- openSUSE Updates

openSUSE-SU-2016:0263-1: critical: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0263-1 Rating: critical References: #960996 #962743 Cross-References: CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0483 CVE-2016-0494 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: java-1_8_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743) - CVE-2015-7575: Further reduce use of MD5 (SLOTH) (bsc#960996) - CVE-2015-8126: Vulnerability in the AWT component related to splashscreen displays - CVE-2015-8472: Vulnerability in the AWT component, addressed by same fix - CVE-2016-0402: Vulnerability in the Networking component related to URL processing - CVE-2016-0448: Vulnerability in the JMX comonent related to attribute processing - CVE-2016-0466: Vulnerability in the JAXP component, related to limits - CVE-2016-0483: Vulnerability in the AWT component related to image decoding - CVE-2016-0494: Vulnerability in 2D component related to font actions Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-105=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.72-21.1 java-1_8_0-openjdk-accessibility-1.8.0.72-21.1 java-1_8_0-openjdk-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-debugsource-1.8.0.72-21.1 java-1_8_0-openjdk-demo-1.8.0.72-21.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-devel-1.8.0.72-21.1 java-1_8_0-openjdk-headless-1.8.0.72-21.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.72-21.1 java-1_8_0-openjdk-src-1.8.0.72-21.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.72-21.1 References: https://www.suse.com/security/cve/CVE-2015-7575.html https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2015-8472.html https://www.suse.com/security/cve/CVE-2016-0402.html https://www.suse.com/security/cve/CVE-2016-0448.html https://www.suse.com/security/cve/CVE-2016-0466.html https://www.suse.com/security/cve/CVE-2016-0483.html https://www.suse.com/security/cve/CVE-2016-0494.html https://bugzilla.suse.com/960996 https://bugzilla.suse.com/962743

1 0

openSUSE-SU-2016:0261-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0261-1 Rating: important References: #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment This update adds the following functionality: - fate#319300: SHA2 password hashing module that can be loaded on-demand. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-104=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-libldap-2_3-0-2.3.37-11.1 compat-libldap-2_3-0-debuginfo-2.3.37-11.1 libldap-2_4-2-2.4.41-11.1 libldap-2_4-2-debuginfo-2.4.41-11.1 openldap2-2.4.41-11.1 openldap2-back-meta-2.4.41-11.1 openldap2-back-meta-debuginfo-2.4.41-11.1 openldap2-back-perl-2.4.41-11.1 openldap2-back-perl-debuginfo-2.4.41-11.1 openldap2-back-sql-2.4.41-11.1 openldap2-back-sql-debuginfo-2.4.41-11.1 openldap2-client-2.4.41-11.1 openldap2-client-debuginfo-2.4.41-11.1 openldap2-client-debugsource-2.4.41-11.1 openldap2-debuginfo-2.4.41-11.1 openldap2-debugsource-2.4.41-11.1 openldap2-devel-2.4.41-11.1 openldap2-devel-static-2.4.41-11.1 - openSUSE Leap 42.1 (x86_64): libldap-2_4-2-32bit-2.4.41-11.1 libldap-2_4-2-debuginfo-32bit-2.4.41-11.1 openldap2-devel-32bit-2.4.41-11.1 - openSUSE Leap 42.1 (noarch): openldap2-doc-2.4.41-11.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210

1 0

openSUSE-RU-2016:0258-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0258-1 Rating: moderate References: #771521 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Fix panning when configured in xorg.conf* (boo#771521). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-103=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-103=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xorg-x11-server-7.6_1.17.2-15.1 xorg-x11-server-debuginfo-7.6_1.17.2-15.1 xorg-x11-server-debugsource-7.6_1.17.2-15.1 xorg-x11-server-extra-7.6_1.17.2-15.1 xorg-x11-server-extra-debuginfo-7.6_1.17.2-15.1 xorg-x11-server-sdk-7.6_1.17.2-15.1 xorg-x11-server-source-7.6_1.17.2-15.1 - openSUSE 13.2 (i586 x86_64): xorg-x11-server-7.6_1.16.1-31.1 xorg-x11-server-debuginfo-7.6_1.16.1-31.1 xorg-x11-server-debugsource-7.6_1.16.1-31.1 xorg-x11-server-extra-7.6_1.16.1-31.1 xorg-x11-server-extra-debuginfo-7.6_1.16.1-31.1 xorg-x11-server-sdk-7.6_1.16.1-31.1 References: https://bugzilla.suse.com/771521

