August 2018 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2018:2435-1: Recommended update for powerline
by maintenance＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Recommended Update: Recommended update for powerline ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2435-1 Rating: low References: #1101303 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for powerline fixes the following issues: - powerline intitializaton was not working correctly in vim (boo#10101303) - add correct systemd service for powerline Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-913=1 Package List: - openSUSE Leap 15.0 (x86_64): powerline-2.6-lp150.3.3.1 powerline-debuginfo-2.6-lp150.3.3.1 powerline-debugsource-2.6-lp150.3.3.1 - openSUSE Leap 15.0 (noarch): powerline-docs-2.6-lp150.3.3.1 powerline-fonts-2.6-lp150.3.3.1 tmux-powerline-2.6-lp150.3.3.1 vim-plugin-powerline-2.6-lp150.3.3.1 References: https://bugzilla.suse.com/1101303

1 0

openSUSE-SU-2018:2434-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2434-1 Rating: important References: #1027519 #1091107 #1103276 Cross-References: CVE-2018-3646 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for xen fixes the following security issues: - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - Incorrect MSR_DEBUGCTL handling let guests enable BTS allowing a malicious or buggy guest administrator can lock up the entire host (bsc#1103276) This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-910=1 Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.2_10-28.1 xen-debugsource-4.9.2_10-28.1 xen-devel-4.9.2_10-28.1 xen-doc-html-4.9.2_10-28.1 xen-libs-4.9.2_10-28.1 xen-libs-debuginfo-4.9.2_10-28.1 xen-tools-4.9.2_10-28.1 xen-tools-debuginfo-4.9.2_10-28.1 xen-tools-domU-4.9.2_10-28.1 xen-tools-domU-debuginfo-4.9.2_10-28.1 References: https://www.suse.com/security/cve/CVE-2018-3646.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1091107 https://bugzilla.suse.com/1103276

1 0

openSUSE-SU-2018:2433-1: moderate: Security update for apache2
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2433-1 Rating: moderate References: #1101688 #1101689 Cross-References: CVE-2018-1333 CVE-2018-8011 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for apache2 fixes the following issues: The following security vulnerabilities were fixed: - CVE-2018-1333: Fixed a worker exhaustion that could have lead to a denial of service via specially crafted HTTP/2 requests (bsc#1101689). - CVE-2018-8011: Fixed a null pointer dereference in mod_md, which could have lead to a denial of service via specially crafted HTTP requests (bsc#1101688). Note: We are currently not shipping this modules, since it is still considered experimental, but we might start to ship it with future releases. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-907=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): apache2-2.4.33-lp150.2.3.1 apache2-debuginfo-2.4.33-lp150.2.3.1 apache2-debugsource-2.4.33-lp150.2.3.1 apache2-devel-2.4.33-lp150.2.3.1 apache2-event-2.4.33-lp150.2.3.1 apache2-event-debuginfo-2.4.33-lp150.2.3.1 apache2-example-pages-2.4.33-lp150.2.3.1 apache2-prefork-2.4.33-lp150.2.3.1 apache2-prefork-debuginfo-2.4.33-lp150.2.3.1 apache2-utils-2.4.33-lp150.2.3.1 apache2-utils-debuginfo-2.4.33-lp150.2.3.1 apache2-worker-2.4.33-lp150.2.3.1 apache2-worker-debuginfo-2.4.33-lp150.2.3.1 - openSUSE Leap 15.0 (noarch): apache2-doc-2.4.33-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-1333.html https://www.suse.com/security/cve/CVE-2018-8011.html https://bugzilla.suse.com/1101688 https://bugzilla.suse.com/1101689

1 0

openSUSE-RU-2018:2432-1: moderate: Recommended update for linphoneqt
by maintenance＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Recommended Update: Recommended update for linphoneqt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2432-1 Rating: moderate References: #1095273 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for linphoneqt fixes the following issues: - some UI elements (buttons, tabs) did not render correctly (boo#1095273) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-905=1 Package List: - openSUSE Leap 15.0 (x86_64): linphone-4.1.1-lp150.3.5.1 linphone-debuginfo-4.1.1-lp150.3.5.1 linphoneqt-debugsource-4.1.1-lp150.3.5.1 References: https://bugzilla.suse.com/1095273

1 0

openSUSE-SU-2018:2431-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2431-1 Rating: moderate References: #1099793 Cross-References: CVE-2018-0500 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: Security issue fixed: - CVE-2018-0500: Fix a SMTP send heap buffer overflow (bsc#1099793). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-908=1 Package List: - openSUSE Leap 15.0 (i586 x86_64): curl-7.60.0-lp150.2.9.1 curl-debuginfo-7.60.0-lp150.2.9.1 curl-debugsource-7.60.0-lp150.2.9.1 curl-mini-7.60.0-lp150.2.9.1 curl-mini-debuginfo-7.60.0-lp150.2.9.1 curl-mini-debugsource-7.60.0-lp150.2.9.1 libcurl-devel-7.60.0-lp150.2.9.1 libcurl-mini-devel-7.60.0-lp150.2.9.1 libcurl4-7.60.0-lp150.2.9.1 libcurl4-debuginfo-7.60.0-lp150.2.9.1 libcurl4-mini-7.60.0-lp150.2.9.1 libcurl4-mini-debuginfo-7.60.0-lp150.2.9.1 - openSUSE Leap 15.0 (x86_64): libcurl-devel-32bit-7.60.0-lp150.2.9.1 libcurl4-32bit-7.60.0-lp150.2.9.1 libcurl4-32bit-debuginfo-7.60.0-lp150.2.9.1 References: https://www.suse.com/security/cve/CVE-2018-0500.html https://bugzilla.suse.com/1099793

