- openSUSE Updates

openSUSE-SU-2016:0243-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0243-1 Rating: important References: #961937 Cross-References: CVE-2016-1897 CVE-2016-1898 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update to ffmpeg 2.8.5 fixes the following issues: * CVE-2016-1897: Cross-origin issue in URL processing (concat) - local file disclosure (boo#961937) * CVE-2016-1898: Cross-origin issue in URL processing (subfile) - local file disclosure (boo#961937) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-94=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ffmpeg-2.8.5-12.1 ffmpeg-debuginfo-2.8.5-12.1 ffmpeg-debugsource-2.8.5-12.1 ffmpeg-devel-2.8.5-12.1 libavcodec-devel-2.8.5-12.1 libavcodec56-2.8.5-12.1 libavcodec56-debuginfo-2.8.5-12.1 libavdevice-devel-2.8.5-12.1 libavdevice56-2.8.5-12.1 libavdevice56-debuginfo-2.8.5-12.1 libavfilter-devel-2.8.5-12.1 libavfilter5-2.8.5-12.1 libavfilter5-debuginfo-2.8.5-12.1 libavformat-devel-2.8.5-12.1 libavformat56-2.8.5-12.1 libavformat56-debuginfo-2.8.5-12.1 libavresample-devel-2.8.5-12.1 libavresample2-2.8.5-12.1 libavresample2-debuginfo-2.8.5-12.1 libavutil-devel-2.8.5-12.1 libavutil54-2.8.5-12.1 libavutil54-debuginfo-2.8.5-12.1 libpostproc-devel-2.8.5-12.1 libpostproc53-2.8.5-12.1 libpostproc53-debuginfo-2.8.5-12.1 libswresample-devel-2.8.5-12.1 libswresample1-2.8.5-12.1 libswresample1-debuginfo-2.8.5-12.1 libswscale-devel-2.8.5-12.1 libswscale3-2.8.5-12.1 libswscale3-debuginfo-2.8.5-12.1 - openSUSE Leap 42.1 (x86_64): libavcodec56-32bit-2.8.5-12.1 libavcodec56-debuginfo-32bit-2.8.5-12.1 libavdevice56-32bit-2.8.5-12.1 libavdevice56-debuginfo-32bit-2.8.5-12.1 libavfilter5-32bit-2.8.5-12.1 libavfilter5-debuginfo-32bit-2.8.5-12.1 libavformat56-32bit-2.8.5-12.1 libavformat56-debuginfo-32bit-2.8.5-12.1 libavresample2-32bit-2.8.5-12.1 libavresample2-debuginfo-32bit-2.8.5-12.1 libavutil54-32bit-2.8.5-12.1 libavutil54-debuginfo-32bit-2.8.5-12.1 libpostproc53-32bit-2.8.5-12.1 libpostproc53-debuginfo-32bit-2.8.5-12.1 libswresample1-32bit-2.8.5-12.1 libswresample1-debuginfo-32bit-2.8.5-12.1 libswscale3-32bit-2.8.5-12.1 libswscale3-debuginfo-32bit-2.8.5-12.1 References: https://www.suse.com/security/cve/CVE-2016-1897.html https://www.suse.com/security/cve/CVE-2016-1898.html https://bugzilla.suse.com/961937

1 0

openSUSE-SU-2016:0239-1: moderate: Security update for ecryptfs-utils
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for ecryptfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0239-1 Rating: moderate References: #962052 Cross-References: CVE-2016-1572 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ecryptfs-utils fixes the following issues: - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems (bsc#962052) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-93=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ecryptfs-utils-104-3.1 ecryptfs-utils-debuginfo-104-3.1 ecryptfs-utils-debugsource-104-3.1 - openSUSE 13.2 (x86_64): ecryptfs-utils-32bit-104-3.1 ecryptfs-utils-debuginfo-32bit-104-3.1 References: https://www.suse.com/security/cve/CVE-2016-1572.html https://bugzilla.suse.com/962052

