From sle-updates at lists.suse.com Fri Dec 1 07:08:12 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 15:08:12 +0100 (CET) Subject: SUSE-SU-2017:3171-1: moderate: Security update for ceph Message-ID: <20171201140812.BF50FFCD7@maintenance.suse.de> SUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3171-1 Rating: moderate References: #1003891 #1008435 #1008501 #1012100 #1014986 #1015371 #1015748 #1024691 #1025643 #1028109 #1029482 #1033786 #1042973 #1043767 #1051598 #1056536 #970642 Cross-References: CVE-2016-9579 CVE-2017-7519 Affected Products: SUSE Enterprise Storage 3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 15 fixes is now available. Description: This update provides Ceph 10.2.10, which brings fixes and enhancements: This security issue was fixed: - CVE-2017-7519: libradosstriper processes arbitrary printf placeholders in user input. (bsc#1043767) - CVE-2016-9579: Do not abort RGW server when accepting a CORS request with short origin. (bsc#1014986) These non-security issues were fixed: - common: Add rdbmap to ceph-common. (bsc#1029482) - tools/rados: Default to include clone objects when executing "cache-flush-evict-all". (bsc#1003891) - mon, ceph-disk: Add lockbox permissions to bootstrap-osd. (bsc#1008435) - ceph_volume_client: Fix _recover_auth_meta() method. (bsc#1008501) - systemd/ceph-disk: Reduce ceph-disk flock contention. (bsc#1012100) - doc: Add verbiage to rbdmap manpage. (bsc#1015748) - doc: Add Install section to systemd rbdmap.service file. (bsc#1015748) - ceph systemd dependencies are wrong (bsc#1042973) - ceph-disk omits '--runtime' when enabling ceph-osd units (was: ERROR: unable to open OSD superblock) (bsc#1051598) - SES4: 23 osd's are down after patching node. (bsc#1056536) - Invalid error code returned by MDS is causing a kernel client WARNING (bsc#1028109) - systemctl stop rbdmap unmaps ALL rbds and not just the ones in /etc/ceph/rbdmap (bsc#1024691) - documentation: man crushtool does not cover the '--show-mappings' parameter (bsc#1033786) - swift | This returns with HTTP/1.1 401 Unauthorized (bsc#1015371) - OSDs fail to start after server reboot (bsc#1025643) - 'ceph-deploy mds destroy' not implemented (bsc#970642) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Enterprise Storage 3: zypper in -t patch SUSE-Storage-3-2017-1975=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Enterprise Storage 3 (aarch64 x86_64): ceph-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-base-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-base-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-common-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-common-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-debugsource-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-fuse-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-mds-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-mds-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-mon-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-mon-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-osd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-osd-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-radosgw-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-radosgw-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 ceph-test-10.2.10+git.1510313171.6d5f0aeac1-13.7.2 ceph-test-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.2 ceph-test-debugsource-10.2.10+git.1510313171.6d5f0aeac1-13.7.2 libcephfs1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 libcephfs1-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librados2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librados2-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 libradosstriper1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 libradosstriper1-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librbd1-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librbd1-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librgw2-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 librgw2-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-ceph-compat-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-cephfs-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-cephfs-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-rados-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-rados-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-rbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 python-rbd-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-fuse-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-fuse-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-mirror-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-mirror-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-nbd-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 