June 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:1160-1: Recommended update for the KDE Applications stack
by maintenance＠opensuse.org 30 Jun '15

30 Jun '15

openSUSE Recommended Update: Recommended update for the KDE Applications stack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1160-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for the KDE Applications stack provides version 15.04.2 with various fixes and improvements. For a detailed description, please refer to https://www.kde.org/announcements/announce-applications-15.04.2.php. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-455=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): akonadi-4.14.9-24.2 akonadi-debuginfo-4.14.9-24.2 akregator-4.14.9-24.2 akregator-debuginfo-4.14.9-24.2 blogilo-4.14.9-24.2 blogilo-debuginfo-4.14.9-24.2 kaddressbook-4.14.9-24.2 kaddressbook-debuginfo-4.14.9-24.2 kalarm-4.14.9-24.2 kalarm-debuginfo-4.14.9-24.2 kde4-kgreeter-plugins-4.11.20-29.5 kde4-kgreeter-plugins-debuginfo-4.11.20-29.5 kdebase4-workspace-4.11.20-29.5 kdebase4-workspace-addons-4.11.20-29.5 kdebase4-workspace-addons-debuginfo-4.11.20-29.5 kdebase4-workspace-branding-upstream-4.11.20-29.5 kdebase4-workspace-debuginfo-4.11.20-29.5 kdebase4-workspace-debugsource-4.11.20-29.5 kdebase4-workspace-devel-4.11.20-29.5 kdebase4-workspace-devel-debuginfo-4.11.20-29.5 kdebase4-workspace-ksysguardd-4.11.20-29.5 kdebase4-workspace-ksysguardd-debuginfo-4.11.20-29.5 kdebase4-workspace-liboxygenstyle-4.11.20-29.5 kdebase4-workspace-liboxygenstyle-debuginfo-4.11.20-29.5 kdebase4-workspace-libs-4.11.20-29.5 kdebase4-workspace-libs-debuginfo-4.11.20-29.5 kdebase4-workspace-plasma-calendar-4.11.20-29.5 kdebase4-workspace-plasma-calendar-debuginfo-4.11.20-29.5 kdelibs4-4.14.9-24.2 kdelibs4-branding-upstream-4.14.9-24.2 kdelibs4-core-4.14.9-24.2 kdelibs4-core-debuginfo-4.14.9-24.2 kdelibs4-debuginfo-4.14.9-24.2 kdelibs4-debugsource-4.14.9-24.2 kdelibs4-doc-4.14.9-24.2 kdelibs4-doc-debuginfo-4.14.9-24.2 kdepim4-4.14.9-24.2 kdepim4-debuginfo-4.14.9-24.2 kdepim4-debugsource-4.14.9-24.2 kdepim4-runtime-4.14.9-24.1 kdepim4-runtime-debuginfo-4.14.9-24.1 kdepim4-runtime-debugsource-4.14.9-24.1 kdepimlibs4-4.14.9-24.1 kdepimlibs4-debuginfo-4.14.9-24.1 kdepimlibs4-debugsource-4.14.9-24.1 kdm-4.11.20-29.5 kdm-branding-upstream-4.11.20-29.5 kdm-debuginfo-4.11.20-29.5 kjots-4.14.9-24.2 kjots-debuginfo-4.14.9-24.2 kmail-4.14.9-24.2 kmail-debuginfo-4.14.9-24.2 knode-4.14.9-24.2 knode-debuginfo-4.14.9-24.2 knotes-4.14.9-24.2 knotes-debuginfo-4.14.9-24.2 kontact-4.14.9-24.2 kontact-debuginfo-4.14.9-24.2 korganizer-4.14.9-24.2 korganizer-debuginfo-4.14.9-24.2 krandr-4.11.20-29.5 krandr-debuginfo-4.11.20-29.5 ktimetracker-4.14.9-24.2 ktimetracker-debuginfo-4.14.9-24.2 ktnef-4.14.9-24.2 ktnef-debuginfo-4.14.9-24.2 kwin-4.11.20-29.5 kwin-debuginfo-4.11.20-29.5 libakonadi4-4.14.9-24.1 libakonadi4-debuginfo-4.14.9-24.1 libkde4-4.14.9-24.2 libkde4-debuginfo-4.14.9-24.2 libkde4-devel-4.14.9-24.2 libkdecore4-4.14.9-24.2 libkdecore4-debuginfo-4.14.9-24.2 libkdecore4-devel-4.14.9-24.2 libkdecore4-devel-debuginfo-4.14.9-24.2 libkdepim4-4.14.9-24.2 libkdepim4-debuginfo-4.14.9-24.2 libkdepimlibs4-4.14.9-24.1 libkdepimlibs4-debuginfo-4.14.9-24.1 libkdepimlibs4-devel-4.14.9-24.1 libkdepimlibs4-devel-debuginfo-4.14.9-24.1 libksuseinstall-devel-4.14.9-24.2 libksuseinstall1-4.14.9-24.2 libksuseinstall1-debuginfo-4.14.9-24.2 oxygen-cursors4-4.11.20-29.5 python-kdebase4-4.11.20-29.5 - openSUSE 13.2 (x86_64): kdebase4-workspace-liboxygenstyle-32bit-4.11.20-29.5 kdebase4-workspace-liboxygenstyle-debuginfo-32bit-4.11.20-29.5 kdebase4-workspace-libs-32bit-4.11.20-29.5 kdebase4-workspace-libs-debuginfo-32bit-4.11.20-29.5 libakonadi4-32bit-4.14.9-24.1 libakonadi4-debuginfo-32bit-4.14.9-24.1 libkde4-32bit-4.14.9-24.2 libkde4-debuginfo-32bit-4.14.9-24.2 libkdecore4-32bit-4.14.9-24.2 libkdecore4-debuginfo-32bit-4.14.9-24.2 libkdepimlibs4-32bit-4.14.9-24.1 libkdepimlibs4-debuginfo-32bit-4.14.9-24.1 libksuseinstall1-32bit-4.14.9-24.2 libksuseinstall1-debuginfo-32bit-4.14.9-24.2 - openSUSE 13.2 (noarch): kdelibs4-apidocs-4.14.9-24.2 References:

1 0

openSUSE-SU-2015:1155-1: Security update for roundcubemail
by opensuse-security＠opensuse.org 29 Jun '15

29 Jun '15

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1155-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: roundcubemail was updated to version 1.0.6 to fix many minor bugs and two security issues. The security-related fixes in particular are: - security improvement in DBMail driver of password plugin - security improvement in contact photo handling Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-454=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): roundcubemail-1.0.6-11.1 References:

1 0

openSUSE-RU-2015:1153-1: moderate: Recommended update for apache2
by maintenance＠opensuse.org 26 Jun '15

26 Jun '15

openSUSE Recommended Update: Recommended update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1153-1 Rating: moderate References: #930228 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for apache2 fixes the following issue: - fix 2.4.10 regression when some LDAP searches or comparisons might be done with the wrong credentials when a backend connection is reused [bnc#930228] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-452=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-2.4.10-25.1 apache2-debuginfo-2.4.10-25.1 apache2-debugsource-2.4.10-25.1 apache2-devel-2.4.10-25.1 apache2-event-2.4.10-25.1 apache2-event-debuginfo-2.4.10-25.1 apache2-example-pages-2.4.10-25.1 apache2-prefork-2.4.10-25.1 apache2-prefork-debuginfo-2.4.10-25.1 apache2-utils-2.4.10-25.1 apache2-utils-debuginfo-2.4.10-25.1 apache2-worker-2.4.10-25.1 apache2-worker-debuginfo-2.4.10-25.1 - openSUSE 13.2 (noarch): apache2-doc-2.4.10-25.1 References: https://bugzilla.suse.com/930228

1 0

openSUSE-RU-2015:1151-1: Softwarestack update for openSUSE 13.2
by maintenance＠opensuse.org 26 Jun '15