1 0

openSUSE-SU-2016:0255-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 27 Jan '16

27 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0255-1 Rating: important References: #904028 #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment - bsc#904028: Add missing dependency binutils used by %pre. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-102=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libldap-2_4-2-2.4.33-8.6.1 libldap-2_4-2-debuginfo-2.4.33-8.6.1 openldap2-2.4.33-8.6.1 openldap2-back-meta-2.4.33-8.6.1 openldap2-back-meta-debuginfo-2.4.33-8.6.1 openldap2-back-perl-2.4.33-8.6.1 openldap2-back-perl-debuginfo-2.4.33-8.6.1 openldap2-back-sql-2.4.33-8.6.1 openldap2-back-sql-debuginfo-2.4.33-8.6.1 openldap2-client-2.4.33-8.6.1 openldap2-client-debuginfo-2.4.33-8.6.1 openldap2-client-debugsource-2.4.33-8.6.1 openldap2-debuginfo-2.4.33-8.6.1 openldap2-debugsource-2.4.33-8.6.1 openldap2-devel-2.4.33-8.6.1 openldap2-devel-static-2.4.33-8.6.1 - openSUSE 13.1 (x86_64): libldap-2_4-2-32bit-2.4.33-8.6.1 libldap-2_4-2-debuginfo-32bit-2.4.33-8.6.1 openldap2-devel-32bit-2.4.33-8.6.1 - openSUSE 13.1 (noarch): openldap2-doc-2.4.33-8.6.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/904028 https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210

1 0

openSUSE-SU-2016:0252-1: moderate: Security update for tiff
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0252-1 Rating: moderate References: #942690 #960341 Cross-References: CVE-2015-7554 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update to tiff 4.0.6 fixes the following issues: - CVE-2015-7554: Out-of-bounds write in the thumbnail and tiffcmp tools allowed attacker to cause a denial of service or have unspecified further impact (bsc#960341) - bsc#942690: potential out-of-bound write in NeXTDecode() (#2508) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-101=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libtiff-devel-4.0.6-3.1 libtiff5-4.0.6-3.1 libtiff5-debuginfo-4.0.6-3.1 tiff-4.0.6-3.1 tiff-debuginfo-4.0.6-3.1 tiff-debugsource-4.0.6-3.1 - openSUSE Leap 42.1 (x86_64): libtiff-devel-32bit-4.0.6-3.1 libtiff5-32bit-4.0.6-3.1 libtiff5-debuginfo-32bit-4.0.6-3.1 References: https://www.suse.com/security/cve/CVE-2015-7554.html https://bugzilla.suse.com/942690 https://bugzilla.suse.com/960341

