February 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0364-1: moderate: Security update for translate-toolkit
by opensuse-security＠opensuse.org 05 Feb '18

05 Feb '18

openSUSE Security Update: Security update for translate-toolkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0364-1 Rating: moderate References: #1073535 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for translate-toolkit to 2.2.4 fixes several issues. This security issue was fixed: - Prevent inclusion of external ressources (XXE) (boo#1073535) These non-security issues were fixed: - Added support for nested and WebExtension JSON dialects. - po2txt no longer converts non-translatable strings. - Improvement for puncspace check. - Support for .xliff extension. - Added MinimalChecker and ReducedChecker checkers. - Fixed resolving of country names translations. - Refactored functions for resolving language/country names translation to be memory efficient. - Improvements for ts and subtitles formats. - Fixed Montenegrin language name. - Avoid resolving external entities while parsing XML. - Improvements for Android, ts and resx formats. - Added support for PHP nested arrays. - Added Kabyle language Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-130=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): translate-toolkit-2.2.4-4.1 translate-toolkit-devel-doc-2.2.4-4.1 References: https://bugzilla.suse.com/1073535

1 0

openSUSE-SU-2018:0360-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 04 Feb '18

04 Feb '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0360-1 Rating: moderate References: #1078463 #1079021 Cross-References: CVE-2018-6406 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium to version 64.0.3282.140 fixes the following security issues: - CVE-2018-6406: Various asan fixes (boo#1078463, boo#1079021) The regular expression library re2 was updated to 2018-02-01. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-128=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libre2-0-20180201-12.1 libre2-0-debuginfo-20180201-12.1 re2-debugsource-20180201-12.1 re2-devel-20180201-12.1 - openSUSE Leap 42.3 (x86_64): chromedriver-64.0.3282.140-138.1 chromedriver-debuginfo-64.0.3282.140-138.1 chromium-64.0.3282.140-138.1 chromium-debuginfo-64.0.3282.140-138.1 chromium-debugsource-64.0.3282.140-138.1 libre2-0-32bit-20180201-12.1 libre2-0-debuginfo-32bit-20180201-12.1 References: https://www.suse.com/security/cve/CVE-2018-6406.html https://bugzilla.suse.com/1078463 https://bugzilla.suse.com/1079021

1 0

openSUSE-SU-2018:0359-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 04 Feb '18

04 Feb '18

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0359-1 Rating: moderate References: #1078463 #1079021 Cross-References: CVE-2018-6406 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for chromium to version 64.0.3282.140 fixes the following security issues: - CVE-2018-6406: Various asan fixes (boo#1078463, boo#1079021) The regular expression library re2 was updated to 2018-02-01. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-128=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libre2-0-20180201-8.1 libre2-0-debuginfo-20180201-8.1 re2-debugsource-20180201-8.1 re2-devel-20180201-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-64.0.3282.140-49.1 chromedriver-debuginfo-64.0.3282.140-49.1 chromium-64.0.3282.140-49.1 chromium-debuginfo-64.0.3282.140-49.1 chromium-debugsource-64.0.3282.140-49.1 References: https://www.suse.com/security/cve/CVE-2018-6406.html https://bugzilla.suse.com/1078463 https://bugzilla.suse.com/1079021

1 0

openSUSE-RU-2018:0358-1: Recommended update for timezone, timezone-java
by maintenance＠opensuse.org 04 Feb '18

04 Feb '18

openSUSE Recommended Update: Recommended update for timezone, timezone-java ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0358-1 Rating: low References: #1073275 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the latest timezone information (2018c) for your system, including following changes: - Sao Tome and Principe switched from +00 to +01 on 2018-01-01. - Southern Brazil's DST will now start on November's first Sunday. (bsc#1073275) - New zic option -t to specify the time zone file if TZ is unset. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-129=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): timezone-2018c-45.1 timezone-debuginfo-2018c-45.1 timezone-debugsource-2018c-45.1 - openSUSE Leap 42.3 (noarch): timezone-java-2018c-0.45.1 References: https://bugzilla.suse.com/1073275

1 0

openSUSE-SU-2018:0344-1: moderate: Security update for ecryptfs-utils
by opensuse-security＠opensuse.org 01 Feb '18

01 Feb '18

openSUSE Security Update: Security update for ecryptfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0344-1 Rating: moderate References: #989121 #989122 Cross-References: CVE-2015-8946 CVE-2016-6224 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ecryptfs-utils fixes the following issues: - CVE-2015-8946: ecryptfs-setup-swap improperly configures encrypted swap when using GPT partitioning (bsc#989121) - CVE-2016-6224: ecryptfs-setup-swap improperly configures encrypted swap when using GPT partitioning on a NVMe or MMC drive (bsc#989122) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-126=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ecryptfs-utils-103-7.1 ecryptfs-utils-debuginfo-103-7.1 ecryptfs-utils-debugsource-103-7.1 - openSUSE Leap 42.3 (x86_64): ecryptfs-utils-32bit-103-7.1 ecryptfs-utils-debuginfo-32bit-103-7.1 References: https://www.suse.com/security/cve/CVE-2015-8946.html https://www.suse.com/security/cve/CVE-2016-6224.html https://bugzilla.suse.com/989121 https://bugzilla.suse.com/989122