1 0

openSUSE-RU-2018:2430-1: moderate: Recommended update for screenfetch
by maintenance＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Recommended Update: Recommended update for screenfetch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2430-1 Rating: moderate References: #1103527 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for screenfetch to version 3.8.0 fixes the following issues: - Recommend lsb-release as it is needed for correct detection of distribution (boo#1103527) - Require bc to avoid error on startup - Additional Intel GPU checks - document `-w' command in README.mkdn - document `-w' command in manpage - show CPU temperature Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-912=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-912=1 Package List: - openSUSE Leap 42.3 (noarch): screenfetch-3.8.0-10.6.1 - openSUSE Leap 15.0 (noarch): screenfetch-3.8.0-lp150.2.6.1 References: https://bugzilla.suse.com/1103527

1 0

openSUSE-RU-2018:2429-1: moderate: Recommended update for screenfetch
by maintenance＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Recommended Update: Recommended update for screenfetch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2429-1 Rating: moderate References: #1103527 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for screenfetch to version 3.8.0 fixes the following issues: - Recommend lsb-release as it is needed for correct detection of distribution (boo#1103527) - Require bc to avoid error on startup - Additional Intel GPU checks - document `-w' command in README.mkdn - document `-w' command in manpage - show CPU temperature Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-912=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): screenfetch-3.8.0-8.1 References: https://bugzilla.suse.com/1103527

1 0

openSUSE-RU-2018:2428-1: moderate: Recommended update for virtualbox
by maintenance＠opensuse.org 19 Aug '18

19 Aug '18

openSUSE Recommended Update: Recommended update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2428-1 Rating: moderate References: #1105201 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for virtualbox fixes the following issues: Update to VirtualBox 5.2.18 (boo#1105201), containing multiple upstream bug fixes: - VMM: fix loading with recent binutils and self-built versions of VirtualBox - NAT: fix --nataliasmode sameports which is a valid setting - VRDP: fixed VM process termination on RDP client disconnect if 3D is enabled for the virtual machine Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-909=1 Package List: - openSUSE Leap 15.0 (noarch): virtualbox-guest-desktop-icons-5.2.18-lp150.4.14.1 virtualbox-guest-source-5.2.18-lp150.4.14.1 virtualbox-host-source-5.2.18-lp150.4.14.1 - openSUSE Leap 15.0 (x86_64): python3-virtualbox-5.2.18-lp150.4.14.1 python3-virtualbox-debuginfo-5.2.18-lp150.4.14.1 virtualbox-5.2.18-lp150.4.14.1 virtualbox-debuginfo-5.2.18-lp150.4.14.1 virtualbox-debugsource-5.2.18-lp150.4.14.1 virtualbox-devel-5.2.18-lp150.4.14.1 virtualbox-guest-kmp-default-5.2.18_k4.12.14_lp150.12.16-lp150.4.14.1 virtualbox-guest-kmp-default-debuginfo-5.2.18_k4.12.14_lp150.12.16-lp150.4.14.1 virtualbox-guest-tools-5.2.18-lp150.4.14.1 virtualbox-guest-tools-debuginfo-5.2.18-lp150.4.14.1 virtualbox-guest-x11-5.2.18-lp150.4.14.1 virtualbox-guest-x11-debuginfo-5.2.18-lp150.4.14.1 virtualbox-host-kmp-default-5.2.18_k4.12.14_lp150.12.16-lp150.4.14.1 virtualbox-host-kmp-default-debuginfo-5.2.18_k4.12.14_lp150.12.16-lp150.4.14.1 virtualbox-qt-5.2.18-lp150.4.14.1 virtualbox-qt-debuginfo-5.2.18-lp150.4.14.1 virtualbox-vnc-5.2.18-lp150.4.14.1 virtualbox-websrv-5.2.18-lp150.4.14.1 virtualbox-websrv-debuginfo-5.2.18-lp150.4.14.1 References: https://bugzilla.suse.com/1105201