1 0

openSUSE-SU-2016:0251-1: moderate: Security update for php5
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0251-1 Rating: moderate References: #949961 #949962 #962057 Cross-References: CVE-2015-7803 CVE-2015-7804 CVE-2016-1903 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for php5 fixes the following issues: - CVE-2015-7803: Specially crafted .phar files with a crafted TAR archive entry allowed remote attackers to cause a Denial of Service (DoS) [bsc#949961] - CVE-2015-7804: Specially crafted .phar files with a crafted ZIP archive entry referencing a file "/" allowed remote attackers to cause a Denial of Service (DoS) or potentially leak unspecified memory content [bsc#949961] - CVE-2016-1903: Specially crafted image files could allowed remote attackers read unspecified memory when rotating images [bsc#962057] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-100=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-39.1 apache2-mod_php5-debuginfo-5.6.1-39.1 php5-5.6.1-39.1 php5-bcmath-5.6.1-39.1 php5-bcmath-debuginfo-5.6.1-39.1 php5-bz2-5.6.1-39.1 php5-bz2-debuginfo-5.6.1-39.1 php5-calendar-5.6.1-39.1 php5-calendar-debuginfo-5.6.1-39.1 php5-ctype-5.6.1-39.1 php5-ctype-debuginfo-5.6.1-39.1 php5-curl-5.6.1-39.1 php5-curl-debuginfo-5.6.1-39.1 php5-dba-5.6.1-39.1 php5-dba-debuginfo-5.6.1-39.1 php5-debuginfo-5.6.1-39.1 php5-debugsource-5.6.1-39.1 php5-devel-5.6.1-39.1 php5-dom-5.6.1-39.1 php5-dom-debuginfo-5.6.1-39.1 php5-enchant-5.6.1-39.1 php5-enchant-debuginfo-5.6.1-39.1 php5-exif-5.6.1-39.1 php5-exif-debuginfo-5.6.1-39.1 php5-fastcgi-5.6.1-39.1 php5-fastcgi-debuginfo-5.6.1-39.1 php5-fileinfo-5.6.1-39.1 php5-fileinfo-debuginfo-5.6.1-39.1 php5-firebird-5.6.1-39.1 php5-firebird-debuginfo-5.6.1-39.1 php5-fpm-5.6.1-39.1 php5-fpm-debuginfo-5.6.1-39.1 php5-ftp-5.6.1-39.1 php5-ftp-debuginfo-5.6.1-39.1 php5-gd-5.6.1-39.1 php5-gd-debuginfo-5.6.1-39.1 php5-gettext-5.6.1-39.1 php5-gettext-debuginfo-5.6.1-39.1 php5-gmp-5.6.1-39.1 php5-gmp-debuginfo-5.6.1-39.1 php5-iconv-5.6.1-39.1 php5-iconv-debuginfo-5.6.1-39.1 php5-imap-5.6.1-39.1 php5-imap-debuginfo-5.6.1-39.1 php5-intl-5.6.1-39.1 php5-intl-debuginfo-5.6.1-39.1 php5-json-5.6.1-39.1 php5-json-debuginfo-5.6.1-39.1 php5-ldap-5.6.1-39.1 php5-ldap-debuginfo-5.6.1-39.1 php5-mbstring-5.6.1-39.1 php5-mbstring-debuginfo-5.6.1-39.1 php5-mcrypt-5.6.1-39.1 php5-mcrypt-debuginfo-5.6.1-39.1 php5-mssql-5.6.1-39.1 php5-mssql-debuginfo-5.6.1-39.1 php5-mysql-5.6.1-39.1 php5-mysql-debuginfo-5.6.1-39.1 php5-odbc-5.6.1-39.1 php5-odbc-debuginfo-5.6.1-39.1 php5-opcache-5.6.1-39.1 php5-opcache-debuginfo-5.6.1-39.1 php5-openssl-5.6.1-39.1 php5-openssl-debuginfo-5.6.1-39.1 php5-pcntl-5.6.1-39.1 php5-pcntl-debuginfo-5.6.1-39.1 php5-pdo-5.6.1-39.1 php5-pdo-debuginfo-5.6.1-39.1 php5-pgsql-5.6.1-39.1 php5-pgsql-debuginfo-5.6.1-39.1 php5-phar-5.6.1-39.1 php5-phar-debuginfo-5.6.1-39.1 php5-posix-5.6.1-39.1 php5-posix-debuginfo-5.6.1-39.1 php5-pspell-5.6.1-39.1 php5-pspell-debuginfo-5.6.1-39.1 php5-readline-5.6.1-39.1 php5-readline-debuginfo-5.6.1-39.1 php5-shmop-5.6.1-39.1 php5-shmop-debuginfo-5.6.1-39.1 php5-snmp-5.6.1-39.1 php5-snmp-debuginfo-5.6.1-39.1 php5-soap-5.6.1-39.1 php5-soap-debuginfo-5.6.1-39.1 php5-sockets-5.6.1-39.1 php5-sockets-debuginfo-5.6.1-39.1 php5-sqlite-5.6.1-39.1 php5-sqlite-debuginfo-5.6.1-39.1 php5-suhosin-5.6.1-39.1 php5-suhosin-debuginfo-5.6.1-39.1 php5-sysvmsg-5.6.1-39.1 php5-sysvmsg-debuginfo-5.6.1-39.1 php5-sysvsem-5.6.1-39.1 php5-sysvsem-debuginfo-5.6.1-39.1 php5-sysvshm-5.6.1-39.1 php5-sysvshm-debuginfo-5.6.1-39.1 php5-tidy-5.6.1-39.1 php5-tidy-debuginfo-5.6.1-39.1 php5-tokenizer-5.6.1-39.1 php5-tokenizer-debuginfo-5.6.1-39.1 php5-wddx-5.6.1-39.1 php5-wddx-debuginfo-5.6.1-39.1 php5-xmlreader-5.6.1-39.1 php5-xmlreader-debuginfo-5.6.1-39.1 php5-xmlrpc-5.6.1-39.1 php5-xmlrpc-debuginfo-5.6.1-39.1 php5-xmlwriter-5.6.1-39.1 php5-xmlwriter-debuginfo-5.6.1-39.1 php5-xsl-5.6.1-39.1 php5-xsl-debuginfo-5.6.1-39.1 php5-zip-5.6.1-39.1 php5-zip-debuginfo-5.6.1-39.1 php5-zlib-5.6.1-39.1 php5-zlib-debuginfo-5.6.1-39.1 - openSUSE 13.2 (noarch): php5-pear-5.6.1-39.1 References: https://www.suse.com/security/cve/CVE-2015-7803.html https://www.suse.com/security/cve/CVE-2015-7804.html https://www.suse.com/security/cve/CVE-2016-1903.html https://bugzilla.suse.com/949961 https://bugzilla.suse.com/949962 https://bugzilla.suse.com/962057

