October 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:3412-1: moderate: Recommended update for amazon-ssm-agent
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for amazon-ssm-agent ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3412-1 Rating: moderate References: #1108265 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for amazon-ssm-agent provides version 2.3.50.0 and fixes the following issues: - Enables the Session Manager capability that lets you manage your Amazon EC2 instance through an interactive one-click browser-based shell or through the AWS CLI. - Beginning this agent version, SSM Agent will create a local user "ssm-user" and add it to /etc/sudoers (Linux) every time the agent starts. The ssm-user is the default OS user when a Session Manager session is started, and the password for this user is reset on every session. You can change the permissions by moving the ssm-user to a less-privileged group or by changing the sudoers file. The ssm-user is not removed from the system when SSM Agent is uninstalled. - Retry sending Run Command execution results for up to 2 hours. - More detailed error messages are returned for inventory plugin failures during State Manager association executions. - Bug fix to clean the orchestration directory. - Streaming AWS Systems Manager Run Command output to CloudWatch Logs. - Reducing number of retries for serial port opening. - Add retry logic to installation verification. - Bug fix to retry sending document results if they couldn't reach the service. - Bug fix so that aws:downloadContent does not change permissions of directories. - Bug fix to Cloudwatch plugin where StartType has duplicated Enabled value. - Added support for agent hibernation so that Agent backs off or enters hibernation mode if it does not have access to the service. - Fix S3Download to download from cross regions. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1255=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): amazon-ssm-agent-2.3.50.0-2.9.1 References: https://bugzilla.suse.com/1108265

1 0

openSUSE-RU-2018:3411-1: moderate: Recommended update for yast2-isns
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for yast2-isns ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3411-1 Rating: moderate References: #1099691 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-isns implements the following feature: - Added additional searchkeys to desktop file (fate#321043, bsc#1099691) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1261=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-isns-4.0.1-lp150.2.3.1 References: https://bugzilla.suse.com/1099691

1 0

openSUSE-RU-2018:3410-1: moderate: Recommended update for apr-util
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for apr-util ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3410-1 Rating: moderate References: #1094754 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apr-util fixes the following issues: - Fix detection / build with MariaDB 10.2 (bsc#1094754) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1257=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apr-util-debuginfo-1.6.1-lp150.3.3.1 apr-util-debugsource-1.6.1-lp150.3.3.1 apr-util-devel-1.6.1-lp150.3.3.1 libapr-util1-1.6.1-lp150.3.3.1 libapr-util1-dbd-mysql-1.6.1-lp150.3.3.1 libapr-util1-dbd-mysql-debuginfo-1.6.1-lp150.3.3.1 libapr-util1-dbd-pgsql-1.6.1-lp150.3.3.1 libapr-util1-dbd-pgsql-debuginfo-1.6.1-lp150.3.3.1 libapr-util1-dbd-sqlite3-1.6.1-lp150.3.3.1 libapr-util1-dbd-sqlite3-debuginfo-1.6.1-lp150.3.3.1 libapr-util1-debuginfo-1.6.1-lp150.3.3.1 References: https://bugzilla.suse.com/1094754