1 0

openSUSE-SU-2016:0226-1: important: Security update for openldap2
by opensuse-security＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Security Update: Security update for openldap2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0226-1 Rating: important References: #904028 #937766 #945582 #955210 Cross-References: CVE-2015-4000 CVE-2015-6908 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-6908: The ber_get_next function allowed remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. (bsc#945582) - CVE-2015-4000: Fix weak Diffie-Hellman size vulnerability. (bsc#937766) It also fixes the following non-security bugs: - bsc#955210: Unresponsive LDAP host lookups in IPv6 environment - bsc#904028: Add missing dependency binutils used by %pre. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-92=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): compat-libldap-2_3-0-2.3.37-8.9.1 compat-libldap-2_3-0-debuginfo-2.3.37-8.9.1 libldap-2_4-2-2.4.39-8.9.1 libldap-2_4-2-debuginfo-2.4.39-8.9.1 openldap2-2.4.39-8.9.1 openldap2-back-meta-2.4.39-8.9.1 openldap2-back-meta-debuginfo-2.4.39-8.9.1 openldap2-back-perl-2.4.39-8.9.1 openldap2-back-perl-debuginfo-2.4.39-8.9.1 openldap2-back-sql-2.4.39-8.9.1 openldap2-back-sql-debuginfo-2.4.39-8.9.1 openldap2-client-2.4.39-8.9.1 openldap2-client-debuginfo-2.4.39-8.9.1 openldap2-client-debugsource-2.4.39-8.9.1 openldap2-debuginfo-2.4.39-8.9.1 openldap2-debugsource-2.4.39-8.9.1 openldap2-devel-2.4.39-8.9.1 openldap2-devel-static-2.4.39-8.9.1 - openSUSE 13.2 (x86_64): libldap-2_4-2-32bit-2.4.39-8.9.1 libldap-2_4-2-debuginfo-32bit-2.4.39-8.9.1 openldap2-devel-32bit-2.4.39-8.9.1 - openSUSE 13.2 (noarch): openldap2-doc-2.4.39-8.9.1 References: https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-6908.html https://bugzilla.suse.com/904028 https://bugzilla.suse.com/937766 https://bugzilla.suse.com/945582 https://bugzilla.suse.com/955210

1 0

openSUSE-RU-2016:0223-1: moderate: Recommended update for libverto
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for libverto ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0223-1 Rating: moderate References: #958871 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libverto fixes the following issues: - Introduce conflict between libverto-devel and krb5-devel because Kerberos is bundling its libverto source. (boo#958871) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-90=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libverto-debugsource-0.2.6-7.1 libverto-devel-0.2.6-7.1 libverto-glib-devel-0.2.6-7.1 libverto-glib1-0.2.6-7.1 libverto-glib1-debuginfo-0.2.6-7.1 libverto-libev-devel-0.2.6-7.1 libverto-libev1-0.2.6-7.1 libverto-libev1-debuginfo-0.2.6-7.1 libverto-tevent-devel-0.2.6-7.1 libverto-tevent1-0.2.6-7.1 libverto-tevent1-debuginfo-0.2.6-7.1 libverto1-0.2.6-7.1 libverto1-debuginfo-0.2.6-7.1 - openSUSE Leap 42.1 (x86_64): libverto-glib1-32bit-0.2.6-7.1 libverto-glib1-debuginfo-32bit-0.2.6-7.1 libverto-libev1-32bit-0.2.6-7.1 libverto-libev1-debuginfo-32bit-0.2.6-7.1 libverto-tevent1-32bit-0.2.6-7.1 libverto-tevent1-debuginfo-32bit-0.2.6-7.1 libverto1-32bit-0.2.6-7.1 libverto1-debuginfo-32bit-0.2.6-7.1 References: https://bugzilla.suse.com/958871

1 0

openSUSE-RU-2016:0222-1: moderate: Recommended update for mate-menu
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for mate-menu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0222-1 Rating: moderate References: #959024 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mate-menu fixes the following issues: - Update to 5.6.7: + Fix intends in mate-menu execute.py. + Do not use mate-folder.png that doesn't exist in freedesktop specification. + Fix configurator crash due to changes in Gtk 2.24.29. + Do not crash if lsb_release is not available (boo#959024). - Only recommend lsb-release. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-91=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): mate-menu-5.6.7-7.1 mate-menu-lang-5.6.7-7.1 References: https://bugzilla.suse.com/959024

1 0

openSUSE-RU-2016:0221-1: Recommended update for clamav-database
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0221-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh January 18th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-87=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201601180000-38.1 References:

