April 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2018:0966-1: moderate: Security update for python3
by opensuse-security＠opensuse.org 17 Apr '18

17 Apr '18

openSUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0966-1 Rating: moderate References: #1083507 Cross-References: CVE-2017-18207 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python3 fixes the following issues: Security issue fixed: - CVE-2017-18207: Fixed possible denial of service vulnerability by adding a check to Lib/wave.py that verifies that at least one channel is provided (bsc#1083507). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-372=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libpython3_4m1_0-3.4.6-12.3.1 libpython3_4m1_0-debuginfo-3.4.6-12.3.1 python3-3.4.6-12.3.1 python3-base-3.4.6-12.3.1 python3-base-debuginfo-3.4.6-12.3.1 python3-base-debugsource-3.4.6-12.3.1 python3-curses-3.4.6-12.3.1 python3-curses-debuginfo-3.4.6-12.3.1 python3-dbm-3.4.6-12.3.1 python3-dbm-debuginfo-3.4.6-12.3.1 python3-debuginfo-3.4.6-12.3.1 python3-debugsource-3.4.6-12.3.1 python3-devel-3.4.6-12.3.1 python3-devel-debuginfo-3.4.6-12.3.1 python3-idle-3.4.6-12.3.1 python3-testsuite-3.4.6-12.3.1 python3-testsuite-debuginfo-3.4.6-12.3.1 python3-tk-3.4.6-12.3.1 python3-tk-debuginfo-3.4.6-12.3.1 python3-tools-3.4.6-12.3.1 - openSUSE Leap 42.3 (x86_64): libpython3_4m1_0-32bit-3.4.6-12.3.1 libpython3_4m1_0-debuginfo-32bit-3.4.6-12.3.1 python3-32bit-3.4.6-12.3.1 python3-base-32bit-3.4.6-12.3.1 python3-base-debuginfo-32bit-3.4.6-12.3.1 python3-debuginfo-32bit-3.4.6-12.3.1 - openSUSE Leap 42.3 (noarch): python3-doc-3.4.6-12.3.2 python3-doc-pdf-3.4.6-12.3.2 References: https://www.suse.com/security/cve/CVE-2017-18207.html https://bugzilla.suse.com/1083507

1 0

openSUSE-SU-2018:0965-1: moderate: Security update for python-gunicorn, python3-gunicorn
by opensuse-security＠opensuse.org 17 Apr '18

17 Apr '18

openSUSE Security Update: Security update for python-gunicorn, python3-gunicorn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0965-1 Rating: moderate References: #1088613 Cross-References: CVE-2018-1000164 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-gunicorn, python3-gunicorn fixes the following issues: - CVE-2018-1000164: Improper neutralization of CRLF Sequences allow tricking the server to return arbitrary HTTP headers (boo#1088613) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-369=1 Package List: - openSUSE Leap 42.3 (noarch): python-gunicorn-19.3.0-4.3.1 python-gunicorn-doc-19.3.0-4.3.1 python3-gunicorn-19.3.0-5.3.1 python3-gunicorn-doc-19.3.0-5.3.1 References: https://www.suse.com/security/cve/CVE-2018-1000164.html https://bugzilla.suse.com/1088613

1 0

openSUSE-RU-2018:0964-1: moderate: Recommended update for ddccontrol
by maintenance＠opensuse.org 17 Apr '18

17 Apr '18

openSUSE Recommended Update: Recommended update for ddccontrol ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0964-1 Rating: moderate References: #1088935 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ddccontrol fixes the following issues: - boo#1088935: An invalid udev rule prevented i2c-dev from being loaded Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-370=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): ddccontrol-0.4.2+20140105+git9d89d8c-2.3.1 ddccontrol-debuginfo-0.4.2+20140105+git9d89d8c-2.3.1 ddccontrol-debugsource-0.4.2+20140105+git9d89d8c-2.3.1 ddccontrol-devel-0.4.2+20140105+git9d89d8c-2.3.1 ddccontrol-gtk-0.4.2+20140105+git9d89d8c-2.3.1 ddccontrol-gtk-debuginfo-0.4.2+20140105+git9d89d8c-2.3.1 libddccontrol0-0.4.2+20140105+git9d89d8c-2.3.1 libddccontrol0-debuginfo-0.4.2+20140105+git9d89d8c-2.3.1 - openSUSE Leap 42.3 (noarch): ddccontrol-doc-0.4.2+20140105+git9d89d8c-2.3.1 ddccontrol-lang-0.4.2+20140105+git9d89d8c-2.3.1 References: https://bugzilla.suse.com/1088935

