August 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:1462-1: Recommended update for the GNOME-stack
by maintenance＠opensuse.org 31 Aug '15

31 Aug '15

openSUSE Recommended Update: Recommended update for the GNOME-stack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1462-1 Rating: low References: #938799 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides various fixes and improvements for the GNOME-stack: - gedit (3.14.3 -> 3.14.4): + Various bug fixes + Updated translations - gnome-initial-setup (3.14.2.1 -> 3.14.4): + Deal gracefully with absence of goa. + Updated translations. + Fix a crash in the network page. + Append ibus sources to input sources list. + Allow resizing on small screens. + Use header bars on goa dialogs. + Fix a crash in the language page. + Hide the window instead of letting gdm kill it. + Fix a crash in the keyboard page. + Updated translations. - gnome-packagekit (3.14.2 -> 3.14.3): + Bugfix: Don't use the gtk namespace for local functions. + Updated translations. - gnome-software (3.14.1 -> 3.14.7): + Show installation progress when installing apps. + Make sure apps that aren't installable are properly hidden in the category view. + Show a better UI for offline update failure dialog. + Several improvements to the sources dialog. + Fix a frequent crash in appstream plugin. + Fix a critical warning when opening the app folder dialog. + Fix a possible crash when changing the download-updates option in gsettings. + Fix a possible crash when dealing with apps that have no desktop ID associated. + Fix a crash with invalid screenshot URLs in appstream data. + Fix an issue that caused "Source: Unknown" to be shown on the details page even though the source info was available. + Update the styling of the history and sources dialogs to make sure unclickable rows don't appear clickable. + Correct the desktop file name for gnome-chess. + Hide updates UI on managed systems. + Workaround text coming up as selected in the updates dialog. + Fix a crash in the screenshot loader. + Fix a crash when installing rpms that lack description. + Wrap long descriptions in the update dialog. + Reduce network timeouts to one minute. + Avoid scaled up fonts on non-HiDPI displays. + Correctly save HiDPI images to HiDPI directories. + Scroll the contents of the error message dialog. + Correctly show the category for apps that only have a top-level category. + Fix a possible crash in the category code. + Fix a possible crash when pending apps change. + Updated translations. + Add the origin as a keyword if it's not the majority source. + Support the LOCAL AppStream icon type. + Do not fail to get popular apps if the AppStream data is invalid. + Do not show a random white line above the star rating widget. + Do not show empty app boxes if no popular results are available. + Do not try to download local web-app icons. + Fix screenshot loading with --details. + Use blue stars for the user-ratings rather than yellow/gold. - gtk3 (3.14.13 -> 3.14.15): + listbox: listen for adjustment changes. + Many coverity warning fixes. + Various other upstream-bugs fixed * bgo#741800, bgo#751401, bgo#752016,bgo#693738, bgo#738083, bgo#745957, bgo#750011, bgo#750605, bgo#750690, bgo#750870, bgo#750994, bgo#751050, bgo#751227, bgo#751443, bgo#751739, bgo#751752 + Updated translations. - nautilus (3.14.2 -> 3.14.3): + Don't create a window at start when using desktop. + Avoid unreadable names in list view. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-561=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): gedit-3.14.4-11.3 gedit-debuginfo-3.14.4-11.3 gedit-debugsource-3.14.4-11.3 gedit-devel-3.14.4-11.3 gnome-initial-setup-3.14.4-7.1 gnome-initial-setup-debuginfo-3.14.4-7.1 gnome-initial-setup-debugsource-3.14.4-7.1 gnome-packagekit-3.14.3-8.1 gnome-packagekit-debuginfo-3.14.3-8.1 gnome-packagekit-debugsource-3.14.3-8.1 gnome-packagekit-extras-3.14.3-8.1 gnome-packagekit-extras-debuginfo-3.14.3-8.1 gnome-shell-search-provider-nautilus-3.14.3-15.1 gnome-software-3.14.7-12.3 gnome-software-debuginfo-3.14.7-12.3 gnome-software-debugsource-3.14.7-12.3 gtk3-debugsource-3.14.15-21.1 gtk3-devel-3.14.15-21.1 gtk3-devel-debuginfo-3.14.15-21.1 gtk3-immodule-amharic-3.14.15-21.1 gtk3-immodule-amharic-debuginfo-3.14.15-21.1 gtk3-immodule-broadway-3.14.15-21.1 gtk3-immodule-broadway-debuginfo-3.14.15-21.1 gtk3-immodule-inuktitut-3.14.15-21.1 gtk3-immodule-inuktitut-debuginfo-3.14.15-21.1 gtk3-immodule-multipress-3.14.15-21.1 gtk3-immodule-multipress-debuginfo-3.14.15-21.1 gtk3-immodule-thai-3.14.15-21.1 gtk3-immodule-thai-debuginfo-3.14.15-21.1 gtk3-immodule-vietnamese-3.14.15-21.1 gtk3-immodule-vietnamese-debuginfo-3.14.15-21.1 gtk3-immodule-xim-3.14.15-21.1 gtk3-immodule-xim-debuginfo-3.14.15-21.1 gtk3-immodules-tigrigna-3.14.15-21.1 gtk3-immodules-tigrigna-debuginfo-3.14.15-21.1 gtk3-tools-3.14.15-21.1 gtk3-tools-debuginfo-3.14.15-21.1 libgtk-3-0-3.14.15-21.1 libgtk-3-0-debuginfo-3.14.15-21.1 libnautilus-extension1-3.14.3-15.1 libnautilus-extension1-debuginfo-3.14.3-15.1 nautilus-3.14.3-15.1 nautilus-debuginfo-3.14.3-15.1 nautilus-debugsource-3.14.3-15.1 nautilus-devel-3.14.3-15.1 python3-gedit-3.14.4-11.3 typelib-1_0-Gtk-3_0-3.14.15-21.1 typelib-1_0-Nautilus-3_0-3.14.3-15.1 - openSUSE 13.2 (x86_64): gtk3-devel-32bit-3.14.15-21.1 gtk3-devel-debuginfo-32bit-3.14.15-21.1 gtk3-immodule-amharic-32bit-3.14.15-21.1 gtk3-immodule-amharic-debuginfo-32bit-3.14.15-21.1 gtk3-immodule-inuktitut-32bit-3.14.15-21.1 gtk3-immodule-inuktitut-debuginfo-32bit-3.14.15-21.1 gtk3-immodule-multipress-32bit-3.14.15-21.1 gtk3-immodule-multipress-debuginfo-32bit-3.14.15-21.1 gtk3-immodule-thai-32bit-3.14.15-21.1 gtk3-immodule-thai-debuginfo-32bit-3.14.15-21.1 gtk3-immodule-vietnamese-32bit-3.14.15-21.1 gtk3-immodule-vietnamese-debuginfo-32bit-3.14.15-21.1 gtk3-immodule-xim-32bit-3.14.15-21.1 gtk3-immodule-xim-debuginfo-32bit-3.14.15-21.1 gtk3-immodules-tigrigna-32bit-3.14.15-21.1 gtk3-immodules-tigrigna-debuginfo-32bit-3.14.15-21.1 gtk3-tools-32bit-3.14.15-21.1 gtk3-tools-debuginfo-32bit-3.14.15-21.1 libgtk-3-0-32bit-3.14.15-21.1 libgtk-3-0-debuginfo-32bit-3.14.15-21.1 libnautilus-extension1-32bit-3.14.3-15.1 libnautilus-extension1-debuginfo-32bit-3.14.3-15.1 - openSUSE 13.2 (noarch): gedit-lang-3.14.4-11.3 gnome-initial-setup-lang-3.14.4-7.1 gnome-packagekit-lang-3.14.3-8.1 gnome-software-lang-3.14.7-12.3 gtk3-branding-SLED-13.2-20.1 gtk3-branding-openSUSE-13.2-19.1 gtk3-branding-upstream-3.14.15-21.1 gtk3-data-3.14.15-21.1 gtk3-lang-3.14.15-21.1 nautilus-lang-3.14.3-15.1 References: https://bugzilla.suse.com/938799