1 0

openSUSE-RU-2016:0220-1: Recommended update for yast2-slp-server
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for yast2-slp-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0220-1 Rating: low References: #878892 #954494 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-slp-server fixes the following issues: - Fix handling of broken options in configuration file. (bsc#878892, bsc#954494) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-88=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): yast2-slp-server-3.1.4-5.1 References: https://bugzilla.suse.com/878892 https://bugzilla.suse.com/954494

1 0

openSUSE-RU-2016:0219-1: moderate: Recommended update for calibre
by maintenance＠opensuse.org 25 Jan '16

25 Jan '16

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:0219-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for calibre fixes the following issues: - Update to 2.49.0: + A new tool to easily export and import all calibre data -- books, settings and plugins. + Get Books: Add plugins for Amazon Australia and Amazon India. Also restore the Amazon EU plugins (lp#1526089). + PDF Input: Fix conversion of PDF documents that contain ASCII control codes in their outlines not working (lp#1527697). + Driver for Energy Ereader Screenlight (lp#1529108). + E-book viewer: Add an option to allow only a single book to be viewed at a time. Trying to view a second book will cause it to replace the currently viewed book (lp#1526504). + Kobo driver: Add support for the new firmware 3.19.5761. + Get Books: Update plugins for various Polish language book stores to handle changes to the website. + Amazon metadata download: Handle a change in the amazon website that prevented review metadata from being downloaded. + Download calibre plugins securely using HTTPS. + MOBI Output: Try to autofix corrupted PNG images in the input document (lp#1531738). + Nook Glowlight Plus: Send files by default to the NOOK/My Files folder (lp#1531394). + E-book viewer: Fix failure to view comic files that contain non-ASCII characters int heir internal filenames (lp#1530517). + And more, for details see http://calibre-ebook.com/whats-new Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-89=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): calibre-2.49.0-14.1 calibre-debuginfo-2.49.0-14.1 calibre-debugsource-2.49.0-14.1 References:

1 0

openSUSE-SU-2016:0218-1: moderate: Security update for cgit
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: Security update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0218-1 Rating: moderate References: #948969 #961916 Cross-References: CVE-2016-1899 CVE-2016-1900 CVE-2016-1901 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update to cgit 0.12 fixes the following issues: - CVE-2016-1899: Reflected Cross Site Scripting and Header Injection in Mimetype Query String - CVE-2016-1900: Stored Cross Site Scripting and Header Injection in Filename Parameter - CVE-2016-1901: Integer Overflow resulting in Buffer Overflow The bundled git version was updated to 2.7.0. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-86=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cgit-0.12-11.6.1 cgit-debuginfo-0.12-11.6.1 cgit-debugsource-0.12-11.6.1 References: https://www.suse.com/security/cve/CVE-2016-1899.html https://www.suse.com/security/cve/CVE-2016-1900.html https://www.suse.com/security/cve/CVE-2016-1901.html https://bugzilla.suse.com/948969 https://bugzilla.suse.com/961916

1 0

openSUSE-SU-2016:0217-1: jasper
by opensuse-security＠opensuse.org 24 Jan '16

24 Jan '16

openSUSE Security Update: jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0217-1 Rating: low References: #725758 #830803 #881716 #961886 Cross-References: CVE-2014-8138 CVE-2016-1867 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for jasper fixes the following issues: - CVE-2016-1867: Out-of-bounds Read could cause a crash (boo#961886) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-83=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): jasper-1.900.1-160.16.1 jasper-debuginfo-1.900.1-160.16.1 jasper-debugsource-1.900.1-160.16.1 libjasper-devel-1.900.1-160.16.1 libjasper1-1.900.1-160.16.1 libjasper1-debuginfo-1.900.1-160.16.1 - openSUSE 13.1 (x86_64): libjasper1-32bit-1.900.1-160.16.1 libjasper1-debuginfo-32bit-1.900.1-160.16.1 References: https://www.suse.com/security/cve/CVE-2014-8138.html https://www.suse.com/security/cve/CVE-2016-1867.html https://bugzilla.suse.com/725758 https://bugzilla.suse.com/830803 https://bugzilla.suse.com/881716 https://bugzilla.suse.com/961886

1 0