26 Jun '15

openSUSE Recommended Update: Softwarestack update for openSUSE 13.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1151-1 Rating: low References: #725867 #820693 #832519 #897301 #899510 #903405 #923800 #925678 #925696 #929483 #929528 #929593 #929990 #931601 #932393 #933277 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 16 recommended fixes can now be installed. Description: This recommended update for the Softwarestack fixes the following issues: - zypper: + man: add section about GPG checks + repos/services: Show GPG Check status + Handle pkgGpgCheck callback (fate#314603) + download: fix wrong total (=0) counter in download message + download: actually abort on user request. + Clarify comment in zypper.conf (bnc#820693) + Fix format of sizes in output (bnc#897301) + Adapt enterprise product detection (bnc#933277) + removerepo: Warn user that deleting a service repo is a volatile change (bnc#929990) + Clarify 'zypper lp --date' description (bnc#929593) + Don't use color in XML mode. + fix table sort (bnc#832519) + only use ANSI codes on terminals (bnc#925678) + Fix prompt returning undefined default value after wrong input (bnc#925696) + man: fix typo (bnc#923800) + suppress MediaChangeReport while testing multiple baseurls (bnc#899510) + allow repo:package to reinstall from a different repo (bnc#725867) + fix wrong description of --force-resolution defaults + Updated translations - libzypp: + zypp.conf: Add config values for gpgcheck, repo_gpgcheck and pkg_gpgcheck. The default behavior 'gpgcheck=On' will automatically turn on the gpg signature check for packages downloaded from repository with unsigned metadata. If the repo metadata are signed, a faster comparison via checksums is done. By explicitly setting repo_gpgcheck or pkg_gpgcheck you can enforce the signature check of repository metadata or downloaded packages to be always performed. Those defaults can be overwritten per repository. (FATE#314603) + Downloader: Accept unsigned repository if pkgGpgCheck is ON. + Fix SSL client certificate authentication via URL option ssl_clientcert/ssl_clientkey (bnc#932393) + FindFileConflicts: avoid nested exception on user abort (bnc#931601) + Fix repo alias containing ']' not handled correctly (bnc#929528) + Fix SEGV when dumping rpm header with epoch (bnc#929483) + POODLE: libzypp should only talk TLS (bnc#903405) + Suppress MediaChangeReport while testing multiple baseurls (bnc#899510) - libsolv: + add forgotten sha-512 support to data_skip + speed up whatprovides lookup with a new helper array + fix dup with allowuninstall + improve alreadyinstalled handling of supplements + you really want to use rbconfig there Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-453=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): PackageKit-1.0.3-13.1 PackageKit-backend-zypp-1.0.3-13.1 PackageKit-backend-zypp-debuginfo-1.0.3-13.1 