June 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:1705-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1705-1 Rating: moderate References: #1088888 #1091371 #1092161 #1092373 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for salt fixes the following issues: - Updates the documentation to 2018.3.0 - No more AWS EC2 rate limitations in salt-cloud (bsc#1088888) - MySQL returner now also allows to use Unix sockets (bsc#1091371) - Do not override jid on returners, only sending back to master (bsc#1092373) - salt-ssh: * Bugfix: Option --extra-filerefs doesn't add all files to the state archive * Pillar completely overwritten (not merged) when doing module.run + state.apply with pillar in kwargs - Remove minion/thin/version if exists to force thin regeneration (bsc#1092161) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-634=1 Package List: - openSUSE Leap 15.0 (noarch): salt-bash-completion-2018.3.0-lp150.3.3.1 salt-fish-completion-2018.3.0-lp150.3.3.1 salt-zsh-completion-2018.3.0-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): python2-salt-2018.3.0-lp150.3.3.1 python3-salt-2018.3.0-lp150.3.3.1 salt-2018.3.0-lp150.3.3.1 salt-api-2018.3.0-lp150.3.3.1 salt-cloud-2018.3.0-lp150.3.3.1 salt-doc-2018.3.0-lp150.3.3.1 salt-master-2018.3.0-lp150.3.3.1 salt-minion-2018.3.0-lp150.3.3.1 salt-proxy-2018.3.0-lp150.3.3.1 salt-ssh-2018.3.0-lp150.3.3.1 salt-syndic-2018.3.0-lp150.3.3.1 References: https://bugzilla.suse.com/1088888 https://bugzilla.suse.com/1091371 https://bugzilla.suse.com/1092161 https://bugzilla.suse.com/1092373

1 0

openSUSE-RU-2018:1704-1: Recommended update for spyder3
by maintenance＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Recommended Update: Recommended update for spyder3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1704-1 Rating: low References: #1095587 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spyder3 fixes the following issues: - spyder3 did not declare the run-time dependency on python3-cloudpickle correctly (boo#1095587) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-632=1 Package List: - openSUSE Leap 15.0 (noarch): spyder3-3.2.8-lp150.2.3.1 spyder3-breakpoints-3.2.8-lp150.2.3.1 spyder3-breakpoints-lang-3.2.8-lp150.2.3.1 spyder3-dicom-3.2.8-lp150.2.3.1 spyder3-doc-3.2.8-lp150.2.3.1 spyder3-hdf5-3.2.8-lp150.2.3.1 spyder3-lang-3.2.8-lp150.2.3.1 spyder3-profiler-3.2.8-lp150.2.3.1 spyder3-profiler-lang-3.2.8-lp150.2.3.1 spyder3-pylint-3.2.8-lp150.2.3.1 spyder3-pylint-lang-3.2.8-lp150.2.3.1 References: https://bugzilla.suse.com/1095587

1 0

openSUSE-RU-2018:1703-1: moderate: Recommended update for yast2-nfs-client
by maintenance＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Recommended Update: Recommended update for yast2-nfs-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1703-1 Rating: moderate References: #1064437 #429326 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-nfs-client fixes the following issues: - Fixed a regression that was preventing some strings to be translated. - Do not crash when 'edit' button is pressed in the partitioner if there are no NFS entries (affects installation, part of fate#318196). - When executed standalone (not embedded in the Partitioner), use storage-ng to read and write /etc/fstab, instead of the old buggy parser (boo#429326, bsc#1064437). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-635=1 Package List: - openSUSE Leap 15.0 (noarch): yast2-nfs-client-4.0.6-lp150.2.3.1 References: https://bugzilla.suse.com/1064437 https://bugzilla.suse.com/429326

1 0

openSUSE-RU-2018:1702-1: moderate: Recommended update for python-kiwi
by maintenance＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Recommended Update: Recommended update for python-kiwi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1702-1 Rating: moderate References: #1087104 #1094883 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for python-kiwi fixes the following issues: - Adding 'additionaltags' containerconfig attribute to support multiple tags for containers - Bugfix: Does no longer delete uncompressed base docker images - Bugfix: Does no longer create static dev nodes in root init (bsc#1087104) - Bugfix: Adds the initrd-root-fs.target service dependency to auto generated sysroot.mount for kiwi-live and kiwi-overlay dracut modules. - Adds a verification to check that the target file doesn't exist before creating a symlink - Adds a documentation for config-cdroot archive - Bugfix: Fix setup of LOADER_TYPE in sysconfig/bootloader (bsc#1094883) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-633=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): dracut-kiwi-lib-9.15.3-lp150.2.6.1 dracut-kiwi-live-9.15.3-lp150.2.6.1 dracut-kiwi-oem-dump-9.15.3-lp150.2.6.1 dracut-kiwi-oem-repart-9.15.3-lp150.2.6.1 dracut-kiwi-overlay-9.15.3-lp150.2.6.1 kiwi-man-pages-9.15.3-lp150.2.6.1 kiwi-pxeboot-9.15.3-lp150.2.6.1 kiwi-tools-9.15.3-lp150.2.6.1 kiwi-tools-debuginfo-9.15.3-lp150.2.6.1 python-kiwi-debugsource-9.15.3-lp150.2.6.1 python2-kiwi-9.15.3-lp150.2.6.1 python3-kiwi-9.15.3-lp150.2.6.1 References: https://bugzilla.suse.com/1087104 https://bugzilla.suse.com/1094883