1 0

openSUSE-RU-2018:2427-1: moderate: Recommended update for systemd
by maintenance＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Recommended Update: Recommended update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2427-1 Rating: moderate References: #1039099 #1080382 #1082004 #1082485 #1083158 #1088052 #1088769 #1088890 #1089761 #1090785 #1091265 #1093851 #1095096 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has 13 recommended fixes can now be installed. Description: This update for systemd fixes the following issues: - core: In --user mode, report READY=1 as soon as basic.target is reached. - sd-bus: Extend D-Bus authentication timeout considerably. - scsi_id: Fixup prefix for pre-SPC inquiry reply. (bsc#1039099) - udev: Use MAC address match only for ibmveth/ibmvnic/mlx4. (bsc#1095096) - compat-rules: Generate more compat by-id symlinks for NVMe devices. (bsc#1095096) - udev: Whitelist mlx4_core locally-administered MAC addresses in the persistent rule generator. (bsc#1083158) - udev: Don't create by-partlabel/primary and .../logical symlinks. (bsc#1089761) - rules: Add /dev/disk/by-partuuid symlinks also for dos partition tables. - device: Make sure to always retroactively start device dependencies. (bsc#1088052) - device: Skip deserialization of device units when udevd is not running. - install: "user" and "global" scopes are equivalent for user presets. (bsc#1093851) - install: Search preset files in /run. - man: Updated systemd-analyze blame description for service-units with Type=simple. (bsc#1091265) - logind: Fix crash when shutdown is not issued from a tty. (bsc#1088890) - logind: Do not use an uninitialized variable. (bsc#1088890) - Disable user services by default. (bsc#1090785) - Ship 99-sysctl.conf instead of creating it during package installation/update. (bsc#1088769) Previously this symlink was created in /etc/sysctl.d during %post which made the symlink not owned and more importantly it was created only if /etc/sysctl.conf is already installed which is not always the case during the installation process it seems. So ship the symlink unconditionally and put it in /usr/lib/sysctl.d instead since it's a distro default behavior that might be overriden by sysadmin later. - systemd: Add offline environmental condition to 80-acpi-container-hotplug.rules. (bsc#1080382, bsc#1082485) Add the offline event environmental condition to restrict the rule that is can only be triggered when the change event is received with the "offline" environmental data. The 27664c581 "ACPI / scan: Send change uevent with offine environmental data" kernel patch changed the corresponding code in kernel. This change prevents the udev rules for acpi container be triggered by "udevadm trigger" from user space. - build-sys: Explicitly require python3. (bsc#1082004) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-900=1 Package List: - openSUSE Leap 42.3 (i586 x86_64): libsystemd0-228-53.1 libsystemd0-debuginfo-228-53.1 libsystemd0-mini-228-53.1 libsystemd0-mini-debuginfo-228-53.1 libudev-devel-228-53.1 libudev-mini-devel-228-53.1 libudev-mini1-228-53.1 libudev-mini1-debuginfo-228-53.1 libudev1-228-53.1 libudev1-debuginfo-228-53.1 nss-myhostname-228-53.1 nss-myhostname-debuginfo-228-53.1 nss-mymachines-228-53.1 nss-mymachines-debuginfo-228-53.1 systemd-228-53.1 systemd-debuginfo-228-53.1 systemd-debugsource-228-53.1 systemd-devel-228-53.1 systemd-logger-228-53.1 systemd-mini-228-53.1 systemd-mini-debuginfo-228-53.1 systemd-mini-debugsource-228-53.1 systemd-mini-devel-228-53.1 systemd-mini-sysvinit-228-53.1 systemd-sysvinit-228-53.1 udev-228-53.1 udev-debuginfo-228-53.1 udev-mini-228-53.1 udev-mini-debuginfo-228-53.1 - openSUSE Leap 42.3 (noarch): systemd-bash-completion-228-53.1 systemd-mini-bash-completion-228-53.1 - openSUSE Leap 42.3 (x86_64): libsystemd0-32bit-228-53.1 libsystemd0-debuginfo-32bit-228-53.1 libudev1-32bit-228-53.1 libudev1-debuginfo-32bit-228-53.1 nss-myhostname-32bit-228-53.1 nss-myhostname-debuginfo-32bit-228-53.1 systemd-32bit-228-53.1 systemd-debuginfo-32bit-228-53.1 References: https://bugzilla.suse.com/1039099 https://bugzilla.suse.com/1080382 https://bugzilla.suse.com/1082004 https://bugzilla.suse.com/1082485 https://bugzilla.suse.com/1083158 https://bugzilla.suse.com/1088052 https://bugzilla.suse.com/1088769 https://bugzilla.suse.com/1088890 https://bugzilla.suse.com/1089761 https://bugzilla.suse.com/1090785 https://bugzilla.suse.com/1091265 https://bugzilla.suse.com/1093851 https://bugzilla.suse.com/1095096

1 0

openSUSE-RU-2018:2425-1: moderate: Recommended update for ca-certificates-mozilla
by maintenance＠opensuse.org 17 Aug '18

17 Aug '18

openSUSE Recommended Update: Recommended update for ca-certificates-mozilla ______________________________________________________________________________ Announcement ID: openSUSE-RU-2018:2425-1 Rating: moderate References: #1100415 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The systemwide Root CA certificates were updated to the 2.24 state of the Mozilla NSS Certificate store. Following CAs were removed: * S-TRUST_Universal_Root_CA * TC_TrustCenter_Class_3_CA_II * TURKTRUST_Elektronik_Sertifika_Hizmet_Saglayicisi_H5 This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-902=1 Package List: - openSUSE Leap 42.3 (noarch): ca-certificates-mozilla-2.24-15.1 References: https://bugzilla.suse.com/1100415

1 0