1 0

openSUSE-RU-2018:3409-1: moderate: Recommended update for yast2-storage-ng and libstorage-ng
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for yast2-storage-ng and libstorage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3409-1 Rating: moderate References: #1055756 #1085134 #1089353 #1090010 #1099144 #1099181 #1099394 #1099762 #1103113 #1104774 #1105227 #1106774 #1107298 #1108831 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 14 recommended fixes can now be installed. Description: This update for yast2-storage-ng and libstorage-ng fixes the following issues: yast2-storage-ng: - When trying to reuse a partition, AutoYaST will consider only those partitions from the right disk (bsc#1106774). - Show a warning when overwriting manually edited settings (bsc#1055756) - AutoYaST: Export volume group name (lvm_group) when an MD RAID device is used as a physical volume (bsc#1103113). - AutoYaST: Recognize Xen virtual partitions in the profile when importing and installing (bsc#1085134). - AutoYaST: Set the 'mount by' option when reusing partitions (bsc#1104774). - Fixed the warning about overwriting a manually edited partition layout. Now it works even after going back and forth in the installer steps (bsc#1055756). - Partitioner: Display Xen virtual partitions and allow to format and mount them (bsc#1085134). - RAID attributes: Include "Active: Yes/No". (bsc#1090010) - Fixed crash in the Kubic proposal when insufficient disk space. (bsc#1099762) - Allow to use whole disk as PV by indicating a partition with number 0 (bsc#1107298) - Add asterisk to mount points that is not active and to the description (fate#318196) - Does no longer crash if existing boot partition cannot be used without formatting it (bsc#1108831) libstorage-ng: - Fixed variable scope to fix temporary mounting. (bsc#1099144) - Avoid exceptions for inactive RAIDs. (bsc#1090010) - Adjust multipath parser to accept nvme related output. (bsc#1089353) - Detect correctly whether a file system is currently mounted. (bsc#1105227) - Do not crash when displaying summary for an encrypted but not mounted disk (bsc#1099181) - Improve handling of udev ids starting with dm-uuid for partitions on multipath (bsc#1099394) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1258=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): libstorage-ng-debuginfo-3.3.315-lp150.2.9.1 libstorage-ng-debugsource-3.3.315-lp150.2.9.1 libstorage-ng-devel-3.3.315-lp150.2.9.1 libstorage-ng-integration-tests-3.3.315-lp150.2.9.1 libstorage-ng-python3-3.3.315-lp150.2.9.1 libstorage-ng-python3-debuginfo-3.3.315-lp150.2.9.1 libstorage-ng-ruby-3.3.315-lp150.2.9.1 libstorage-ng-ruby-debuginfo-3.3.315-lp150.2.9.1 libstorage-ng-utils-3.3.315-lp150.2.9.1 libstorage-ng-utils-debuginfo-3.3.315-lp150.2.9.1 libstorage-ng1-3.3.315-lp150.2.9.1 libstorage-ng1-debuginfo-3.3.315-lp150.2.9.1 yast2-storage-ng-4.0.213-lp150.2.12.1 - openSUSE Leap 15.0 (noarch): libstorage-ng-lang-3.3.315-lp150.2.9.1 References: https://bugzilla.suse.com/1055756 https://bugzilla.suse.com/1085134 https://bugzilla.suse.com/1089353 https://bugzilla.suse.com/1090010 https://bugzilla.suse.com/1099144 https://bugzilla.suse.com/1099181 https://bugzilla.suse.com/1099394 https://bugzilla.suse.com/1099762 https://bugzilla.suse.com/1103113 https://bugzilla.suse.com/1104774 https://bugzilla.suse.com/1105227 https://bugzilla.suse.com/1106774 https://bugzilla.suse.com/1107298 https://bugzilla.suse.com/1108831

1 0

openSUSE-RU-2018:3408-1: moderate: Recommended update for yast2-scanner
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for yast2-scanner ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3408-1 Rating: moderate References: #1087957 #1099691 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-scanner implements the following feature: - Added additional searchkeys to desktop file (fate#321043, bsc#1099691) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1262=1 Package List: - openSUSE Leap 15.0 (x86_64): yast2-scanner-4.0.2-lp150.2.3.1 yast2-scanner-debuginfo-4.0.2-lp150.2.3.1 yast2-scanner-debugsource-4.0.2-lp150.2.3.1 References: https://bugzilla.suse.com/1087957 https://bugzilla.suse.com/1099691

1 0

openSUSE-RU-2018:3407-1: moderate: Recommended update for bcache-tools
by maintenance＠opensuse.org 25 Oct '18

25 Oct '18

openSUSE Recommended Update: Recommended update for bcache-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3407-1 Rating: moderate References: #1109460 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bcache-tools fixes the following issues: - Avoid many operations on sysfs entries by yast2 bcache module development. (bsc#1109460) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1260=1 Package List: - openSUSE Leap 15.0 (x86_64): bcache-tools-1.0.9-lp150.2.3.1 bcache-tools-debuginfo-1.0.9-lp150.2.3.1 bcache-tools-debugsource-1.0.9-lp150.2.3.1 References: https://bugzilla.suse.com/1109460

1 0

openSUSE-OU-2018:3399-1: moderate: Optional update to add nodejs10
by maintenance＠opensuse.org 24 Oct '18

24 Oct '18

openSUSE Optional Update: Optional update to add nodejs10 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:3399-1 Rating: moderate References: #1109141 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update adds nodejs10 to the distribution. The package is a build dependency for Chromium 70 (bsc#1109141) Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1252=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): nodejs10-10.12.0-2.1 nodejs10-debuginfo-10.12.0-2.1 nodejs10-debugsource-10.12.0-2.1 nodejs10-devel-10.12.0-2.1 npm10-10.12.0-2.1 - openSUSE Leap 42.3 (noarch): nodejs10-docs-10.12.0-2.1 References: https://bugzilla.suse.com/1109141

1 0

openSUSE-SU-2018:3396-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 24 Oct '18