PackageKit-browser-plugin-1.0.3-13.1 PackageKit-browser-plugin-debuginfo-1.0.3-13.1 PackageKit-debuginfo-1.0.3-13.1 PackageKit-debugsource-1.0.3-13.1 PackageKit-devel-1.0.3-13.1 PackageKit-devel-debuginfo-1.0.3-13.1 PackageKit-gstreamer-plugin-1.0.3-13.1 PackageKit-gstreamer-plugin-debuginfo-1.0.3-13.1 PackageKit-gtk3-module-1.0.3-13.1 PackageKit-gtk3-module-debuginfo-1.0.3-13.1 libpackagekit-glib2-18-1.0.3-13.1 libpackagekit-glib2-18-debuginfo-1.0.3-13.1 libpackagekit-glib2-devel-1.0.3-13.1 libsolv-debugsource-0.6.11-13.1 libsolv-demo-0.6.11-13.1 libsolv-demo-debuginfo-0.6.11-13.1 libsolv-devel-0.6.11-13.1 libsolv-devel-debuginfo-0.6.11-13.1 libsolv-tools-0.6.11-13.1 libsolv-tools-debuginfo-0.6.11-13.1 libyui-gtk-pkg-debugsource-2.43.2-2.8.1 libyui-gtk-pkg-devel-2.43.2-2.8.1 libyui-gtk-pkg6-2.43.2-2.8.1 libyui-gtk-pkg6-debuginfo-2.43.2-2.8.1 libyui-ncurses-pkg-debugsource-2.46.1-2.8.1 libyui-ncurses-pkg-devel-2.46.1-2.8.1 libyui-ncurses-pkg6-2.46.1-2.8.1 libyui-ncurses-pkg6-debuginfo-2.46.1-2.8.1 libyui-qt-pkg-debugsource-2.44.7-8.1 libyui-qt-pkg-devel-2.44.7-8.1 libyui-qt-pkg6-2.44.7-8.1 libyui-qt-pkg6-debuginfo-2.44.7-8.1 libzypp-14.39.0-25.1 libzypp-bindings-debugsource-0.6.4-14.1 libzypp-debuginfo-14.39.0-25.1 libzypp-debugsource-14.39.0-25.1 libzypp-devel-14.39.0-25.1 libzypp-devel-doc-14.39.0-25.1 perl-solv-0.6.11-13.1 perl-solv-debuginfo-0.6.11-13.1 perl-zypp-0.6.4-14.1 perl-zypp-debuginfo-0.6.4-14.1 python-solv-0.6.11-13.1 python-solv-debuginfo-0.6.11-13.1 python-zypp-0.6.4-14.1 python-zypp-debuginfo-0.6.4-14.1 ruby-solv-0.6.11-13.1 ruby-solv-debuginfo-0.6.11-13.1 ruby-zypp-0.6.4-14.1 ruby-zypp-debuginfo-0.6.4-14.1 typelib-1_0-PackageKitGlib-1_0-1.0.3-13.1 yast2-pkg-bindings-3.1.20-8.1 yast2-pkg-bindings-debuginfo-3.1.20-8.1 yast2-pkg-bindings-debugsource-3.1.20-8.1 zypper-1.11.32-22.1 zypper-debuginfo-1.11.32-22.1 zypper-debugsource-1.11.32-22.1 - openSUSE 13.2 (x86_64): libpackagekit-glib2-18-32bit-1.0.3-13.1 libpackagekit-glib2-18-debuginfo-32bit-1.0.3-13.1 libpackagekit-glib2-devel-32bit-1.0.3-13.1 - openSUSE 13.2 (noarch): PackageKit-branding-upstream-1.0.3-13.1 PackageKit-lang-1.0.3-13.1 libyui-gtk-pkg-doc-2.43.2-2.8.1 libyui-ncurses-pkg-doc-2.46.1-2.8.1 libyui-qt-pkg-doc-2.44.7-8.1 yast2-pkg-bindings-devel-doc-3.1.20-8.1 zypper-aptitude-1.11.32-22.1 zypper-log-1.11.32-22.1 References: https://bugzilla.suse.com/725867 https://bugzilla.suse.com/820693 https://bugzilla.suse.com/832519 https://bugzilla.suse.com/897301 https://bugzilla.suse.com/899510 https://bugzilla.suse.com/903405 https://bugzilla.suse.com/923800 https://bugzilla.suse.com/925678 https://bugzilla.suse.com/925696 https://bugzilla.suse.com/929483 https://bugzilla.suse.com/929528 https://bugzilla.suse.com/929593 https://bugzilla.suse.com/929990 https://bugzilla.suse.com/931601 https://bugzilla.suse.com/932393 https://bugzilla.suse.com/933277