1 0

openSUSE-OU-2015:1461-1: moderate: Optional update for xtables-geoip
by maintenance＠opensuse.org 31 Aug '15

31 Aug '15

openSUSE Optional Update: Optional update for xtables-geoip ______________________________________________________________________________ Announcement ID: openSUSE-OU-2015:1461-1 Rating: moderate References: Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has 0 optional fixes can now be installed. Description: xtables-geoip was updated to the 2015.08 version of the MaxMind GeoLite database. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-564=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-564=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): xtables-geoip-2015.08-2.3.1 - openSUSE 13.1 (noarch): xtables-geoip-2015.08-2.3.1 References:

1 0

openSUSE-RU-2015:1460-1: Recommended update for ca-certificates-cacert
by maintenance＠opensuse.org 31 Aug '15

31 Aug '15

openSUSE Recommended Update: Recommended update for ca-certificates-cacert ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1460-1 Rating: low References: #86884 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides the following fix for ca-certificates-cacert: - replaced the "Class 3 PKI Key" by the current version. Changes its signature algorithm from RSA-MD5 to RSA-SHA256. (bnc#868884) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-562=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): ca-certificates-cacert-1-15.3.1 References: https://bugzilla.suse.com/86884

1 0

openSUSE-RU-2015:1459-1: Recommended update to time zone database 2015f
by maintenance＠opensuse.org 31 Aug '15

31 Aug '15

openSUSE Recommended Update: Recommended update to time zone database 2015f ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1459-1 Rating: low References: #941249 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The time zone database was updated to 2015f, incorporating the following changes: * North Korea switches to +0830 on 2015-08-15, abbreviation remains "KST". * Uruguay no longer observes DST. * Moldova starts and ends DST at 00:00 UTC, not at 01:00 UTC. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-563=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-563=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2015f-29.1 timezone-debuginfo-2015f-29.1 timezone-debugsource-2015f-29.1 - openSUSE 13.2 (noarch): timezone-java-2015f-29.1 - openSUSE 13.1 (i586 x86_64): timezone-2015f-34.1 timezone-debuginfo-2015f-34.1 timezone-debugsource-2015f-34.1 - openSUSE 13.1 (noarch): timezone-java-2015f-34.1 References: https://bugzilla.suse.com/941249

1 0

openSUSE-RU-2015:1458-1: Recommended update for Docker, Go, golang-github-russross-blackfriday and golang-github-cpuguy83-go-md2man
by maintenance＠opensuse.org 31 Aug '15

