openSUSE Security Update: Security update for deluge ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:1497-1 Rating: important References: #1039815 #1039958 Cross-References: CVE-2017-7178 CVE-2017-9031 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for deluge fixes two security issues: - CVE-2017-9031: A remote attacker may have used a directory traversal vulnerability in the web interface (bsc#1039815) - CVE-2017-7178: A remote attacher could have exploited a CSRF vulnerability to trick a logged-in user to perform actions in the WebUI (bsc#1039958) In addition, deluge was updated to 1.3.15 with the following fixes and changes: - Core: Fix issues with displaying libtorrent-rasterbar single proxy. - Core: Fix libtorrent-rasterbar 1.2 trackers crashing Deluge UIs. - Core: Fix an error in torrent priorities causing file priority mismatch in UIs. - GtkUI: Fix column sort state not saved in Thinclient mode. - GtkUI: Fix a connection manager error with malformed ip. - GtkUI: Rename SystemTray/Indicator "Pause/Resume All" to "Pause/Resume Session". - GtkUI: Workaround libtorrent-rasterbar single proxy by greying out unused proxy types. - Notification Plugin: Fix webui passing string for int port value. - AutoAdd Plugin: Add WebUI preferences page detailing lack of configuration via WebUI. - Label Plugin: Add WebUI preferences page detailing how to configure plugin. - Core: Fix 'Too many files open' errors. - Core: Add support for python-GeoIP for use with libtorrent 1.1. - Core: Fix a single proxy entry being overwritten resulting in no proxy set. - UI: Add the tracker_status translation to UIs. - GtkUI: Strip whitespace from infohash before checks. - GtkUI: Add a missed feature autofill infohash entry from clipboard. - WebUI: Backport bind interface option for server. - ConsoleUI: Fix a decode error comparing non-ascii (str) torrent names. - AutoAdd Plugin: Fixes for splitting magnets from file. - Remove the duplicate magnet extension when splitting. - Remove deluge-libtorrent-1.1-geoip.patch: fixed upstream. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-656=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): deluge-1.3.15-3.3.1 deluge-lang-1.3.15-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-7178.html https://www.suse.com/security/cve/CVE-2017-9031.html https://bugzilla.suse.com/1039815 https://bugzilla.suse.com/1039958