rbd-nbd-debuginfo-10.2.10+git.1510313171.6d5f0aeac1-13.7.3 References: https://www.suse.com/security/cve/CVE-2016-9579.html https://www.suse.com/security/cve/CVE-2017-7519.html https://bugzilla.suse.com/1003891 https://bugzilla.suse.com/1008435 https://bugzilla.suse.com/1008501 https://bugzilla.suse.com/1012100 https://bugzilla.suse.com/1014986 https://bugzilla.suse.com/1015371 https://bugzilla.suse.com/1015748 https://bugzilla.suse.com/1024691 https://bugzilla.suse.com/1025643 https://bugzilla.suse.com/1028109 https://bugzilla.suse.com/1029482 https://bugzilla.suse.com/1033786 https://bugzilla.suse.com/1042973 https://bugzilla.suse.com/1043767 https://bugzilla.suse.com/1051598 https://bugzilla.suse.com/1056536 https://bugzilla.suse.com/970642 From sle-updates at lists.suse.com Fri Dec 1 07:11:29 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 15:11:29 +0100 (CET) Subject: SUSE-RU-2017:3172-1: Recommended update for zip Message-ID: <20171201141129.AB0F4FCD7@maintenance.suse.de> SUSE Recommended Update: Recommended update for zip ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3172-1 Rating: low References: #1068346 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for zip provides the following fix: - Fix memory leaks when appending files (bsc#1068346) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1974=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1974=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1974=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1974=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1974=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): zip-3.0-16.3.1 zip-debuginfo-3.0-16.3.1 zip-debugsource-3.0-16.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): zip-3.0-16.3.1 zip-debuginfo-3.0-16.3.1 zip-debugsource-3.0-16.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): zip-3.0-16.3.1 zip-debuginfo-3.0-16.3.1 zip-debugsource-3.0-16.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): zip-3.0-16.3.1 zip-debuginfo-3.0-16.3.1 zip-debugsource-3.0-16.3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): zip-3.0-16.3.1 zip-debuginfo-3.0-16.3.1 zip-debugsource-3.0-16.3.1 References: https://bugzilla.suse.com/1068346 From sle-updates at lists.suse.com Fri Dec 1 07:11:55 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 15:11:55 +0100 (CET) Subject: SUSE-RU-2017:3173-1: Recommended update for zip Message-ID: <20171201141155.1EE5AFCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for zip ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3173-1 Rating: low References: #1068346 Affected Products: SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for zip provides the following fix: - Fix memory leaks when appending files (bsc#1068346) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-zip-13357=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): zip-3.0-4.9.4.1 References: https://bugzilla.suse.com/1068346 From sle-updates at lists.suse.com Fri Dec 1 10:09:22 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:09:22 +0100 (CET) Subject: SUSE-OU-2017:3174-1: Optional update for sap-suse-cluster-connector Message-ID: <20171201170922.D9A02FCC0@maintenance.suse.de> SUSE Optional Update: Optional update for sap-suse-cluster-connector ______________________________________________________________________________ Announcement ID: SUSE-OU-2017:3174-1 Rating: low References: #1064860 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP3 SUSE Linux Enterprise Server for SAP 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for sap-suse-cluster-connector provides the following fixes: - Initial package release (bsc#1064860) - Adds support for NetWeaver 7.4x+ systems - Match the new NW-HA-CLU 7.40 certification (fate#323465) Patch Instructions: To install this SUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2017-1978=1 - SUSE Linux Enterprise Server for SAP 12-SP2: zypper in -t patch SUSE-SLE-SAP-12-SP2-2017-1978=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1978=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP3 (noarch): sap-suse-cluster-connector-3.0.0-2.2 - SUSE Linux Enterprise Server for SAP 12-SP2 (noarch): sap-suse-cluster-connector-3.0.0-2.2 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): sap-suse-cluster-connector-3.0.0-2.2 References: https://bugzilla.suse.com/1064860 From sle-updates at lists.suse.com Fri Dec 1 10:09:52 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:09:52 +0100 (CET) Subject: SUSE-RU-2017:3175-1: Recommended update for cryptctl Message-ID: <20171201170952.B2A37FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for cryptctl ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3175-1 Rating: low References: #1059782 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides cryptctl built against the latest released Go update for SUSE Linux Enterprise 12, fixing a potential initialization problem on large NUMA systems. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP2: zypper in -t patch SUSE-SLE-SAP-12-SP2-2017-5764=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP2 (ppc64le x86_64): cryptctl-1.2.6-5.5.4 cryptctl-debuginfo-1.2.6-5.5.4 cryptctl-debugsource-1.2.6-5.5.4 References: https://bugzilla.suse.com/1059782 From sle-updates at lists.suse.com Fri Dec 1 10:10:25 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:10:25 +0100 (CET) Subject: SUSE-SU-2017:3176-1: moderate: Security update for curl Message-ID: <20171201171025.EB324FCC4@maintenance.suse.de> SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3176-1 Rating: moderate References: #1061876 Cross-References: CVE-2017-1000254 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SECURITY SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following security issues: - CVE-2017-1000254: FTP PWD response parser out of bounds read (bsc#1061876) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-curl-13361=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-curl-13361=1 - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-curl-13361=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-curl-13361=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libcurl-devel-7.19.7-1.70.8.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): curl-7.19.7-1.70.8.1 libcurl4-7.19.7-1.70.8.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libcurl4-32bit-7.19.7-1.70.8.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libcurl4-x86-7.19.7-1.70.8.1 - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): curl-openssl1-7.19.7-1.70.8.1 libcurl4-openssl1-7.19.7-1.70.8.1 - SUSE Linux Enterprise Server 11-SECURITY (ppc64 s390x x86_64): libcurl4-openssl1-32bit-7.19.7-1.70.8.1 - SUSE Linux Enterprise Server 11-SECURITY (ia64): libcurl4-openssl1-x86-7.19.7-1.70.8.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): curl-debuginfo-7.19.7-1.70.8.1 curl-debugsource-7.19.7-1.70.8.1 References: https://www.suse.com/security/cve/CVE-2017-1000254.html https://bugzilla.suse.com/1061876 From sle-updates at lists.suse.com Fri Dec 1 10:11:09 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:11:09 +0100 (CET) Subject: SUSE-SU-2017:3177-1: important: Security update for openvpn-openssl1 Message-ID: <20171201171109.C2F0AFCC4@maintenance.suse.de> SUSE Security Update: Security update for openvpn-openssl1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3177-1 Rating: important References: #1060877 Cross-References: CVE-2017-12166 Affected Products: SUSE Linux Enterprise Server 11-SECURITY ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvpn-openssl1 fixes the following issues: Security issue fixed: - CVE-2017-12166: Fix remote buffer overflow (bsc#1060877). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openvpn-openssl1-13362=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): openvpn-openssl1-2.3.2-0.10.3.1 openvpn-openssl1-down-root-plugin-2.3.2-0.10.3.1 References: https://www.suse.com/security/cve/CVE-2017-12166.html https://bugzilla.suse.com/1060877 From sle-updates at lists.suse.com Fri Dec 1 10:11:42 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:11:42 +0100 (CET) Subject: SUSE-SU-2017:3178-1: important: Security update for xen Message-ID: <20171201171142.EC0A0FCC4@maintenance.suse.de> SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3178-1 Rating: important References: #1027519 #1055047 #1061075 #1063123 #1068187 #1068191 Cross-References: CVE-2017-15289 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for xen to version 4.7.4 (bsc#1027519) fixes several issues. This new feature was added: - Support migration of HVM domains larger than 1 TB These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1987=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1987=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1987=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 x86_64): xen-debugsource-4.7.4_02-43.21.1 xen-devel-4.7.4_02-43.21.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): xen-4.7.4_02-43.21.1 xen-debugsource-4.7.4_02-43.21.1 xen-doc-html-4.7.4_02-43.21.1 xen-libs-32bit-4.7.4_02-43.21.1 xen-libs-4.7.4_02-43.21.1 xen-libs-debuginfo-32bit-4.7.4_02-43.21.1 xen-libs-debuginfo-4.7.4_02-43.21.1 xen-tools-4.7.4_02-43.21.1 xen-tools-debuginfo-4.7.4_02-43.21.1 xen-tools-domU-4.7.4_02-43.21.1 xen-tools-domU-debuginfo-4.7.4_02-43.21.