31 Aug '15

openSUSE Recommended Update: Recommended update for Docker, Go, golang-github-russross-blackfriday and golang-github-cpuguy83-go-md2man ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1458-1 Rating: low References: #818502 #898901 #931301 #935570 #939067 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This recommended update for Docker, go, golang-github-russross-blackfriday and golang-github-cpuguy83-go-md2man provides the following fixes and improvements: - Docker + Update from version 1.6.1 to 1.7.0 * introduce go_arches for architectures that use the go compiler instead of gcc-go * enable build for aarch64 * Runtime - Experimental feature: support for out-of-process volume plugins - The userland proxy can be disabled in favor of hairpin NAT using the daemon’s `--userland-proxy=false` flag - The `exec` command supports the `-u|--user` flag to specify the new process owner - Default gateway for containers can be specified daemon-wide using the `--default-gateway` and `--default-gateway-v6` flags - The CPU CFS (Completely Fair Scheduler) quota can be set in `docker run` using `--cpu-quota` - Container block IO can be controlled in `docker run` using`--blkio-weight` - ZFS support - The `docker logs` command supports a `--since` argument - UTS namespace can be shared with the host with `docker run --uts=host` * Quality - Networking stack was entirely rewritten as part of the libnetwork effort - Engine internals refactoring - Volumes code was entirely rewritten to support the plugins effort - Sending SIGUSR1 to a daemon will dump all goroutines stacks without exiting * Build - Support ${variable:-value} and ${variable:+value} syntax for environment variables - Support resource management flags `--cgroup-parent`, `--cpu-period`, `--cpu-quota`, `--cpuset-cpus`, `--cpuset-mems` - git context changes with branches and directories - The .dockerignore file support exclusion rules * Distribution - Client support for v2 mirroring support for the official registry * Bugfixes - Firewalld is now supported and will automatically be used when available - mounting --device recursively * Build docker on PPC and S390x using gcc-go provided by gcc5 - added sysconfig.docker.ppc64le: make docker daemon start on ppc64le despite some iptables issues. To be removed soon - ignore-dockerinit-checksum.patch: applied only when building with gcc-go. Required to workaround a limitation of gcc-go - gcc-go-build-static-libgo.patch: used only when building with gcc-go, link libgo statically into docker itself. * build and install man pages + * re-enable debug_packge/debug_install_post macros from goprep() + * add ldflags to gobuild() to compute BUILD ID for debuginfo package * Revert change prohibiting mounting into /sys + Get rid of SocketUser and SocketGroup workarounds for docker.socket - Go + Update from version 1.3.3 to 1.4.2 * macros.go: - fix missing quotes in %goinstall (bsc#939067) - fix "summary-not-capitalized" - doc can't properly describe what the sub-package really is, and they're mostly source codes instead of the claimed "API, documentation, and examples". so rename to *-source. and not recommend to install them to save users' disk space. - %%go_requires should be handled automatically by golang-packaging - not recommend to install source package any more, so %%go_recommmends set to nil. - add a "WITH_FAKE_BUILDID" option to enable the fake build ID compution. - to fake build ID, you have to make sure your package has only one binary. It is nonsense that two or more nonidentical binaries have the same build ID. - re-enable debug_packge/debug_install_post macros from goprep() - add ldflags to gobuild() to compute BUILD ID for debuginfo package * cmd/ld: set alignment for the .rel.plt section on 32-bit architectures * go itself doesn't support BUILD ID yet * force Go to look for certificates only in the locations available on openSUSE and SLE. Also ensure certificates are found on SLE11 * This fixes i586 builds for openSUSE:Factory: - Too many levels of recursion in macro expansion - Failed to write file: invalid section alignment * Added Obsoletes for go-vim/emacs, they went to separate projects * Fix dangling-symlink /usr/lib64/go/src/pkg /usr/share/go/src/pkg * Support of editors has been dropped - golang-org-x-text + Initial update with version 1.4.2 * x-test holds supplementary Go libraries for text processing, many involving Unicode. - golang-org-x-net + Initial update with version 1.4.2 * x-net contains additional go.network libraries such as the websocket and SPDY protocols that are developed by the Go team but outside of the main source tree. - golang-github-russross-blackfriday + Initial update with version 1.2 * blackfriday is a Markdown processor implemented in Go. It is paranoid about its input (so you can safely feed it user-supplied data), it is fast, it supports common extensions (tables, smart punctuation substitutions, etc.), and it is safe for all utf-8 (unicode) input. * HTML output is currently supported, along with Smartypants extensions. An experimental LaTeX output engine is also included. - golang-github-cpuguy83-go-md2man + Initial update with version 1.0.2 * Tool to converts markdown into man pages Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-560=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): go-1.4.2-12.1 go-debuginfo-1.4.2-12.1 go-debugsource-1.4.2-12.1 go-doc-1.4.2-12.1 golang-github-cpuguy83-go-md2man-1.0.2+git20150617.e69ac41-2.2 golang-github-cpuguy83-go-md2man-debuginfo-1.0.2+git20150617.e69ac41-2.2 golang-github-cpuguy83-go-md2man-source-1.0.2+git20150617.e69ac41-2.2 golang-github-russross-blackfriday-1.2.0+git20150720.8cec3a8-2.3 golang-github-russross-blackfriday-source-1.2.0+git20150720.8cec3a8-2.3 golang-github-shurcool-sanitized_anchor_name-0.0.0+git20150514.11a20b7-2.2 golang-github-shurcool-sanitized_anchor_name-source-0.0.0+git20150514.11a20b7-2.2 golang-org-x-net-1.4.2+git20150629.d9558e5-2.3 golang-org-x-net-source-1.4.2+git20150629.d9558e5-2.3 golang-org-x-text-1.4.2+git20150710.7c0e16d-2.2 golang-org-x-text-debuginfo-1.4.2+git20150710.7c0e16d-2.2 golang-org-x-text-source-1.4.2+git20150710.7c0e16d-2.2 golang-packaging-6-2.1 - openSUSE 13.2 (x86_64): docker-1.7.1-34.3 docker-debuginfo-1.7.1-34.3 docker-debugsource-1.7.1-34.3 - openSUSE 13.2 (noarch): docker-bash-completion-1.7.1-34.3 docker-test-1.7.1-34.3 docker-zsh-completion-1.7.1-34.3 References: https://bugzilla.suse.com/818502 https://bugzilla.suse.com/898901 https://bugzilla.suse.com/931301 https://bugzilla.suse.com/935570 https://bugzilla.suse.com/939067