1 0

openSUSE-SU-2016:0250-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0250-1 Rating: important References: #963184 #963185 #963186 #963187 #963188 #963189 #963190 #963191 #963192 Cross-References: CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 48.0.2564.82 to fix security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-1612: Bad cast in V8 (boo#963184) - CVE-2016-1613: Use-after-free in PDFium (boo#963185) - CVE-2016-1614: Information leak in Blink (boo#963186) - CVE-2016-1615: Origin confusion in Omnibox (boo#963187) - CVE-2016-1616: URL Spoofing (boo#963188) - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189) - CVE-2016-1618: Weak random number generator in Blink (boo#963190) - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191) - CVE-2016-1620 chromium-browser: various fixes (boo#963192) This update also enables SSE2 support on x86_64, VA-API hardware acceleration and fixes a crash when trying to enable the Chromecast extension. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-99=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-99=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): chromedriver-48.0.2564.82-13.1 chromedriver-debuginfo-48.0.2564.82-13.1 chromium-48.0.2564.82-13.1 chromium-debuginfo-48.0.2564.82-13.1 chromium-debugsource-48.0.2564.82-13.1 chromium-desktop-gnome-48.0.2564.82-13.1 chromium-desktop-kde-48.0.2564.82-13.1 chromium-ffmpegsumo-48.0.2564.82-13.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-13.1 - openSUSE 13.2 (i586 x86_64): chromedriver-48.0.2564.82-67.1 chromedriver-debuginfo-48.0.2564.82-67.1 chromium-48.0.2564.82-67.1 chromium-debuginfo-48.0.2564.82-67.1 chromium-debugsource-48.0.2564.82-67.1 chromium-desktop-gnome-48.0.2564.82-67.1 chromium-desktop-kde-48.0.2564.82-67.1 chromium-ffmpegsumo-48.0.2564.82-67.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-67.1 References: https://www.suse.com/security/cve/CVE-2016-1612.html https://www.suse.com/security/cve/CVE-2016-1613.html https://www.suse.com/security/cve/CVE-2016-1614.html https://www.suse.com/security/cve/CVE-2016-1615.html https://www.suse.com/security/cve/CVE-2016-1616.html https://www.suse.com/security/cve/CVE-2016-1617.html https://www.suse.com/security/cve/CVE-2016-1618.html https://www.suse.com/security/cve/CVE-2016-1619.html https://www.suse.com/security/cve/CVE-2016-1620.html https://bugzilla.suse.com/963184 https://bugzilla.suse.com/963185 https://bugzilla.suse.com/963186 https://bugzilla.suse.com/963187 https://bugzilla.suse.com/963188 https://bugzilla.suse.com/963189 https://bugzilla.suse.com/963190 https://bugzilla.suse.com/963191 https://bugzilla.suse.com/963192

