February 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:0485-1: Recommended update for doomsday
by maintenance＠opensuse.org 20 Feb '18

20 Feb '18

openSUSE Recommended Update: Recommended update for doomsday ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0485-1 Rating: low References: #1073084 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for doomsday fixes the following issues: - Ship doomsday-engine.desktop file calling /usr/bin/launch-doomsday in the same subpackage as launch-doomsday. [boo#1073084] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-181=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): doomsday-1.14.5-6.3.1 doomsday-debuginfo-1.14.5-6.3.1 doomsday-debugsource-1.14.5-6.3.1 - openSUSE Leap 42.3 (noarch): doomsday-launcher-1.14.5-6.3.1 References: https://bugzilla.suse.com/1073084

1 0

openSUSE-RU-2018:0484-1: Recommended update for hawk2
by maintenance＠opensuse.org 20 Feb '18

20 Feb '18

openSUSE Recommended Update: Recommended update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0484-1 Rating: low References: #1054027 #1074856 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for hawk2 provides the following fixes: - High: Support guest nodes (bsc#1074856) - Show descriptions in cluster config (bsc#1054027) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-182=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): hawk2-2.1.0+git.1516013868.bada8da4-6.1 hawk2-debuginfo-2.1.0+git.1516013868.bada8da4-6.1 hawk2-debugsource-2.1.0+git.1516013868.bada8da4-6.1 References: https://bugzilla.suse.com/1054027 https://bugzilla.suse.com/1074856

1 0

openSUSE-RU-2018:0483-1: Recommended update for python-openqa_review
by maintenance＠opensuse.org 20 Feb '18

20 Feb '18

openSUSE Recommended Update: Recommended update for python-openqa_review ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0483-1 Rating: low References: Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-openqa_review introduces version 1.10.0: * Add helper script for SLE15 functional+autoyast concise report * Mark closed tickets as red * Add 'bgo' bugref * Handle unknown bugtrackers gracefully * Provide job references in failed soft-fail parsing * Add review wrapper script for 'functional' group on openqa.suse.de * Handle disconnects by remote end on API get gracefully Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-180=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): python-openqa_review-1.10.0-6.1 python3-openqa_review-1.10.0-6.1 References:

1 0

openSUSE-RU-2018:0481-1: moderate: Recommended update for amarok
by maintenance＠opensuse.org 19 Feb '18

19 Feb '18

openSUSE Recommended Update: Recommended update for amarok ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0481-1 Rating: moderate References: #1070899 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for amarok contains the following fixes: - avoid automatic network connections during start-up that may cause the playback to fail for local files (boo#1070899) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-179=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (noarch): amarok-lang-2.8.0-22.1 - openSUSE Leap 42.3 (x86_64): amarok-2.8.0-22.1 amarok-debuginfo-2.8.0-22.1 amarok-debugsource-2.8.0-22.1 References: https://bugzilla.suse.com/1070899

1 0

openSUSE-RU-2018:0480-1: moderate: Recommended update for amarok
by maintenance＠opensuse.org 19 Feb '18

19 Feb '18

openSUSE Recommended Update: Recommended update for amarok ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0480-1 Rating: moderate References: #1070899 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for amarok contains the following fixes: - avoid automatic network connections during start-up that may cause the playback to fail for local files (boo#1070899) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-179=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): amarok-2.8.0-8.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): amarok-lang-2.8.0-8.1 References: https://bugzilla.suse.com/1070899

1 0

openSUSE-SU-2018:0479-1: moderate: Security update for mpv
by opensuse-security＠opensuse.org 19 Feb '18