1 0

openSUSE-SU-2018:0343-1: moderate: Security update for libXfont
by opensuse-security＠opensuse.org 01 Feb '18

01 Feb '18

openSUSE Security Update: Security update for libXfont ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0343-1 Rating: moderate References: #1049692 #1050459 #1054285 Cross-References: CVE-2017-13720 CVE-2017-13722 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for libXfont fixes several issues. These security issues were fixed: - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads (bsc#1054285) - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information (bsc#1049692) - Prevent the X server from accessing arbitrary files as root. It is not possible to leak information, but special files can be touched allowing for causing side effects (bsc#1050459) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-124=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libXfont-debugsource-1.5.1-13.1 libXfont-devel-1.5.1-13.1 libXfont1-1.5.1-13.1 libXfont1-debuginfo-1.5.1-13.1 - openSUSE Leap 42.3 (x86_64): libXfont-devel-32bit-1.5.1-13.1 libXfont1-32bit-1.5.1-13.1 libXfont1-debuginfo-32bit-1.5.1-13.1 References: https://www.suse.com/security/cve/CVE-2017-13720.html https://www.suse.com/security/cve/CVE-2017-13722.html https://bugzilla.suse.com/1049692 https://bugzilla.suse.com/1050459 https://bugzilla.suse.com/1054285

1 0

openSUSE-RU-2018:0342-1: Recommended update for osinfo-db, virt-manager
by maintenance＠opensuse.org 01 Feb '18

01 Feb '18

openSUSE Recommended Update: Recommended update for osinfo-db, virt-manager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0342-1 Rating: low References: #1027942 #1054986 #1055787 #1056028 #1057733 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for osinfo-db, virt-manager fixes the following issues: - Add support for openSUSE Leap 15 and SLE 15 product family. (bsc#1054986) - Fix OES 2018 installs as Xen guest. (bsc#1056028) - Fix hang on first reboot when installing PV guests from ISO images. (bsc#1055787) - Fix libosinfo database entry for SUSE CaaS Platform. (bsc#1057733) - Update osinfo database to version 20170423. (fate#322156) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-127=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): osinfo-db-20170813-4.1 virt-install-1.4.1-6.1 virt-manager-1.4.1-6.1 virt-manager-common-1.4.1-6.1 References: https://bugzilla.suse.com/1027942 https://bugzilla.suse.com/1054986 https://bugzilla.suse.com/1055787 https://bugzilla.suse.com/1056028 https://bugzilla.suse.com/1057733

1 0

openSUSE-RU-2018:0341-1: Recommended update for systemd-rpm-macros
by maintenance＠opensuse.org 01 Feb '18

01 Feb '18

openSUSE Recommended Update: Recommended update for systemd-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0341-1 Rating: low References: #1071543 #1073715 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for systemd-rpm-macros provides the following fixes: - Make sure to apply presets if packages start shipping units during upgrades. (bsc#1071543, bsc#1073715) - Remove a useless test in %service_add_pre(). The test was placed where the condition '[ "$FIRST_ARG" -gt 1 ]' was always true. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-125=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): logrotate-3.11.0-15.2 logrotate-debuginfo-3.11.0-15.2 logrotate-debugsource-3.11.0-15.2 - openSUSE Leap 42.3 (noarch): systemd-rpm-macros-3-9.1 References: https://bugzilla.suse.com/1071543 https://bugzilla.suse.com/1073715

1 0

openSUSE-RU-2018:0332-1: moderate: Recommended update for ptpd
by maintenance＠opensuse.org 01 Feb '18

01 Feb '18

openSUSE Recommended Update: Recommended update for ptpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0332-1 Rating: moderate References: #1069468 #1076900 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for ptpd fixes the following issues: - service file was using an incorrect executable path (boo#1076900) - References to /var/adm/fillup-templates replaced with %_fillupdir macro (boo#1069468) This update also includes all upstream bug fixes and improvements in the 2.3.1 version. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-123=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ptpd-2.3.1-8.1 ptpd-debuginfo-2.3.1-8.1 ptpd-debugsource-2.3.1-8.1 References: https://bugzilla.suse.com/1069468 https://bugzilla.suse.com/1076900

1 0

openSUSE-SU-2018:0329-1: important: Security update for freeimage
by opensuse-security＠opensuse.org 01 Feb '18

01 Feb '18

openSUSE Security Update: Security update for freeimage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0329-1 Rating: important References: #1002621 Cross-References: CVE-2016-5684 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for freeimage fixes one issues. This security issue was fixed: - CVE-2016-5684: Prevent out-of-bounds write vulnerability in the XMP image handling functionality. A specially crafted XMP file could have caused an arbitrary memory overwrite resulting in code execution (boo#1002621). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-121=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): freeimage-debugsource-3.17.0-5.1 freeimage-devel-3.17.0-5.1 libfreeimage3-3.17.0-5.1 libfreeimage3-debuginfo-3.17.0-5.1 libfreeimageplus3-3.17.0-5.1 libfreeimageplus3-debuginfo-3.17.0-5.1 References: https://www.suse.com/security/cve/CVE-2016-5684.html https://bugzilla.suse.com/1002621

1 0