1 0

openSUSE-SU-2016:0249-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0249-1 Rating: important References: #963184 #963185 #963186 #963187 #963188 #963189 #963190 #963191 #963192 Cross-References: CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 48.0.2564.82 to fix security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-1612: Bad cast in V8 (boo#963184) - CVE-2016-1613: Use-after-free in PDFium (boo#963185) - CVE-2016-1614: Information leak in Blink (boo#963186) - CVE-2016-1615: Origin confusion in Omnibox (boo#963187) - CVE-2016-1616: URL Spoofing (boo#963188) - CVE-2016-1617: History sniffing with HSTS and CSP (boo#963189) - CVE-2016-1618: Weak random number generator in Blink (boo#963190) - CVE-2016-1619: Out-of-bounds read in PDFium (boo#963191) - CVE-2016-1620 chromium-browser: various fixes (boo#963192) This update also enables SSE2 support on x86_64, VA-API hardware acceleration and fixes a crash when trying to enable the Chromecast extension. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-99=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-48.0.2564.82-41.1 chromedriver-debuginfo-48.0.2564.82-41.1 chromium-48.0.2564.82-41.1 chromium-debuginfo-48.0.2564.82-41.1 chromium-debugsource-48.0.2564.82-41.1 chromium-desktop-gnome-48.0.2564.82-41.1 chromium-desktop-kde-48.0.2564.82-41.1 chromium-ffmpegsumo-48.0.2564.82-41.1 chromium-ffmpegsumo-debuginfo-48.0.2564.82-41.1 References: https://www.suse.com/security/cve/CVE-2016-1612.html https://www.suse.com/security/cve/CVE-2016-1613.html https://www.suse.com/security/cve/CVE-2016-1614.html https://www.suse.com/security/cve/CVE-2016-1615.html https://www.suse.com/security/cve/CVE-2016-1616.html https://www.suse.com/security/cve/CVE-2016-1617.html https://www.suse.com/security/cve/CVE-2016-1618.html https://www.suse.com/security/cve/CVE-2016-1619.html https://www.suse.com/security/cve/CVE-2016-1620.html https://bugzilla.suse.com/963184 https://bugzilla.suse.com/963185 https://bugzilla.suse.com/963186 https://bugzilla.suse.com/963187 https://bugzilla.suse.com/963188 https://bugzilla.suse.com/963189 https://bugzilla.suse.com/963190 https://bugzilla.suse.com/963191 https://bugzilla.suse.com/963192

1 0

openSUSE-RU-2016:0247-1: update for Xorg
by maintenance＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Recommended Update: update for Xorg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0247-1 Rating: low References: #771521 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Fix panning when configured in xorg.conf* (boo#771521). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-97=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xorg-x11-server-7.6_1.14.3.901-31.1 xorg-x11-server-debuginfo-7.6_1.14.3.901-31.1 xorg-x11-server-debugsource-7.6_1.14.3.901-31.1 xorg-x11-server-extra-7.6_1.14.3.901-31.1 xorg-x11-server-extra-debuginfo-7.6_1.14.3.901-31.1 xorg-x11-server-sdk-7.6_1.14.3.901-31.1 References: https://bugzilla.suse.com/771521

1 0

openSUSE-SU-2016:0246-1: moderate: Security update for python-requests
by opensuse-security＠opensuse.org 26 Jan '16

26 Jan '16

openSUSE Security Update: Security update for python-requests ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0246-1 Rating: moderate References: #897658 Cross-References: CVE-2014-1830 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-requests fixes the following issue: - CVE-2014-1830: Proxy-Authorization header leak (bnc#897658) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-98=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): python-requests-1.2.3-4.3.1 References: https://www.suse.com/security/cve/CVE-2014-1830.html https://bugzilla.suse.com/897658

1 0