1 0

openSUSE-SU-2015:1148-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1148-1 Rating: important References: #935701 Cross-References: CVE-2015-3113 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.468 to fix one security issue. The following vulnerability was fixed: * CVE-2015-3113: A heap buffer overflow vulnerability could have allowed code execution (bsc#935701, APSB15-14) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-450=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-450=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.468-2.58.1 flash-player-gnome-11.2.202.468-2.58.1 flash-player-kde4-11.2.202.468-2.58.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.468-123.1 flash-player-gnome-11.2.202.468-123.1 flash-player-kde4-11.2.202.468-123.1 References: https://www.suse.com/security/cve/CVE-2015-3113.html https://bugzilla.suse.com/935701

1 0

openSUSE-RU-2015:1147-1: moderate: Recommended update for timezone, timezone-java
by maintenance＠opensuse.org 26 Jun '15

26 Jun '15

openSUSE Recommended Update: Recommended update for timezone, timezone-java ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1147-1 Rating: moderate References: #934654 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The timezone database was updated to 2015e: [boo#934654] * Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00, not 06-13 and 07-18 as guessed. * Assume Cayman Islands will observe DST starting next year, using US rules. * The file 'iso3166.tab' now uses UTF-8 * When displaying data, tzselect converts it to the current locale's encoding if the iconv command works. * tzselect no longer mishandles Dominica, fixing a bug introduced in Release 2014f. * zic -l no longer fails when compiled with -DTZDEFAULT=\"/etc/localtime\", regression from 2014f. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-451=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-451=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2015e-26.1 timezone-debuginfo-2015e-26.1 timezone-debugsource-2015e-26.1 - openSUSE 13.2 (noarch): timezone-java-2015e-26.1 - openSUSE 13.1 (i586 x86_64): timezone-2015e-31.1 timezone-debuginfo-2015e-31.1 timezone-debugsource-2015e-31.1 - openSUSE 13.1 (noarch): timezone-java-2015e-31.1 References: https://bugzilla.suse.com/934654

1 0

openSUSE-SU-2015:1146-1: moderate: Security update for chromium
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1146-1 Rating: moderate References: #935022 #935723 Cross-References: CVE-2015-1266 CVE-2015-1267 CVE-2015-1268 CVE-2015-1269 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: chromium was updated to 43.0.2357.130 to fix several security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-1266: Scheme validation error in WebUI * CVE-2015-1268: Cross-origin bypass in Blink * CVE-2015-1267: Cross-origin bypass in Blink * CVE-2015-1269: Normalization error in HSTS/HPKP preload list * boo#935022: Prevent Chromium from downloading a binary blob for speech recognition Contains the following non-security changes: * resolved browser font magnification/scaling issue. * Fixed an issue where sometimes a blank page would print * Icons not displaying properly on Linux Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-449=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-449=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-43.0.2357.130-34.1 chromedriver-debuginfo-43.0.2357.130-34.1 chromium-43.0.2357.130-34.1 chromium-debuginfo-43.0.2357.130-34.1 chromium-debugsource-43.0.2357.130-34.1 chromium-desktop-gnome-43.0.2357.130-34.1 chromium-desktop-kde-43.0.2357.130-34.1 chromium-ffmpegsumo-43.0.2357.130-34.1 chromium-ffmpegsumo-debuginfo-43.0.2357.130-34.1 - openSUSE 13.1 (i586 x86_64): chromedriver-43.0.2357.130-89.1 chromedriver-debuginfo-43.0.2357.130-89.1 chromium-43.0.2357.130-89.1 chromium-debuginfo-43.0.2357.130-89.1 chromium-debugsource-43.0.2357.130-89.1 chromium-desktop-gnome-43.0.2357.130-89.1 chromium-desktop-kde-43.0.2357.130-89.1 chromium-ffmpegsumo-43.0.2357.130-89.1 chromium-ffmpegsumo-debuginfo-43.0.2357.130-89.1 References: https://www.suse.com/security/cve/CVE-2015-1266.html https://www.suse.com/security/cve/CVE-2015-1267.html https://www.suse.com/security/cve/CVE-2015-1268.html https://www.suse.com/security/cve/CVE-2015-1269.html https://bugzilla.suse.com/935022 https://bugzilla.suse.com/935723

1 0

openSUSE-RU-2015:1140-1: moderate: Recommended update for iproute2
by maintenance＠opensuse.org 25 Jun '15

25 Jun '15

openSUSE Recommended Update: Recommended update for iproute2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1140-1 Rating: moderate References: #934828 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for iproute2 fixes the following issue: - Update iproute2-dirs.diff to respect /usr/share/tc [bnc#934828] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-448=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): iproute2-3.16-2.7.1 iproute2-debuginfo-3.16-2.7.1 iproute2-debugsource-3.16-2.7.1 libnetlink-devel-3.16-2.7.1 - openSUSE 13.2 (noarch): iproute2-doc-3.16-2.7.1 References: https://bugzilla.suse.com/934828

