July 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:1918-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 31 Jul '16

31 Jul '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1918-1 Rating: important References: #989901 Cross-References: CVE-2016-1705 CVE-2016-1706 CVE-2016-1707 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901): - CVE-2016-1706: Sandbox escape in PPAPI - CVE-2016-1707: URL spoofing on iOS - CVE-2016-1708: Use-after-free in Extensions - CVE-2016-1709: Heap-buffer-overflow in sfntly - CVE-2016-1710: Same-origin bypass in Blink - CVE-2016-1711: Same-origin bypass in Blink - CVE-2016-5127: Use-after-free in Blink - CVE-2016-5128: Same-origin bypass in V8 - CVE-2016-5129: Memory corruption in V8 - CVE-2016-5130: URL spoofing - CVE-2016-5131: Use-after-free in libxml - CVE-2016-5132: Limited same-origin bypass in Service Workers - CVE-2016-5133: Origin confusion in proxy authentication - CVE-2016-5134: URL leakage via PAC script - CVE-2016-5135: Content-Security-Policy bypass - CVE-2016-5136: Use after free in extensions - CVE-2016-5137: History sniffing with HSTS and CSP - CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-919=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-52.0.2743.82-150.1 chromedriver-debuginfo-52.0.2743.82-150.1 chromium-52.0.2743.82-150.1 chromium-debuginfo-52.0.2743.82-150.1 chromium-debugsource-52.0.2743.82-150.1 chromium-desktop-gnome-52.0.2743.82-150.1 chromium-desktop-kde-52.0.2743.82-150.1 chromium-ffmpegsumo-52.0.2743.82-150.1 chromium-ffmpegsumo-debuginfo-52.0.2743.82-150.1 References: https://www.suse.com/security/cve/CVE-2016-1705.html https://www.suse.com/security/cve/CVE-2016-1706.html https://www.suse.com/security/cve/CVE-2016-1707.html https://www.suse.com/security/cve/CVE-2016-1708.html https://www.suse.com/security/cve/CVE-2016-1709.html https://www.suse.com/security/cve/CVE-2016-1710.html https://www.suse.com/security/cve/CVE-2016-1711.html https://www.suse.com/security/cve/CVE-2016-5127.html https://www.suse.com/security/cve/CVE-2016-5128.html https://www.suse.com/security/cve/CVE-2016-5129.html https://www.suse.com/security/cve/CVE-2016-5130.html https://www.suse.com/security/cve/CVE-2016-5131.html https://www.suse.com/security/cve/CVE-2016-5132.html https://www.suse.com/security/cve/CVE-2016-5133.html https://www.suse.com/security/cve/CVE-2016-5134.html https://www.suse.com/security/cve/CVE-2016-5135.html https://www.suse.com/security/cve/CVE-2016-5136.html https://www.suse.com/security/cve/CVE-2016-5137.html https://bugzilla.suse.com/989901

1 0

openSUSE-SU-2016:1917-1: critical: Security update for dropbear
by opensuse-security＠opensuse.org 31 Jul '16

31 Jul '16

openSUSE Security Update: Security update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1917-1 Rating: critical References: #990363 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for dropbear fixes four security issues (bnc#990363): - A format string injection vulnerability allowed remotes attacker to run arbitrary code as root if specific usernames including "%" symbols could be created on the target system. If a dbclient user can control usernames or host arguments, or untrusted input is processed, potentially arbitrary code could have been executed as the dbclient user. - When importing malicious OpenSSH key files via dropbearconvert, arbitrary code could have been executed as the local dropbearconvert user - If particular -m or -c arguments were provided, as used in scripts, dbclient could have executed arbitrary code - dbclient or dropbear server could have exposed process memory to the running user if compiled with DEBUG_TRACE and running with -v Dropbear was updated to the upstream 2016.74 release, including fixes for the following upstream issues: - Port forwarding failure when connecting to domains that have both IPv4 and IPv6 addresses - 100% CPU use while waiting for rekey to complete - Fix crash when fallback initshells() is used scp failing when the local user doesn't exist The following upstream improvements are included: - Support syslog in dbclient, option -o usesyslog=yes - Kill a proxycommand when dbclient exits - Option to exit when a TCP forward fails - Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-918=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): dropbear-2016.74-2.10.1 dropbear-debuginfo-2016.74-2.10.1 dropbear-debugsource-2016.74-2.10.1 References: https://bugzilla.suse.com/990363