1 0

openSUSE-RU-2018:0963-1: Recommended update for tftp
by maintenance＠opensuse.org 17 Apr '18

17 Apr '18

openSUSE Recommended Update: Recommended update for tftp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0963-1 Rating: low References: #1064297 #1075543 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for tftp provides the following fixes: - Allow tftpd to be configured by sysconfig file. (bsc#1075543) - Fix starting tftpd via tftp.service file. (bsc#1064297) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-371=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): tftp-5.2-19.1 tftp-debuginfo-5.2-19.1 tftp-debugsource-5.2-19.1 References: https://bugzilla.suse.com/1064297 https://bugzilla.suse.com/1075543

1 0

openSUSE-RU-2018:0962-1: Recommended update for python-pyasn1, python3-pyasn1
by maintenance＠opensuse.org 17 Apr '18

17 Apr '18

openSUSE Recommended Update: Recommended update for python-pyasn1, python3-pyasn1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0962-1 Rating: low References: #1073879 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update unifies the pyasn1 module for Python 2 an 3 module to use common sources. For python3-pyasn, this updates the package to version 0.1.9, with a number of upstream improvements and fixes. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-368=1 Package List: - openSUSE Leap 42.3 (noarch): python-pyasn1-0.1.9-13.3.1 python3-pyasn1-0.1.9-13.3.1 References: https://bugzilla.suse.com/1073879

1 0

openSUSE-RU-2018:0961-1: Recommended update for freetds
by maintenance＠opensuse.org 16 Apr '18

16 Apr '18

openSUSE Recommended Update: Recommended update for freetds ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0961-1 Rating: low References: #1026910 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for freetds provides the following fix: - Add dependency on libtdsodbc0 in develpkg wrt (bsc#1026910) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-366=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): freetds-debugsource-0.91-16.3.1 freetds-devel-0.91-16.3.1 freetds-doc-0.91-16.3.1 freetds-tools-0.91-16.3.1 freetds-tools-debuginfo-0.91-16.3.1 libfreetds-0.91-16.3.1 libfreetds-debuginfo-0.91-16.3.1 libtdsodbc0-0.91-16.3.1 libtdsodbc0-debuginfo-0.91-16.3.1 References: https://bugzilla.suse.com/1026910

1 0

openSUSE-SU-2018:0960-1: moderate: Security update for evince
by opensuse-security＠opensuse.org 16 Apr '18

16 Apr '18

openSUSE Security Update: Security update for evince ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0960-1 Rating: moderate References: #1070046 Cross-References: CVE-2017-1000159 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for evince fixes the following issues: - CVE-2017-1000159: Command injection in evince via filename when printing to PDF could lead to command execution (bsc#1070046) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-367=1 Package List: - openSUSE Leap 42.3 (noarch): evince-lang-3.20.2-9.1 - openSUSE Leap 42.3 (x86_64): evince-3.20.2-9.1 evince-browser-plugin-3.20.2-9.1 evince-browser-plugin-debuginfo-3.20.2-9.1 evince-debuginfo-3.20.2-9.1 evince-debugsource-3.20.2-9.1 evince-devel-3.20.2-9.1 evince-plugin-comicsdocument-3.20.2-9.1 evince-plugin-comicsdocument-debuginfo-3.20.2-9.1 evince-plugin-djvudocument-3.20.2-9.1 evince-plugin-djvudocument-debuginfo-3.20.2-9.1 evince-plugin-dvidocument-3.20.2-9.1 evince-plugin-dvidocument-debuginfo-3.20.2-9.1 evince-plugin-pdfdocument-3.20.2-9.1 evince-plugin-pdfdocument-debuginfo-3.20.2-9.1 evince-plugin-psdocument-3.20.2-9.1 evince-plugin-psdocument-debuginfo-3.20.2-9.1 evince-plugin-tiffdocument-3.20.2-9.1 evince-plugin-tiffdocument-debuginfo-3.20.2-9.1 evince-plugin-xpsdocument-3.20.2-9.1 evince-plugin-xpsdocument-debuginfo-3.20.2-9.1 libevdocument3-4-3.20.2-9.1 libevdocument3-4-debuginfo-3.20.2-9.1 libevview3-3-3.20.2-9.1 libevview3-3-debuginfo-3.20.2-9.1 nautilus-evince-3.20.2-9.1 nautilus-evince-debuginfo-3.20.2-9.1 typelib-1_0-EvinceDocument-3_0-3.20.2-9.1 typelib-1_0-EvinceView-3_0-3.20.2-9.1 References: https://www.suse.com/security/cve/CVE-2017-1000159.html https://bugzilla.suse.com/1070046