1 0

openSUSE-SU-2015:1139-1: important: Security update for openssl
by opensuse-security＠opensuse.org 25 Jun '15

25 Jun '15

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1139-1 Rating: important References: #931698 #933898 #933911 #934487 #934489 #934491 #934493 #934494 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: openssl was updated to fix six security issues. The following vulnerabilities were fixed: * CVE-2015-4000: The Logjam Attack / weakdh.org. Rject connections with DH parameters shorter than 768 bits, generates 2048-bit DH parameters by default. (boo#931698) * CVE-2015-1788: Malformed ECParameters causes infinite loop (boo#934487) * CVE-2015-1789: Exploitable out-of-bounds read in X509_cmp_time (boo#934489) * CVE-2015-1790: PKCS7 crash with missing EnvelopedContent (boo#934491) * CVE-2015-1792: CMS verify infinite loop with unknown hash function (boo#934493) * CVE-2015-1791: race condition in NewSessionTicket (boo#933911) * CVE-2015-3216: Crash in ssleay_rand_bytes due to locking regression (boo#933898) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-447=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-447=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.24.1 libopenssl1_0_0-1.0.1k-2.24.1 libopenssl1_0_0-debuginfo-1.0.1k-2.24.1 libopenssl1_0_0-hmac-1.0.1k-2.24.1 openssl-1.0.1k-2.24.1 openssl-debuginfo-1.0.1k-2.24.1 openssl-debugsource-1.0.1k-2.24.1 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.24.1 libopenssl1_0_0-32bit-1.0.1k-2.24.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.24.1 libopenssl1_0_0-hmac-32bit-1.0.1k-2.24.1 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.24.1 - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.72.1 libopenssl1_0_0-1.0.1k-11.72.1 libopenssl1_0_0-debuginfo-1.0.1k-11.72.1 openssl-1.0.1k-11.72.1 openssl-debuginfo-1.0.1k-11.72.1 openssl-debugsource-1.0.1k-11.72.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.72.1 libopenssl1_0_0-32bit-1.0.1k-11.72.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.72.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.72.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://bugzilla.suse.com/934494

1 0

openSUSE-SU-2015:1135-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1135-1 Rating: moderate References: #851126 #934501 #934502 Cross-References: CVE-2015-3236 CVE-2015-3237 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: Curl was updated to fix two security issues and enable metalink support The following vulnerabilities were fixed: * CVE-2015-3236: libcurl could have wrongly send HTTP credentials when re-using connections (boo#934501) * CVE-2015-3237: libcurl could have been tricked by a malicious SMB server to send off data it did not intend to (boo#934502) The following feature was enabled: * boo#851126: enable metalink support. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-446=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-446=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): curl-7.42.1-16.1 curl-debuginfo-7.42.1-16.1 curl-debugsource-7.42.1-16.1 libcurl-devel-7.42.1-16.1 libcurl4-7.42.1-16.1 libcurl4-debuginfo-7.42.1-16.1 - openSUSE 13.2 (x86_64): libcurl-devel-32bit-7.42.1-16.1 libcurl4-32bit-7.42.1-16.1 libcurl4-debuginfo-32bit-7.42.1-16.1 - openSUSE 13.1 (i586 x86_64): curl-7.42.1-2.47.1 curl-debuginfo-7.42.1-2.47.1 curl-debugsource-7.42.1-2.47.1 libcurl-devel-7.42.1-2.47.1 libcurl4-7.42.1-2.47.1 libcurl4-debuginfo-7.42.1-2.47.1 - openSUSE 13.1 (x86_64): libcurl-devel-32bit-7.42.1-2.47.1 libcurl4-32bit-7.42.1-2.47.1 libcurl4-debuginfo-32bit-7.42.1-2.47.1 References: https://www.suse.com/security/cve/CVE-2015-3236.html https://www.suse.com/security/cve/CVE-2015-3237.html https://bugzilla.suse.com/851126 https://bugzilla.suse.com/934501 https://bugzilla.suse.com/934502

1 0