: #1047302 #1054023 #1059515 #1071535 #962999 #984459 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for fate to version 1.6.0.4 fixes the following issues: - Changes to Dev/QA in ECO tab are not recognized or saved (bsc#1071535) - CSS: Font size 8pt too small for reading (bsc#962999) - Fate repeatedly crashing (bsc#1059515) - Can change ECO fields after initial save (bsc#1054023) - Duplicated features not visible in FATE (bsc#1047302) - Crash after not saving new entry and quitting (bsc#984459) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-12=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-12=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): fate-1.6.0.4-32.1 fate-debuginfo-1.6.0.4-32.1 - openSUSE Leap 42.2 (x86_64): fate-1.6.0.4-23.15.1 fate-debuginfo-1.6.0.4-23.15.1 References: https://bugzilla.suse.com/1047302 https://bugzilla.suse.com/1054023 https://bugzilla.suse.com/1059515 https://bugzilla.suse.com/1071535 https://bugzilla.suse.com/962999 https://bugzilla.suse.com/984459

1 0

openSUSE-RU-2018:0033-1: moderate: Recommended update for libsolv, libzypp, zypper
by maintenance＠opensuse.org 05 Jan '18

05 Jan '18

openSUSE Recommended Update: Recommended update for libsolv, libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0033-1 Rating: moderate References: #1035946 #1036002 #1047233 #1053671 #1057188 #1057634 #1057640 #1058695 #1058783 #1062561 #1064999 #1067605 #1068708 #1071466 #661410 #969569 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: The Software Update Stack was updated to receive fixes and enhancements. libsolv: - Expose solver_get_recommendations() in bindings. - Fix bug in solver_prune_to_highest_prio_per_name resulting in bad output from solver_get_recommendations(). - Support 'without' and 'unless' dependencies. - Use same heuristic as upstream to determine source RPMs. - Fix memory leak in bindings. - Add pool_best_solvables() function. - Fix 64bit integer parsing from RPM headers. - Enable bzip2 and xz/lzma compression support. - Enable complex/rich dependencies on distributions with RPM 4.13+. - Fix potential segmentation fault in testcase_depstr. (bsc#1036002) - Fix performance issues with name = md5sum dependencies. (bsc#1035946) - Build with libxml2 instead of libexpat. libzypp: - Don't store duplicated locks. (bsc#969569) - Fix default for solver.allowNameChange. (bsc#1071466) - Don't filter procs with a different mnt namespace. (bsc#1068708) - Support repo variables in an URIs host:port component. (bsc#1057640, bsc#1067605) - Fix possible segmentation fault in Locale handling. (bsc#1064999) - Fix media handling in presence of a repo path prefix. (bsc#1062561) - Remove unused legacy notify-message script. (bsc#1058783) - Support multiple product licenses in repomd. (fate#322276) - Propagate 'rpm --import' errors. (bsc#1057188) - Fix typos in zypp.conf. zypper: - Locale: Fix possible segmentation fault. (bsc#1064999) - Unify '(add|modify)(repo|service)' property related arguments. - Fixed 'add' commands supporting to set only a subset of properties. - Introduced '-f/-F' as preferred short option for --[no-]refresh in all four commands. (bsc#661410, bsc#1053671) - Fix missing package names in installation report. (bsc#1058695) - Differ between unsupported and packages with unknown support status. (bsc#1057634) - Return error code '107' if an RPM's %post configuration script fails. (bsc#1047233) - Update manpage regarding custom repository variable fixes. (bsc#1057640, bsc#1067605) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-10=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libsolv-debugsource-0.6.30-5.6.1 libsolv-demo-0.6.30-5.6.1 libsolv-demo-debuginfo-0.6.30-5.6.1 libsolv-devel-0.6.30-5.6.1 libsolv-devel-debuginfo-0.6.30-5.6.1 libsolv-tools-0.6.30-5.6.1 libsolv-tools-debuginfo-0.6.30-5.6.1 libzypp-16.17.7-5.15.1 libzypp-debuginfo-16.17.7-5.15.1 libzypp-debugsource-16.17.7-5.15.1 libzypp-devel-16.17.7-5.15.1 libzypp-devel-doc-16.17.7-5.15.1 perl-solv-0.6.30-5.6.1 perl-solv-debuginfo-0.6.30-5.6.1 python-solv-0.6.30-5.6.1 python-solv-debuginfo-0.6.30-5.6.1 python3-solv-0.6.30-5.6.1 python3-solv-debuginfo-0.6.30-5.6.1 ruby-solv-0.6.30-5.6.1 ruby-solv-debuginfo-0.6.30-5.6.1 zypper-1.13.39-5.15.1 zypper-debuginfo-1.13.39-5.15.1 zypper-debugsource-1.13.39-5.15.1 - openSUSE Leap 42.2 (noarch): zypper-aptitude-1.13.39-5.15.1 zypper-log-1.13.39-5.15.1 References: https://bugzilla.suse.com/1035946 https://bugzilla.suse.com/1036002 https://bugzilla.suse.com/1047233 https://bugzilla.suse.com/1053671 https://bugzilla.suse.com/1057188 https://bugzilla.suse.com/1057634 https://bugzilla.suse.com/1057640 https://bugzilla.suse.com/1058695 https://bugzilla.suse.com/1058783 https://bugzilla.suse.com/1062561 https://bugzilla.suse.com/1064999 https://bugzilla.suse.com/1067605 https://bugzilla.suse.com/1068708 https://bugzilla.suse.com/1071466 https://bugzilla.suse.com/661410 https://bugzilla.suse.com/969569