1 0

openSUSE-RU-2018:1701-1: moderate: Recommended update for installation-images
by maintenance＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Recommended Update: Recommended update for installation-images ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1701-1 Rating: moderate References: Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for installation-images fixes the following issues: - The installer dit not detext an existing ReiserFS system (fate#323394) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-631=1 Package List: - openSUSE Leap 15.0 (x86_64): install-initrd-openSUSE-14.373-lp150.2.3.2 installation-images-debuginfodeps-openSUSE-14.373-lp150.2.3.2 skelcd-installer-net-openSUSE-14.373-lp150.2.3.2 skelcd-installer-openSUSE-14.373-lp150.2.3.2 - openSUSE Leap 15.0 (noarch): tftpboot-installation-openSUSE-Leap-15.0-x86_64-14.373-lp150.2.3.2 References:

1 0

openSUSE-SU-2018:1697-1: moderate: Security update for opencv
by opensuse-security＠opensuse.org 15 Jun '18

15 Jun '18

openSUSE Security Update: Security update for opencv ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1697-1 Rating: moderate References: #1074312 Cross-References: CVE-2017-18009 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opencv fixes this security issue: - CVE-2017-18009: Prevent heap-based buffer over-read in the function cv::HdrDecoder::checkSignature (bsc#1074312). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-629=1 Package List: - openSUSE Leap 15.0 (x86_64): libopencv3_3-3.3.1-lp150.4.3.1 libopencv3_3-debuginfo-3.3.1-lp150.4.3.1 opencv-3.3.1-lp150.4.3.1 opencv-debuginfo-3.3.1-lp150.4.3.1 opencv-debugsource-3.3.1-lp150.4.3.1 opencv-devel-3.3.1-lp150.4.3.1 opencv-doc-3.3.1-lp150.4.3.1 python2-opencv-3.3.1-lp150.4.3.1 python2-opencv-debuginfo-3.3.1-lp150.4.3.1 python3-opencv-3.3.1-lp150.4.3.1 python3-opencv-debuginfo-3.3.1-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2017-18009.html https://bugzilla.suse.com/1074312

1 0

openSUSE-SU-2018:1689-1: moderate: Security update for bouncycastle
by opensuse-security＠opensuse.org 14 Jun '18

14 Jun '18

openSUSE Security Update: Security update for bouncycastle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1689-1 Rating: moderate References: #1072697 #1095722 #1095849 #1095850 #1095852 #1095853 #1095854 #1096022 #1096024 #1096025 #1096026 Cross-References: CVE-2016-1000338 CVE-2016-1000339 CVE-2016-1000340 CVE-2016-1000341 CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000344 CVE-2016-1000345 CVE-2016-1000346 CVE-2016-1000352 CVE-2017-13098 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for bouncycastle to version 1.59 fixes the following issues: These security issues were fixed: - CVE-2017-13098: BouncyCastle, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provided a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange was negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT" (bsc#1072697). - CVE-2016-1000338: Ensure full validation of ASN.1 encoding of signature on verification. It was possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may have allowed the introduction of 'invisible' data into a signed structure (bsc#1095722). - CVE-2016-1000339: Prevent AESEngine key information leak via lookup table accesses (boo#1095853). - CVE-2016-1000340: Preventcarry propagation bugs in the implementation of squaring for several raw math classes (boo#1095854). - CVE-2016-1000341: Fix DSA signature generation vulnerability to timing attack (boo#1095852). - CVE-2016-1000341: DSA signature generation was vulnerable to timing attack. Where timings can be closely observed for the generation of signatures may have allowed an attacker to gain information about the signature's k value and ultimately the private value as well (bsc#1095852). - CVE-2016-1000342: Ensure that ECDSA does fully validate ASN.1 encoding of signature on verification. It was possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may have allowed the introduction of 'invisible' data into a signed structure (bsc#1095850). - CVE-2016-1000343: Prevent weak default settings for private DSA key pair generation (boo#1095849). - CVE-2016-1000344: Removed DHIES from the provider to disable the unsafe usage of ECB mode (boo#1096026). - CVE-2016-1000345: The DHIES/ECIES CBC mode was vulnerable to padding oracle attack. In an environment where timings can be easily observed, it was possible with enough observations to identify when the decryption is failing due to padding (bsc#1096025). - CVE-2016-1000346: The other party DH public key was not fully validated. This could have caused issues as invalid keys could be used to reveal details about the other party's private key where static Diffie-Hellman is in use (bsc#1096024). - CVE-2016-1000352: Remove ECIES from the provider to disable the unsafe usage of ECB mode (boo#1096022). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-628=1 Package List: - openSUSE Leap 42.3 (noarch): bouncycastle-1.59-23.3.1 bouncycastle-javadoc-1.59-23.3.1 References: https://www.suse.com/security/cve/CVE-2016-1000338.html https://www.suse.com/security/cve/CVE-2016-1000339.html https://www.suse.com/security/cve/CVE-2016-1000340.html https://www.suse.com/security/cve/CVE-2016-1000341.html https://www.suse.com/security/cve/CVE-2016-1000342.html https://www.suse.com/security/cve/CVE-2016-1000343.html https://www.suse.com/security/cve/CVE-2016-1000344.html https://www.suse.com/security/cve/CVE-2016-1000345.html https://www.suse.com/security/cve/CVE-2016-1000346.html https://www.suse.com/security/cve/CVE-2016-1000352.html https://www.suse.com/security/cve/CVE-2017-13098.html https://bugzilla.suse.com/1072697 https://bugzilla.suse.com/1095722 https://bugzilla.suse.com/1095849 https://bugzilla.suse.com/1095850 https://bugzilla.suse.com/1095852 https://bugzilla.suse.com/1095853 https://bugzilla.suse.com/1095854 https://bugzilla.suse.com/1096022 https://bugzilla.suse.com/1096024 https://bugzilla.suse.com/1096025 https://bugzilla.suse.com/1096026