19 Feb '18

openSUSE Security Update: Security update for mpv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0479-1 Rating: moderate References: #1077894 Cross-References: CVE-2018-6360 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mpv fixes the following issues: MPV was updated to version 0.27.2 Security issues fixed: * CVE-2018-6360: Additional fix for where mpv allowed remote attackers to execute arbitrary code via a crafted web site, because it read HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL. (boo#1077894) Fixes and minor enhancements: * ytdl_hook: whitelist subtitle URLs as well (#5456) MPV was updated to version 0.27.1 Security issues fixed: * CVE-2018-6360: mpv allowed remote attackers to execute arbitrary code via a crafted web site, because it read HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL. (boo#1077894) Fixes and minor enhancements: * ytdl_hook: whitelist protocols from urls retrieved from youtube-dl (#5456) Version 0.27.0: Added features: * libmpv: options: add a thread-safe way to notify option updates * vd_lavc/vo_opengl: support embedded ICC profiles * vo: rendering API abstraction for future non-GL video outputs * vo_opengl: add a gamut warning feature to highlight out-of-gamut colors (--gamut-warning) * vo_opengl: add direct rendering support (--vd-lavc-dr) * vo_opengl: implement (faster) compute shader based EWA kernel * vo_opengl: implement HLG OOTF inverse * vo_opengl: support HDR peak detection (--hdr-compute-peak) * vo_opengl: support float input pixel formats * vo_opengl: support loading custom user textures (#4586) * vo_opengl: support user compute shaders Removed features: * Remove video equalizer handling from vo_direct3d, vo_sdl, vo_vaapi, and vo_xv (GPL, not worth the effort to support legacy VOs) Added options and commands: * player: add --track-auto-selection option Changed options and commands: * input: use mnemonic names for mouse buttons, same as Qt: https://doc.qt.io/qt-5/qt.html#MouseButton-enum * options: change --loop semantics * player: make --lavfi-complex changeable at runtime * vf_eq: remove this filter (GPL; uses libavfilter’s eq filter now, with changed semantics) * video: change --deinterlace behavior * vo_opengl: generalize HDR tone mapping to gamut mapping, --hdr-tone-mapping → --tone-mapping Removed options and commands: * --field-dominance (GPL-only author, no chance of relicensing) * input: drop deprecated "osd" command * options: drop --video-aspect-method=hybrid (GPL-only) Fixes and minor enhancements: * TOOLS/autocrop.lua: fix cropdetect black limit for 10-bit videos * TOOLS/lua/autodeint: update to lavfi-bridge * TOOLS/lua/status-line: improve and update * af_lavrresample: don't call swr_set_compensation() unless necessary (#4716) * ao_oss: fix period_size calculation (#4642) * ao_rsound: allow setting the host * audio: fix spdif mode * filter_kernels: correct spline64 kernel * options: fix --include (#4673) * player: fix --end with large values (#4650) * player: fix confusion in audio resync code (#4688) * player: make refresh seeks slightly more robust (#4757) * player: readd smi subtitle extension (#4626) * vd_lavc: change auto-probe order to prefer cuda over vdpau-copy * vd_lavc: fix device leak with copy-mode hwaccels (#4735) * vd_lavc: fix hwdec compatibility with yuvj420p formats * vd_lavc: fix mid-stream hwdec fallback * vf_vapoursynth: fix inverted sign and restore 10 bit support (#4720) * video: increase --monitorpixelaspect range * vo_opengl: adjust the rules for linearization (#4631) * vo_opengl: scale deband-grain to the signal range * vo_opengl: tone map on the maximum signal component * x11: fix that window could be resized when using embedding (#4784) * ytdl_hook: resolve relative paths when joining segment urls (#4827) * ytdl_hook: support fragments with relative paths, fixes segmented DASH Version 0.26.0: * Built-in V4L TV support is disabled by default. av://v4l2 can be used instead. * Support for C plugins is now enabled by default (#4491). * Many more parts of the player are now licensed under LGPL, see Copyright file. Added features: * csputils: implement sony s-gamut * vo_opengl: add new HDR tone mapping algorithm (mobius, now default) * vo_opengl: hwdec_cuda: Support separate decode and display devices * vo_opengl: implement sony s-log1 and s-log2 trc * vo_opengl: implement support for OOTFs and non-display referred content