24 Oct '18

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3396-1 Rating: important References: #1112111 Cross-References: CVE-2018-17462 CVE-2018-17463 CVE-2018-17464 CVE-2018-17465 CVE-2018-17466 CVE-2018-17467 CVE-2018-17468 CVE-2018-17469 CVE-2018-17470 CVE-2018-17471 CVE-2018-17472 CVE-2018-17473 CVE-2018-17474 CVE-2018-17475 CVE-2018-17476 CVE-2018-17477 CVE-2018-5179 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for Chromium to version 70.0.3538.67 fixes multiple issues. Security issues fixed (bsc#1112111): - CVE-2018-17462: Sandbox escape in AppCache - CVE-2018-17463: Remote code execution in V8 - Heap buffer overflow in Little CMS in PDFium - CVE-2018-17464: URL spoof in Omnibox - CVE-2018-17465: Use after free in V8 - CVE-2018-17466: Memory corruption in Angle - CVE-2018-17467: URL spoof in Omnibox - CVE-2018-17468: Cross-origin URL disclosure in Blink - CVE-2018-17469: Heap buffer overflow in PDFium - CVE-2018-17470: Memory corruption in GPU Internals - CVE-2018-17471: Security UI occlusion in full screen mode - CVE-2018-17473: URL spoof in Omnibox - CVE-2018-17474: Use after free in Blink - CVE-2018-17475: URL spoof in Omnibox - CVE-2018-17476: Security UI occlusion in full screen mode - CVE-2018-5179: Lack of limits on update() in ServiceWorker - CVE-2018-17477: UI spoof in Extensions VAAPI hardware accelerated rendering is now enabled by default. This update contains the following packaging changes: - Use the system libusb-1.0 library - Use bundled harfbuzz library - Disable gnome-keyring to avoid crashes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1253=1 Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-70.0.3538.67-179.1 chromedriver-debuginfo-70.0.3538.67-179.1 chromium-70.0.3538.67-179.1 chromium-debuginfo-70.0.3538.67-179.1 chromium-debugsource-70.0.3538.67-179.1 References: https://www.suse.com/security/cve/CVE-2018-17462.html https://www.suse.com/security/cve/CVE-2018-17463.html https://www.suse.com/security/cve/CVE-2018-17464.html https://www.suse.com/security/cve/CVE-2018-17465.html https://www.suse.com/security/cve/CVE-2018-17466.html https://www.suse.com/security/cve/CVE-2018-17467.html https://www.suse.com/security/cve/CVE-2018-17468.html https://www.suse.com/security/cve/CVE-2018-17469.html https://www.suse.com/security/cve/CVE-2018-17470.html https://www.suse.com/security/cve/CVE-2018-17471.html https://www.suse.com/security/cve/CVE-2018-17472.html https://www.suse.com/security/cve/CVE-2018-17473.html https://www.suse.com/security/cve/CVE-2018-17474.html https://www.suse.com/security/cve/CVE-2018-17475.html https://www.suse.com/security/cve/CVE-2018-17476.html https://www.suse.com/security/cve/CVE-2018-17477.html https://www.suse.com/security/cve/CVE-2018-5179.html https://bugzilla.suse.com/1112111

1 0

openSUSE-SU-2018:3384-1: moderate: Security update for apache-pdfbox
by opensuse-security＠opensuse.org 24 Oct '18

24 Oct '18

openSUSE Security Update: Security update for apache-pdfbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3384-1 Rating: moderate References: #1099721 #1111009 Cross-References: CVE-2018-11797 CVE-2018-8036 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache-pdfbox fixes the following security issue: - CVE-2018-8036: A crafted file could have triggered an infinite loop which lead to DoS (bsc#1099721). - CVE-2018-11797: A carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree. (bsc#1111009): This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1245=1 Package List: - openSUSE Leap 42.3 (noarch): apache-pdfbox-1.8.12-4.3.1 apache-pdfbox-javadoc-1.8.12-4.3.1 References: https://www.suse.com/security/cve/CVE-2018-11797.html https://www.suse.com/security/cve/CVE-2018-8036.html https://bugzilla.suse.com/1099721 https://bugzilla.suse.com/1111009

1 0

openSUSE-RU-2018:3383-1: Recommended update for tigervnc
by maintenance＠opensuse.org 24 Oct '18

24 Oct '18

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:3383-1 Rating: low References: #1075403 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tigervnc fixes the following issues: - Fix 16bit depth support in the java viewer. (bsc#1075403) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1251=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libXvnc-devel-1.6.0-24.1 libXvnc1-1.6.0-24.1 libXvnc1-debuginfo-1.6.0-24.1 tigervnc-1.6.0-24.1 tigervnc-debuginfo-1.6.0-24.1 tigervnc-debugsource-1.6.0-24.1 xorg-x11-Xvnc-1.6.0-24.1 xorg-x11-Xvnc-debuginfo-1.6.0-24.1 References: https://bugzilla.suse.com/1075403

1 0