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): xen-4.7.4_02-43.21.1 xen-debugsource-4.7.4_02-43.21.1 xen-libs-32bit-4.7.4_02-43.21.1 xen-libs-4.7.4_02-43.21.1 xen-libs-debuginfo-32bit-4.7.4_02-43.21.1 xen-libs-debuginfo-4.7.4_02-43.21.1 References: https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 From sle-updates at lists.suse.com Fri Dec 1 10:12:55 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:12:55 +0100 (CET) Subject: SUSE-RU-2017:3179-1: moderate: Recommended update for open-vm-tools Message-ID: <20171201171255.3F52EFCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for open-vm-tools ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3179-1 Rating: moderate References: #1027987 #1028866 #1031968 #1051627 #1051977 #1052129 #1054800 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update provides open-vm-tools 10.1.10, bringing the following fixes and enhancements: - Fix setting the screen resolution under Wayland environments. (bsc#1054800) - Map certain PAM errors to VGAUTH_E_AUTHENTICATION_DENIED. - Fix timesync state to be uncalibrated when adjustment is larger than 60ms. - Fix a crash when the VSS provider is not installed. - Add support for the new copy and paste selection target named "text/rtf". - Previously Common Agent Framework (CAF) builds were linking against specific versions of PCRE and libiconv. That restriction has been removed. - Reverts a fix that was causing intermittent hangs during soft reboots of some Linux VMs. - Fix a problem that was causing VMs to freeze during snapshots. (bsc#1051627) - Fix unowned /var/lib/vmware directory, which was causing the vgauthd service initialization to fail. (bsc#1028866) - Fix a package dependency for open-vm-tools on libvmtools0. (bsc#1031968) - Fix a build failure caused by an upstream glibc change requiring the explicit inclusion of sys/sysmacros.h - Fix reporting authentication failures. - Make it possible to backup virtual machines with active Docker containers. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-open-vm-tools-13359=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-open-vm-tools-13359=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): libvmtools0-10.1.10-8.3.1 open-vm-tools-10.1.10-8.3.1 open-vm-tools-desktop-10.1.10-8.3.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): open-vm-tools-debuginfo-10.1.10-8.3.1 open-vm-tools-debugsource-10.1.10-8.3.1 References: https://bugzilla.suse.com/1027987 https://bugzilla.suse.com/1028866 https://bugzilla.suse.com/1031968 https://bugzilla.suse.com/1051627 https://bugzilla.suse.com/1051977 https://bugzilla.suse.com/1052129 https://bugzilla.suse.com/1054800 From sle-updates at lists.suse.com Fri Dec 1 10:14:15 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:14:15 +0100 (CET) Subject: SUSE-SU-2017:3180-1: moderate: Security update for lynx Message-ID: <20171201171415.E0A58FCC4@maintenance.suse.de> SUSE Security Update: Security update for lynx ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3180-1 Rating: moderate References: #1068885 Cross-References: CVE-2017-1000211 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for lynx fixes the following issues: Security issue fixed: - CVE-2017-1000211: Fix use after free in the HTMLparser that can resulting in memory disclosure (bsc#1068885). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-lynx-13360=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-lynx-13360=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): lynx-2.8.6-146.3.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): lynx-debuginfo-2.8.6-146.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000211.html https://bugzilla.suse.com/1068885 From sle-updates at lists.suse.com Fri Dec 1 10:14:49 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:14:49 +0100 (CET) Subject: SUSE-RU-2017:3181-1: Recommended update for kiwi Message-ID: <20171201171449.1475CFCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for kiwi ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3181-1 Rating: low References: #1059633 #1059715 #1060304 #1066873 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update provides KIWI v7.03.120, which brings fixes and enhancements: - Keep NVMe drivers in the initrd in order to support systems with the root filesystem on NVMe devices. (bsc#1060304) - Calling 'pvs --noheadings -o vg_name ' is not sufficient to get the volume name and to determine if LVM is being used, as it could happen that udev events are not yet processed, thus the is not yet properly mapped, so it changed to use blkid to determine if the type of the requested partition is LVM and if so it proceeds to a polling strategy to call pvs tool until it succeeds or timing out after 30 seconds. (bsc#1059715) - Fix setting the blocksize value for losetup via the -L command line option. This was broken due to an option name clash between suse util-linux and upstream. (bsc#1066873) - Due to jitters in boot on Azure, the drivers are not always found, so keep them in the initrd to avoid the issue in the virtualized environment. (bsc#1059633) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1977=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1977=1 - SUSE Linux Enterprise Server for SAP 12-SP2: zypper in -t patch SUSE-SLE-SAP-12-SP2-2017-1977=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1977=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1977=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1977=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1977=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): kiwi-debugsource-7.03.120-72.15.1 kiwi-instsource-7.03.120-72.15.