Removed features: * vf_dlopen: remove this filter Added options and commands: * vo_opengl: add --tone-mapping-desaturate * vo_opengl: support tone-mapping-param for `clip` * ytdl_hook: add option to exclude URLs from being parsed Changed options and commands: * allow setting profile option with libmpv * audio: move replaygain control to top-level options * external_files: parse ~ in --{sub,audio}-paths * options: change --sub-fix-timing default to no (#4484) * options: expose string list actions for --sub-file option * options: slight cleanup of --sub-ass-style-override + signfs → scale + --sub-ass-style-override → --sub-ass-override * renamed the HDR TRCs `st2084` and `std-b67` to `pq` and `hlg` respectively * replace vf_format's `peak` suboption by `sig-peak`, which is relative to the reference white level instead of in cd/m^2 * the following options change to append-by-default (and possibly separator): --script * video: change --video-aspect-method default value to `container` Deprecated options and commands: * m_option: deprecate multiple items for -add etc. * player: deprecate "osd" command * --audio-file-paths => --audio-file-path * --sub-paths => --sub-file-path * --opengl-shaders => --opengl-shader * --sub-paths => --sub-file-paths * the following options are deprecated for setting via API: + "script" (use "scripts") + "sub-file" (use "sub-files") + "audio-file" (use "audio-files") + "external-file" (use "external-files") (the compatibility hacks for this will be removed after this release) Removed options and commands: * chmap: remove misleading "downmix" channel layout name (#4545) * demux_lavf: remove --demuxer-lavf-cryptokey option (#4579) * input.conf: drop TV/DVB bindings * options: remove remaining deprecated audio device selection options + --alsa-device + --oss-device + --coreaudio-exclusive + --pulse-sink + --rsound-host/--rsound-port + --ao-sndio-device + --ao-wasapi-exclusive + --ao-wasapi-device * remove option --target-brightness * remove property "video-params/nom-peak" Fixes and minor enhancements: * TOOLS/lua/autoload.lua: actually sort files case insensitive (#4398) * TOOLS/lua/autoload.lua: ignores all files starting with "." * ao_pulse: reorder format choice to prefer float and S32 over S16 as fallback format * command: add missing change notification for playlist-shuffle (#4573) * demux_disc: fix bluray subtitle language retrieval (#4611) * demux_mkv: fix alpha with vp9 + libvpx * demux_mkv: support FFmpeg A_MS/ACM extensions * ipc-unix: don’t truncate the message on EAGAIN (#4452) * ipc: raise json nesting limit (#4394) * mpv_identify: replace deprecated fps property (#4550) * options/path: fallback to USERPROFILE if HOME isn't set * player: close audio device on no audio track * player: fix potential segfault when playing dvd:// with DVD disabled (#4393) * player: prevent seek position to jump around adjacent keyframes, e.g. when dragging the OSC bar on short videos (#4183) * vo_opengl: bump up SHADER_MAX_HOOKS and MAX_TEXTURE_HOOKS to 64 * vo_opengl: correct off-by-one in scale=oversample * vo_opengl: do not use vaapi-over-GLX (#4555) * vo_opengl: fall back to ordered dither instead of blowing up (#4519) * vo_opengl: tone map in linear XYZ instead of RGB * x11: add 128x128 sized icon support * ytdl_hook: add a header to support geo-bypass * ytdl_hook: don't override start time set by saved state * ytdl_hook: don't override user-set start time * ytdl_hook: treat single-entry playlists as a single video * gen: make output reproducible by ensuring stable output of pairs() by wrapping it where it matters. (Closes #18) version 3.3.15 * Fix af/vf filter argument expansion (#15) * Remove some invalid suggestions for some options (#14) * Recognize all --profile-style options as such and complete them version 3.3.14 * Reflect changed --list-options output for --vf-add-style options - Let mpv own /etc/mpv/scripts as a ghost dir so other packages can create it and install scripts there. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-173=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): libmpv1-0.27.2-13.5.1 libmpv1-debuginfo-0.27.2-13.5.1 mpv-0.27.2-13.5.1 mpv-debuginfo-0.27.2-13.5.1 mpv-devel-0.27.2-13.5.1 - openSUSE Leap 42.3 (noarch): mpv-bash-completion-3.3.16-13.5.1 mpv-zsh-completion-0.27.2-13.5.1 References: https://www.suse.com/security/cve/CVE-2018-6360.html https://bugzilla.suse.com/1077894