1 0

openSUSE-RU-2018:0959-1: moderate: Recommended update for evolution-ews
by maintenance＠opensuse.org 16 Apr '18

16 Apr '18

openSUSE Recommended Update: Recommended update for evolution-ews ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:0959-1 Rating: moderate References: #1071254 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for evolution-ews provides the following fixes: - Fix a libsoup issue with evolution-ews. (bsc#1071254) - Fix a few memory leaks. - Autodiscover can cause deadlock in GCancellable code. - Runtime warnings when calling ResolveNames. - Do not restrict/remove From address on message send. - Customized timezones not recognized. - Always build ESExp structure as a GObject descendant. - Initialize connection variable to NULL in camel_ews_folder_get_message(). - Fix a memory leak when creating a contact. - Fix some issues found by Coverity Scan. - Ask for password after NTLM/SSO authentication failure. - Updated translations. This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-365=1 Package List: - openSUSE Leap 42.3 (x86_64): evolution-ews-3.22.6-4.3.1 evolution-ews-debuginfo-3.22.6-4.3.1 evolution-ews-debugsource-3.22.6-4.3.1 evolution-ews-devel-3.22.6-4.3.1 libeews-1_2-0-3.22.6-4.3.1 libeews-1_2-0-debuginfo-3.22.6-4.3.1 libewsutils0-3.22.6-4.3.1 libewsutils0-debuginfo-3.22.6-4.3.1 - openSUSE Leap 42.3 (noarch): evolution-ews-lang-3.22.6-4.3.1 References: https://bugzilla.suse.com/1071254

1 0

openSUSE-SU-2018:0953-1: moderate: Security update for pdns-recursor
by opensuse-security＠opensuse.org 16 Apr '18

16 Apr '18

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:0953-1 Rating: moderate References: #1069242 #1077154 Cross-References: CVE-2018-1000003 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for pdns-recursor fixes the following issues: - update to 4.1.2 - New Features - #6344: Add FFI version of gettag(). - Improvements - #6298, #6303, #6268, #6290: Add the option to set the AXFR timeout for RPZs. - #6172: IXFR: correct behavior of dealing with DNS Name with multiple records and speed up IXFR transaction (Leon Xu). - #6379: Add RPZ statistics endpoint to the API. - Bug Fixes - #6336, #6293, #6237: Retry loading RPZ zones from server when they fail initially. - #6300: Fix ECS-based cache entry refresh code. - #6320: Fix ECS-specific NS AAAA not being returned from the cache. - update to version 4.1.1: + Fixes security vulnerability where man-in-the-middle to send a NXDOMAIN answer for a DNSSEC name that does exist. (boo#1077154, CVE-2018-1000003) + Don't validate signature for "glue" CNAME, since anything else than the initial CNAME can’t be considered authoritative. - update to version 4.0.7: (boo#1069242) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-364=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-recursor-4.1.2-5.1 References: https://www.suse.com/security/cve/CVE-2018-1000003.html https://bugzilla.suse.com/1069242 https://bugzilla.suse.com/1077154

1 0

openSUSE-OU-2018:0942-1: Recommended update for pdns
by maintenance＠opensuse.org 13 Apr '18

13 Apr '18

openSUSE Optional Update: Recommended update for pdns ______________________________________________________________________________ Announcement ID: openSUSE-OU-2018:0942-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: This update for pdns fixes the following issues: - Update to version 4.1.1: bug-fix only release, with fixes to the LDAP and MySQL backends, the pdnsutil tool, and PDNS internals Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-363=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): pdns-4.1.1-5.1 pdns-backend-godbc-4.1.1-5.1 pdns-backend-ldap-4.1.1-5.1 pdns-backend-lua-4.1.1-5.1 pdns-backend-mydns-4.1.1-5.1 pdns-backend-mysql-4.1.1-5.1 pdns-backend-postgresql-4.1.1-5.1 pdns-backend-remote-4.1.1-5.1 pdns-backend-sqlite3-4.1.1-5.1 References:

1 0