1 0

openSUSE-RU-2018:0032-1: moderate: Recommended update for libzypp, zypper
by maintenance＠opensuse.org 05 Jan '18

05 Jan '18

openSUSE Recommended Update: Recommended update for libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0032-1 Rating: moderate References: #1057640 #1067605 #1068708 #1071466 #969569 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: The Software Update Stack was updated to receive fixes and enhancements. libzypp: - Don't store duplicated locks. (bsc#969569) - Fix default for solver.allowNameChange. (bsc#1071466) - Don't filter procs with a different mnt namespace. (bsc#1068708) - Support repo variables in an URIs host:port component. (bsc#1057640, bsc#1067605) zypper: - Update manpage regarding custom repository variable fixes. (bsc#1057640, bsc#1067605) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-11=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libzypp-16.17.7-18.1 libzypp-debuginfo-16.17.7-18.1 libzypp-debugsource-16.17.7-18.1 libzypp-devel-16.17.7-18.1 libzypp-devel-doc-16.17.7-18.1 zypper-1.13.39-14.1 zypper-debuginfo-1.13.39-14.1 zypper-debugsource-1.13.39-14.1 - openSUSE Leap 42.3 (noarch): zypper-aptitude-1.13.39-14.1 zypper-log-1.13.39-14.1 References: https://bugzilla.suse.com/1057640 https://bugzilla.suse.com/1067605 https://bugzilla.suse.com/1068708 https://bugzilla.suse.com/1071466 https://bugzilla.suse.com/969569

1 0

openSUSE-SU-2018:0030-1: important: Security update for qemu
by opensuse-security＠opensuse.org 05 Jan '18