1 0

openSUSE-RU-2018:0478-1: important: Recommended update for ucode-intel
by maintenance＠opensuse.org 19 Feb '18

19 Feb '18

openSUSE Recommended Update: Recommended update for ucode-intel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0478-1 Rating: important References: #1074919 #1079890 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for ucode-intel fixes the following issues: - This reverts the ucode-intel package back to the 20170707 release. The version is 20180108.revertto20170707 to make sure it is installed on affected systems. (boo#1079890 boo#1074919) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-178=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ucode-intel-20180108.revertto20170707-19.1 ucode-intel-blob-20180108.revertto20170707-19.1 ucode-intel-debuginfo-20180108.revertto20170707-19.1 ucode-intel-debugsource-20180108.revertto20170707-19.1 References: https://bugzilla.suse.com/1074919 https://bugzilla.suse.com/1079890

1 0

openSUSE-SU-2018:0477-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 19 Feb '18

19 Feb '18

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0477-1 Rating: moderate References: #1081238 Cross-References: CVE-2018-7050 CVE-2018-7051 CVE-2018-7052 CVE-2018-7053 CVE-2018-7054 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for irssi fixes the following security issues: - CVE-2018-7054: Use after free when server is disconnected during netsplits - CVE-2018-7053: Use after free when SASL messages are received in unexpected order - CVE-2018-7050: Null pointer dereference when an "empty" nick has been observed - CVE-2018-7052: When the number of windows exceed the available space, Irssi would crash due to Null pointer dereference - CVE-2018-7051: Certain nick names could result in out of bounds access when printing theme strings Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-171=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): irssi-1.1.1-43.1 irssi-debuginfo-1.1.1-43.1 irssi-debugsource-1.1.1-43.1 irssi-devel-1.1.1-43.1 References: https://www.suse.com/security/cve/CVE-2018-7050.html https://www.suse.com/security/cve/CVE-2018-7051.html https://www.suse.com/security/cve/CVE-2018-7052.html https://www.suse.com/security/cve/CVE-2018-7053.html https://www.suse.com/security/cve/CVE-2018-7054.html https://bugzilla.suse.com/1081238

1 0

openSUSE-SU-2018:0476-1: moderate: Security update for ffmpeg
by opensuse-security＠opensuse.org 19 Feb '18