1 0

openSUSE-SU-2015:1454-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Aug '15

28 Aug '15

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1454-1 Rating: moderate References: #940806 Cross-References: CVE-2015-4473 CVE-2015-4475 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update to Thunderbird 38.2.0 fixes the following issues (bnc#940806): * MFSA 2015-79/CVE-2015-4473 Miscellaneous memory safety hazards * MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file * MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 Overflow issues in libstagefright * MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file overwriting through Mozilla Maintenance Service with hard links (only affected Windows) * MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds write with Updater and malicious MAR file (does not affect openSUSE RPM packages which do not ship the updater) * MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript * MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection * MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-558=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-38.2.0-70.60.2 MozillaThunderbird-buildsymbols-38.2.0-70.60.2 MozillaThunderbird-debuginfo-38.2.0-70.60.2 MozillaThunderbird-debugsource-38.2.0-70.60.2 MozillaThunderbird-devel-38.2.0-70.60.2 MozillaThunderbird-translations-common-38.2.0-70.60.2 MozillaThunderbird-translations-other-38.2.0-70.60.2 References: https://www.suse.com/security/cve/CVE-2015-4473.html https://www.suse.com/security/cve/CVE-2015-4475.html https://www.suse.com/security/cve/CVE-2015-4478.html https://www.suse.com/security/cve/CVE-2015-4479.html https://www.suse.com/security/cve/CVE-2015-4480.html https://www.suse.com/security/cve/CVE-2015-4481.html https://www.suse.com/security/cve/CVE-2015-4482.html https://www.suse.com/security/cve/CVE-2015-4484.html https://www.suse.com/security/cve/CVE-2015-4485.html https://www.suse.com/security/cve/CVE-2015-4486.html https://www.suse.com/security/cve/CVE-2015-4487.html https://www.suse.com/security/cve/CVE-2015-4488.html https://www.suse.com/security/cve/CVE-2015-4489.html https://www.suse.com/security/cve/CVE-2015-4491.html https://www.suse.com/security/cve/CVE-2015-4492.html https://www.suse.com/security/cve/CVE-2015-4493.html https://bugzilla.suse.com/940806

1 0

openSUSE-SU-2015:1453-1: moderate: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 28 Aug '15

28 Aug '15

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1453-1 Rating: moderate References: #940806 Cross-References: CVE-2015-4473 CVE-2015-4475 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This update to Thunderbird 38.2.0 fixes the following issues (bnc#940806): * MFSA 2015-79/CVE-2015-4473 Miscellaneous memory safety hazards * MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file * MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties * MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 Overflow issues in libstagefright * MFSA 2015-84/CVE-2015-4481 (bmo1171518) Arbitrary file overwriting through Mozilla Maintenance Service with hard links (only affected Windows) * MFSA 2015-85/CVE-2015-4482 (bmo#1184500) Out-of-bounds write with Updater and malicious MAR file (does not affect openSUSE RPM packages which do not ship the updater) * MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript * MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images * MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video * MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 Vulnerabilities found through code inspection * MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-559=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaThunderbird-38.2.0-25.2 MozillaThunderbird-buildsymbols-38.2.0-25.2 MozillaThunderbird-debuginfo-38.2.0-25.2 MozillaThunderbird-debugsource-38.2.0-25.2 MozillaThunderbird-devel-38.2.0-25.2 MozillaThunderbird-translations-common-38.2.0-25.2 MozillaThunderbird-translations-other-38.2.0-25.2 References: https://www.suse.com/security/cve/CVE-2015-4473.html https://www.suse.com/security/cve/CVE-2015-4475.html https://www.suse.com/security/cve/CVE-2015-4478.html https://www.suse.com/security/cve/CVE-2015-4479.html https://www.suse.com/security/cve/CVE-2015-4480.html https://www.suse.com/security/cve/CVE-2015-4481.html https://www.suse.com/security/cve/CVE-2015-4482.html https://www.suse.com/security/cve/CVE-2015-4484.html https://www.suse.com/security/cve/CVE-2015-4485.html https://www.suse.com/security/cve/CVE-2015-4486.html https://www.suse.com/security/cve/CVE-2015-4487.html https://www.suse.com/security/cve/CVE-2015-4488.html https://www.suse.com/security/cve/CVE-2015-4489.html https://www.suse.com/security/cve/CVE-2015-4491.html https://www.suse.com/security/cve/CVE-2015-4492.html https://www.suse.com/security/cve/CVE-2015-4493.html https://bugzilla.suse.com/940806