1 0

openSUSE-RU-2016:1916-1: Recommended update for clamav-database
by maintenance＠opensuse.org 30 Jul '16

30 Jul '16

openSUSE Recommended Update: Recommended update for clamav-database ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1916-1 Rating: low References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for clamav-database fixes the following issues: - Database refresh July 25th. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-917=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): clamav-database-201607251628-133.1 References:

1 0

openSUSE-RU-2016:1915-1: moderate: Recommended update for calibre
by maintenance＠opensuse.org 30 Jul '16

30 Jul '16

openSUSE Recommended Update: Recommended update for calibre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1915-1 Rating: moderate References: #990425 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for calibre fixes the following issues: - A regression in package AppData would cause zypper to show incorrectly formatted output (boo#990425) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-916=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): calibre-2.62.0-21.1 calibre-debuginfo-2.62.0-21.1 calibre-debugsource-2.62.0-21.1 References: https://bugzilla.suse.com/990425

1 0

openSUSE-RU-2016:1910-1: Recommended update for kdesu
by maintenance＠opensuse.org 29 Jul '16

29 Jul '16

openSUSE Recommended Update: Recommended update for kdesu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1910-1 Rating: low References: #958785 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to kdesu fixes the following issues: * The displayed command line text could run into the password field (boo#958785) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-915=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-915=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kde-cli-tools5-5.5.5-15.1 kde-cli-tools5-debuginfo-5.5.5-15.1 kde-cli-tools5-debugsource-5.5.5-15.1 - openSUSE Leap 42.1 (noarch): kde-cli-tools5-lang-5.5.5-15.1 - openSUSE 13.2 (i586 x86_64): kde-cli-tools5-5.3.2-24.1 kde-cli-tools5-debuginfo-5.3.2-24.1 kde-cli-tools5-debugsource-5.3.2-24.1 - openSUSE 13.2 (noarch): kde-cli-tools5-lang-5.3.2-24.1 References: https://bugzilla.suse.com/958785

1 0

openSUSE-RU-2016:1905-1: moderate: Optional update for go
by maintenance＠opensuse.org 28 Jul '16

28 Jul '16

openSUSE Recommended Update: Optional update for go ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1905-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update contains go 1.6.2 and contains the following changes: - fixes to the compiler runtime, tools, and documentation - fixes to the mime/multipart, net/http, and sort packages - install shared libraries Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-914=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): go-1.6.2-17.1 go-debuginfo-1.6.2-17.1 go-debugsource-1.6.2-17.1 go-doc-1.6.2-17.1 References:

1 0

openSUSE-SU-2016:1894-1: moderate: Security update for go
by opensuse-security＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Security Update: Security update for go ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1894-1 Rating: moderate References: #989630 Cross-References: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for go fixes the following issues: - CVE-2015-5739: "Content Length" treated as valid header - CVE-2015-5740: Double content-length headers does not return 400 error - CVE-2015-5741: Additional hardening, not sending Content-Length w/Transfer-Encoding, Closing connections Go was updated to 1.4.3 with the following additional changes: - build: remove -Werror from cmd/dist - runtime: panic when accessing an empty struct value appended to an uninitialized slice - runtime: garbage collector found invalid heap pointer iterating over map Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-907=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): go-1.4.3-15.1 go-debuginfo-1.4.3-15.1 go-debugsource-1.4.3-15.1 go-doc-1.4.3-15.1 References: https://www.suse.com/security/cve/CVE-2015-5739.html https://www.suse.com/security/cve/CVE-2015-5740.html https://www.suse.com/security/cve/CVE-2015-5741.html https://bugzilla.suse.com/989630

1 0

openSUSE-RU-2016:1893-1: moderate: Recommended update for file-roller
by maintenance＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Recommended Update: Recommended update for file-roller ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:1893-1 Rating: moderate References: Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for file-roller provides version 3.16.5 and fixes the following issues: - Fix many memory leaks (bgo#752476). - Fix documentation typos (bgo#758814). - Error extracting files using file-roller with unar with the character '[' (bgo#755580). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-909=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): file-roller-3.16.5-4.1 file-roller-debuginfo-3.16.5-4.1 file-roller-debugsource-3.16.5-4.1 nautilus-file-roller-3.16.5-4.1 nautilus-file-roller-debuginfo-3.16.5-4.1 - openSUSE Leap 42.1 (noarch): file-roller-lang-3.16.5-4.1 References:

1 0

openSUSE-SU-2016:1892-1: moderate: Recommended update for mbedtls
by opensuse-security＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Security Update: Recommended update for mbedtls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1892-1 Rating: moderate References: #988956 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This mbedtls update to version 1.3.17 fixes the following issues: Security issues fixed: - Fix missing padding length check in mbedtls_rsa_rsaes_pkcs1_v15_decrypt required by PKCS1 v2.2 - Fix a potential integer underflow to buffer overread in mbedtls_rsa_rsaes_oaep_decrypt. It is not triggerable remotely in SSL/TLS. - Fix potential integer overflow to buffer overflow in mbedtls_rsa_rsaes_pkcs1_v15_encrypt and mbedtls_rsa_rsaes_oaep_encrypt Bugs fixed: - Fix bug in mbedtls_mpi_add_mpi() that caused wrong results when the three arguments where the same (in-place doubling). Found and fixed by Janos Follath. #309 - Fix issue in Makefile that prevented building using armar. - Fix issue that caused a hang up when generating RSA keys of odd bitlength - Fix bug in mbedtls_rsa_rsaes_pkcs1_v15_encrypt that made null pointer dereference possible. - Fix issue that caused a crash if invalid curves were passed to mbedtls_ssl_conf_curves. #373 Further changes: - On ARM platforms, when compiling with -O0 with GCC, Clang or armcc5, don't use the optimized assembly for bignum multiplication. This removes the need to pass -fomit-frame-pointer to avoid a build error with -O0. - Disabled SSLv3 in the default configuration. - Fix non-compliance server extension handling. Extensions for SSLv3 are now ignored, as required by RFC6101. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-903=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libmbedtls9-1.3.17-12.1 libmbedtls9-debuginfo-1.3.17-12.1 mbedtls-debugsource-1.3.17-12.1 mbedtls-devel-1.3.17-12.1 - openSUSE Leap 42.1 (x86_64): libmbedtls9-32bit-1.3.17-12.1 libmbedtls9-debuginfo-32bit-1.3.17-12.1 References: https://bugzilla.suse.com/988956

1 0

openSUSE-SU-2016:1891-1: critical: Security update for dropbear
by opensuse-security＠opensuse.org 27 Jul '16

27 Jul '16

openSUSE Security Update: Security update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1891-1 Rating: critical References: #990363 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for dropbear fixes four security issues (bnc#990363): - A format string injection vulnerability allowed remotes attacker to run arbitrary code as root if specific usernames including "%" symbols could be created on the target system. If a dbclient user can control usernames or host arguments, or untrusted input is processed, potentially arbitrary code could have been executed as the dbclient user. - When importing malicious OpenSSH key files via dropbearconvert, arbitrary code could have been executed as the local dropbearconvert user - If particular -m or -c arguments were provided, as used in scripts, dbclient could have executed arbitrary code - dbclient or dropbear server could have exposed process memory to the running user if compiled with DEBUG_TRACE and running with -v Dropbear was updated to the upstream 2016.74 release, including fixes for the following upstream issues: - Port forwarding failure when connecting to domains that have both IPv4 and IPv6 addresses - 100% CPU use while waiting for rekey to complete - Fix crash when fallback initshells() is used scp failing when the local user doesn't exist The following upstream improvements are included: - Support syslog in dbclient, option -o usesyslog=yes - Kill a proxycommand when dbclient exits - Option to exit when a TCP forward fails - Allow specifying commands eg "dropbearmulti dbclient ..." instead of symlinks Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-912=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-912=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): dropbear-2016.74-11.1 dropbear-debuginfo-2016.74-11.1 dropbear-debugsource-2016.74-11.1 - openSUSE 13.2 (i586 x86_64): dropbear-2016.74-2.6.1 dropbear-debuginfo-2016.74-2.6.1 dropbear-debugsource-2016.74-2.6.1 References: https://bugzilla.suse.com/990363

1 0