19 Feb '18

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0476-1 Rating: moderate References: #1064577 #1066428 #1069407 #1070762 #1072366 #1078488 #1079368 Cross-References: CVE-2017-15186 CVE-2017-15672 CVE-2017-16840 CVE-2017-17081 CVE-2017-17555 CVE-2018-6392 CVE-2018-6621 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for ffmpeg fixes the following issues: Updated ffmpeg to new bugfix release 3.4.2 * Fix integer overflows, multiplication overflows, undefined shifts, and verify buffer lengths. * avfilter/vf_transpose: Fix used plane count [boo#1078488, CVE-2018-6392] * avcodec/utvideodec: Fix bytes left check in decode_frame() [boo#1079368, CVE-2018-6621] - Enable use of libzvbi for displaying teletext subtitles. - Fixed a DoS in swri_audio_convert() [boo#1072366, CVE-2017-17555]. Update to new bugfix release 3.4.1 * Fixed integer overflows, division by zero, illegal bit shifts * Fixed the gmc_mmx function which failed to validate width and height [boo#1070762, CVE-2017-17081] * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840] * ffplay: use SDL2 audio API - install also doc/ffserver.conf - Update to new upstream release 3.4 * New video filters: deflicker, doublewave, lumakey, pixscope, oscilloscope, robterts, limiter, libvmaf, unpremultiply, tlut2, floodifll, pseudocolor, despill, convolve, vmafmotion. * New audio filters: afir, crossfeed, surround, headphone, superequalizer, haas. * Some video filters with several inputs now use a common set of options: blend, libvmaf, lut3d, overlay, psnr, ssim. They must always be used by name. * librsvg support for svg rasterization * spec-compliant VP9 muxing support in MP4 * Remove the libnut and libschroedinger muxer/demuxer wrappers * drop deprecated qtkit input device (use avfoundation instead) * SUP/PGS subtitle muxer * VP9 tile threading support * KMS screen grabber * CUDA thumbnail filter * V4L2 mem2mem HW assisted codecs * Rockchip MPP hardware decoding * (Not in openSUSE builds, only original ones:) * Gremlin Digital Video demuxer and decoder * Additional frame format support for Interplay MVE movies * Dolby E decoder and SMPTE 337M demuxer * raw G.726 muxer and demuxer, left- and right-justified * NewTek NDI input/output device * FITS demuxer, muxer, decoder and encoder - Fixed a double free in huffyuv [boo#1064577, CVE-2017-15186] - Fixed an out-of-bounds in ffv1dec [boo#1066428, CVE-2017-15672] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-172=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): ffmpeg-3.4.2-10.1 ffmpeg-debuginfo-3.4.2-10.1 ffmpeg-debugsource-3.4.2-10.1 libavcodec-devel-3.4.2-10.1 libavcodec57-3.4.2-10.1 libavcodec57-debuginfo-3.4.2-10.1 libavdevice-devel-3.4.2-10.1 libavdevice57-3.4.2-10.1 libavdevice57-debuginfo-3.4.2-10.1 libavfilter-devel-3.4.2-10.1 libavfilter6-3.4.2-10.1 libavfilter6-debuginfo-3.4.2-10.1 libavformat-devel-3.4.2-10.1 libavformat57-3.4.2-10.1 libavformat57-debuginfo-3.4.2-10.1 libavresample-devel-3.4.2-10.1 libavresample3-3.4.2-10.1 libavresample3-debuginfo-3.4.2-10.1 libavutil-devel-3.4.2-10.1 libavutil55-3.4.2-10.1 libavutil55-debuginfo-3.4.2-10.1 libpostproc-devel-3.4.2-10.1 libpostproc54-3.4.2-10.1 libpostproc54-debuginfo-3.4.2-10.1 libswresample-devel-3.4.2-10.1 libswresample2-3.4.2-10.1 libswresample2-debuginfo-3.4.2-10.1 libswscale-devel-3.4.2-10.1 libswscale4-3.4.2-10.1 libswscale4-debuginfo-3.4.2-10.1 - openSUSE Leap 42.3 (x86_64): libavcodec57-32bit-3.4.2-10.1 libavcodec57-debuginfo-32bit-3.4.2-10.1 libavdevice57-32bit-3.4.2-10.1 libavdevice57-debuginfo-32bit-3.4.2-10.1 libavfilter6-32bit-3.4.2-10.1 libavfilter6-debuginfo-32bit-3.4.2-10.1 libavformat57-32bit-3.4.2-10.1 libavformat57-debuginfo-32bit-3.4.2-10.1 libavresample3-32bit-3.4.2-10.1 libavresample3-debuginfo-32bit-3.4.2-10.1 libavutil55-32bit-3.4.2-10.1 libavutil55-debuginfo-32bit-3.4.2-10.1 libpostproc54-32bit-3.4.2-10.1 libpostproc54-debuginfo-32bit-3.4.2-10.1 libswresample2-32bit-3.4.2-10.1 libswresample2-debuginfo-32bit-3.4.2-10.1 libswscale4-32bit-3.4.2-10.1 libswscale4-debuginfo-32bit-3.4.2-10.1 References: https://www.suse.com/security/cve/CVE-2017-15186.html https://www.suse.com/security/cve/CVE-2017-15672.html https://www.suse.com/security/cve/CVE-2017-16840.html https://www.suse.com/security/cve/CVE-2017-17081.html https://www.suse.com/security/cve/CVE-2017-17555.html https://www.suse.com/security/cve/CVE-2018-6392.html https://www.suse.com/security/cve/CVE-2018-6621.html https://bugzilla.suse.com/1064577 https://bugzilla.suse.com/1066428 https://bugzilla.suse.com/1069407 https://bugzilla.suse.com/1070762 https://bugzilla.suse.com/1072366 https://bugzilla.suse.com/1078488 https://bugzilla.suse.com/1079368

1 0

openSUSE-SU-2018:0475-1: moderate: Security update for irssi
by opensuse-security＠opensuse.org 19 Feb '18

19 Feb '18

openSUSE Security Update: Security update for irssi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0475-1 Rating: moderate References: #1081238 Cross-References: CVE-2018-7050 CVE-2018-7051 CVE-2018-7052 CVE-2018-7053 CVE-2018-7054 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for irssi fixes the following security issues: - CVE-2018-7054: Use after free when server is disconnected during netsplits - CVE-2018-7053: Use after free when SASL messages are received in unexpected order - CVE-2018-7050: Null pointer dereference when an "empty" nick has been observed - CVE-2018-7052: When the number of windows exceed the available space, Irssi would crash due to Null pointer dereference - CVE-2018-7051: Certain nick names could result in out of bounds access when printing theme strings Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-171=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): irssi-1.0.7-25.1 irssi-debuginfo-1.0.7-25.1 irssi-debugsource-1.0.7-25.1 irssi-devel-1.0.7-25.1 References: https://www.suse.com/security/cve/CVE-2018-7050.html https://www.suse.com/security/cve/CVE-2018-7051.html https://www.suse.com/security/cve/CVE-2018-7052.html https://www.suse.com/security/cve/CVE-2018-7053.html https://www.suse.com/security/cve/CVE-2018-7054.html https://bugzilla.suse.com/1081238

1 0