1 0

openSUSE-SU-2015:1452-1: moderate: Security update for ansible
by opensuse-security＠opensuse.org 28 Aug '15

28 Aug '15

openSUSE Security Update: Security update for ansible ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1452-1 Rating: moderate References: #941863 Cross-References: CVE-2015-3908 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Fix CVE-2015-3908 to remove tabs and use spaces instead. This broke python parsing and in consequence Ansible. (bnc #941863) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-557=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): ansible-1.7.1-2.8.1 References: https://www.suse.com/security/cve/CVE-2015-3908.html https://bugzilla.suse.com/941863

1 0

openSUSE-RU-2015:1440-1: moderate: Recommended update for subversion
by maintenance＠opensuse.org 26 Aug '15

26 Aug '15

openSUSE Recommended Update: Recommended update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:1440-1 Rating: moderate References: #942819 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Apache Subversion was updated to fix one packaging bug introduced in a previous update. The following bug was fixed: * boo#942819: subversion would cause a large number of new packages to be recommended for installation in minimal installs due to new Recommendation of subversion-password-store Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-556=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.14-2.20.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.14-2.20.1 libsvn_auth_kwallet-1-0-1.8.14-2.20.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.14-2.20.1 subversion-1.8.14-2.20.1 subversion-debuginfo-1.8.14-2.20.1 subversion-debugsource-1.8.14-2.20.1 subversion-devel-1.8.14-2.20.1 subversion-perl-1.8.14-2.20.1 subversion-perl-debuginfo-1.8.14-2.20.1 subversion-python-1.8.14-2.20.1 subversion-python-ctypes-1.8.14-2.20.1 subversion-python-debuginfo-1.8.14-2.20.1 subversion-ruby-1.8.14-2.20.1 subversion-ruby-debuginfo-1.8.14-2.20.1 subversion-server-1.8.14-2.20.1 subversion-server-debuginfo-1.8.14-2.20.1 subversion-tools-1.8.14-2.20.1 subversion-tools-debuginfo-1.8.14-2.20.1 - openSUSE 13.2 (noarch): subversion-bash-completion-1.8.14-2.20.1 References: https://bugzilla.suse.com/942819

1 0

openSUSE-SU-2015:1429-1: moderate: Security update for xfsprogs
by opensuse-security＠opensuse.org 24 Aug '15

24 Aug '15

openSUSE Security Update: Security update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1429-1 Rating: moderate References: #939367 Cross-References: CVE-2012-2150 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: xfsprogs was updated to fix one security vulnerability and bugs. - Handle unwanted data disclosure in xfs_metadump (bsc#939367, CVE-2012-2150) - Fix definition of leaf attribute block to avoid gcc optimization xfsprogs-fix-leaf-block-definition Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-555=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-555=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xfsprogs-3.2.1-2.3.1 xfsprogs-debuginfo-3.2.1-2.3.1 xfsprogs-debugsource-3.2.1-2.3.1 xfsprogs-devel-3.2.1-2.3.1 - openSUSE 13.1 (i586 x86_64): xfsprogs-3.1.11-2.3.1 xfsprogs-debuginfo-3.1.11-2.3.1 xfsprogs-debugsource-3.1.11-2.3.1 xfsprogs-devel-3.1.11-2.3.1 References: https://www.suse.com/security/cve/CVE-2012-2150.html https://bugzilla.suse.com/939367

1 0