1 0

openSUSE-SU-2018:1686-1: Security update for taglib
by opensuse-security＠opensuse.org 13 Jun '18

13 Jun '18

openSUSE Security Update: Security update for taglib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1686-1 Rating: low References: #1096180 Cross-References: CVE-2018-11439 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for taglib fixes this security issues: - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file (bsc#1096180). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-627=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-627=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libtag-devel-1.11-8.1 libtag1-1.11-8.1 libtag1-debuginfo-1.11-8.1 libtag_c0-1.11-8.1 libtag_c0-debuginfo-1.11-8.1 taglib-1.11-8.1 taglib-debuginfo-1.11-8.1 taglib-debugsource-1.11-8.1 - openSUSE Leap 42.3 (x86_64): libtag1-32bit-1.11-8.1 libtag1-debuginfo-32bit-1.11-8.1 libtag_c0-32bit-1.11-8.1 libtag_c0-debuginfo-32bit-1.11-8.1 - openSUSE Leap 15.0 (i586 x86_64): libtag-devel-1.11.1-lp150.3.3.1 libtag1-1.11.1-lp150.3.3.1 libtag1-debuginfo-1.11.1-lp150.3.3.1 libtag_c0-1.11.1-lp150.3.3.1 libtag_c0-debuginfo-1.11.1-lp150.3.3.1 taglib-1.11.1-lp150.3.3.1 taglib-debuginfo-1.11.1-lp150.3.3.1 taglib-debugsource-1.11.1-lp150.3.3.1 - openSUSE Leap 15.0 (x86_64): libtag1-32bit-1.11.1-lp150.3.3.1 libtag1-32bit-debuginfo-1.11.1-lp150.3.3.1 libtag_c0-32bit-1.11.1-lp150.3.3.1 libtag_c0-32bit-debuginfo-1.11.1-lp150.3.3.1 References: https://www.suse.com/security/cve/CVE-2018-11439.html https://bugzilla.suse.com/1096180

1 0

openSUSE-RU-2018:1685-1: moderate: Recommended update for yast2-packager
by maintenance＠opensuse.org 12 Jun '18

12 Jun '18

openSUSE Recommended Update: Recommended update for yast2-packager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1685-1 Rating: moderate References: #1080450 #1093060 #1094793 #1095053 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for yast2-packager fixes the following issues: - When running the installation in textmode, consider only the preselected language when showing the license for extensions, modules or add-ons (boo#1094793). - During an upgrade, skip the base produce license dialog when the same license was already accepted (boo#1080450) - Renaming of SLES_HPC to SLE_HPC (boo#1095053) - Display an error popup when the FIPS compliant mode is active and the "fips" pattern is not available (boo#1093060) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-622=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): yast2-packager-4.0.67-lp150.2.6.2 References: https://bugzilla.suse.com/1080450 https://bugzilla.suse.com/1093060 https://bugzilla.suse.com/1094793 https://bugzilla.suse.com/1095053

1 0

openSUSE-RU-2018:1684-1: moderate: Recommended update for guix
by maintenance＠opensuse.org 12 Jun '18

12 Jun '18

openSUSE Recommended Update: Recommended update for guix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:1684-1 Rating: moderate References: #1095970 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for guix fixes the following issues: - Bugfix: package fetching via https was not possible (boo#1095970) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-604=1 Package List: - openSUSE Leap 15.0 (x86_64): guix-0.14.0-lp150.2.3.1 guix-debuginfo-0.14.0-lp150.2.3.1 guix-debugsource-0.14.0-lp150.2.3.1 References: https://bugzilla.suse.com/1095970

1 0