05 Jan '18

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0030-1 Rating: important References: #1052825 #1068032 Cross-References: CVE-2017-5715 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for qemu fixes the following issues: A new feature was added: - Support EPYC vCPU type (bsc#1052825 fate#324038) Also a mitigation for a security problem has been applied: - CVE-2017-5715: QEMU was updated to allow passing through new MSR and CPUID flags from the host VM to the CPU, to allow enabling/disabling branch prediction features in the Intel CPU. (bsc#1068032) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-8=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): qemu-linux-user-2.9.1-38.1 qemu-linux-user-debuginfo-2.9.1-38.1 qemu-linux-user-debugsource-2.9.1-38.1 - openSUSE Leap 42.3 (x86_64): qemu-2.9.1-38.1 qemu-arm-2.9.1-38.1 qemu-arm-debuginfo-2.9.1-38.1 qemu-block-curl-2.9.1-38.1 qemu-block-curl-debuginfo-2.9.1-38.1 qemu-block-dmg-2.9.1-38.1 qemu-block-dmg-debuginfo-2.9.1-38.1 qemu-block-iscsi-2.9.1-38.1 qemu-block-iscsi-debuginfo-2.9.1-38.1 qemu-block-rbd-2.9.1-38.1 qemu-block-rbd-debuginfo-2.9.1-38.1 qemu-block-ssh-2.9.1-38.1 qemu-block-ssh-debuginfo-2.9.1-38.1 qemu-debugsource-2.9.1-38.1 qemu-extra-2.9.1-38.1 qemu-extra-debuginfo-2.9.1-38.1 qemu-guest-agent-2.9.1-38.1 qemu-guest-agent-debuginfo-2.9.1-38.1 qemu-ksm-2.9.1-38.1 qemu-kvm-2.9.1-38.1 qemu-lang-2.9.1-38.1 qemu-ppc-2.9.1-38.1 qemu-ppc-debuginfo-2.9.1-38.1 qemu-s390-2.9.1-38.1 qemu-s390-debuginfo-2.9.1-38.1 qemu-testsuite-2.9.1-38.2 qemu-tools-2.9.1-38.1 qemu-tools-debuginfo-2.9.1-38.1 qemu-x86-2.9.1-38.1 qemu-x86-debuginfo-2.9.1-38.1 - openSUSE Leap 42.3 (noarch): qemu-ipxe-1.0.0-38.1 qemu-seabios-1.10.2-38.1 qemu-sgabios-8-38.1 qemu-vgabios-1.10.2-38.1 References: https://www.suse.com/security/cve/CVE-2017-5715.html https://bugzilla.suse.com/1052825 https://bugzilla.suse.com/1068032

1 0

openSUSE-SU-2018:0029-1: moderate: Security update for nodejs4
by opensuse-security＠opensuse.org 05 Jan '18

05 Jan '18

openSUSE Security Update: Security update for nodejs4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0029-1 Rating: moderate References: #1056058 #1066242 #1072322 Cross-References: CVE-2017-14919 CVE-2017-15896 CVE-2017-3735 CVE-2017-3736 CVE-2017-3738 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to embedded OpenSSL (bsc#1072322). - CVE-2017-14919: Embedded zlib issue could cause a DoS via specific windowBits value. - CVE-2017-3738: Embedded OpenSSL is vulnerable to rsaz_1024_mul_avx2 overflow bug on x86_64. - CVE-2017-3736: Embedded OpenSSL is vulnerable to bn_sqrx8x_internal carry bug on x86_64 (bsc#1066242). - CVE-2017-3735: Embedded OpenSSL is vulnerable to malformed X.509 IPAdressFamily that could cause OOB read (bsc#1056058). Bug fixes: - Update to release 4.8.7 (bsc#1072322): * https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ * https://nodejs.org/en/blog/release/v4.8.7/ * https://nodejs.org/en/blog/release/v4.8.6/ * https://nodejs.org/en/blog/release/v4.8.5/ This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-5=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-5=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs4-4.8.7-11.1 nodejs4-debuginfo-4.8.7-11.1 nodejs4-debugsource-4.8.7-11.1 nodejs4-devel-4.8.7-11.1 npm4-4.8.7-11.1 - openSUSE Leap 42.3 (noarch): nodejs4-docs-4.8.7-11.1 - openSUSE Leap 42.2 (i586 x86_64): nodejs4-4.8.7-5.9.1 nodejs4-debuginfo-4.8.7-5.9.1 nodejs4-debugsource-4.8.7-5.9.1 nodejs4-devel-4.8.7-5.9.1 npm4-4.8.7-5.9.1 - openSUSE Leap 42.2 (noarch): nodejs4-docs-4.8.7-5.9.1 References: https://www.suse.com/security/cve/CVE-2017-14919.html https://www.suse.com/security/cve/CVE-2017-15896.html https://www.suse.com/security/cve/CVE-2017-3735.html https://www.suse.com/security/cve/CVE-2017-3736.html https://www.suse.com/security/cve/CVE-2017-3738.html https://bugzilla.suse.com/1056058 https://bugzilla.suse.com/1066242 https://bugzilla.suse.com/1072322

1 0

openSUSE-SU-2018:0027-1: moderate: Security update for clamav-database
by opensuse-security＠opensuse.org 05 Jan '18

05 Jan '18

openSUSE Security Update: Security update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0027-1 Rating: moderate References: Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update refreshes the clamav-database. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2018-6=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): clamav-database-201801010008-54.124.1 References:

1 0