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (x86_64): kiwi-instsource-7.03.120-72.15.1 - SUSE Linux Enterprise Server for SAP 12-SP2 (x86_64): kiwi-pxeboot-7.03.120-72.15.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): kiwi-7.03.120-72.15.1 kiwi-debugsource-7.03.120-72.15.1 kiwi-desc-oemboot-7.03.120-72.15.1 kiwi-desc-vmxboot-7.03.120-72.15.1 kiwi-templates-7.03.120-72.15.1 kiwi-tools-7.03.120-72.15.1 kiwi-tools-debuginfo-7.03.120-72.15.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): kiwi-doc-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): kiwi-7.03.120-72.15.1 kiwi-debugsource-7.03.120-72.15.1 kiwi-desc-oemboot-7.03.120-72.15.1 kiwi-desc-vmxboot-7.03.120-72.15.1 kiwi-templates-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP3 (ppc64le s390x x86_64): kiwi-desc-netboot-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): kiwi-doc-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP3 (x86_64): kiwi-desc-isoboot-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): kiwi-7.03.120-72.15.1 kiwi-debugsource-7.03.120-72.15.1 kiwi-desc-oemboot-7.03.120-72.15.1 kiwi-desc-vmxboot-7.03.120-72.15.1 kiwi-templates-7.03.120-72.15.1 kiwi-tools-7.03.120-72.15.1 kiwi-tools-debuginfo-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le s390x x86_64): kiwi-desc-netboot-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): kiwi-doc-7.03.120-72.15.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): kiwi-desc-isoboot-7.03.120-72.15.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): kiwi-debugsource-7.03.120-72.15.1 kiwi-tools-7.03.120-72.15.1 kiwi-tools-debuginfo-7.03.120-72.15.1 References: https://bugzilla.suse.com/1059633 https://bugzilla.suse.com/1059715 https://bugzilla.suse.com/1060304 https://bugzilla.suse.com/1066873 From sle-updates at lists.suse.com Fri Dec 1 10:15:50 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:15:50 +0100 (CET) Subject: SUSE-RU-2017:3182-1: moderate: Recommended update for open-vm-tools Message-ID: <20171201171550.89826FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for open-vm-tools ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3182-1 Rating: moderate References: #1051627 #1051977 #1052129 #1054800 Affected Products: SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update provides open-vm-tools 10.1.10, bringing the following fixes and enhancements: - Fix setting the screen resolution under Wayland environments. (bsc#1054800) - Map certain PAM errors to VGAUTH_E_AUTHENTICATION_DENIED. - Fix timesync state to be uncalibrated when adjustment is larger than 60ms. - Fix a crash when the VSS provider is not installed. - Add support for the new copy and paste selection target named "text/rtf". - Previously Common Agent Framework (CAF) builds were linking against specific versions of PCRE and libiconv. That restriction has been removed. - Reverts a fix that was causing intermittent hangs during soft reboots of some Linux VMs. - Fix a problem that was causing VMs to freeze during snapshots. (bsc#1051627) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1979=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1979=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-1979=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP3 (x86_64): libvmtools0-10.1.10-3.3.3 libvmtools0-debuginfo-10.1.10-3.3.3 open-vm-tools-10.1.10-3.3.3 open-vm-tools-debuginfo-10.1.10-3.3.3 open-vm-tools-debugsource-10.1.10-3.3.3 open-vm-tools-desktop-10.1.10-3.3.3 open-vm-tools-desktop-debuginfo-10.1.10-3.3.3 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libvmtools0-10.1.10-3.3.3 libvmtools0-debuginfo-10.1.10-3.3.3 open-vm-tools-10.1.10-3.3.3 open-vm-tools-debuginfo-10.1.10-3.3.3 open-vm-tools-debugsource-10.1.10-3.3.3 open-vm-tools-desktop-10.1.10-3.3.3 open-vm-tools-desktop-debuginfo-10.1.10-3.3.3 - SUSE Container as a Service Platform ALL (x86_64): libvmtools0-10.1.10-3.3.3 libvmtools0-debuginfo-10.1.10-3.3.3 open-vm-tools-10.1.10-3.3.3 open-vm-tools-debuginfo-10.1.10-3.3.3 open-vm-tools-debugsource-10.1.10-3.3.3 References: https://bugzilla.suse.com/1051627 https://bugzilla.suse.com/1051977 https://bugzilla.suse.com/1052129 https://bugzilla.suse.com/1054800 From sle-updates at lists.suse.com Fri Dec 1 10:16:42 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:16:42 +0100 (CET) Subject: SUSE-SU-2017:3183-1: important: Security update for ncurses Message-ID: <20171201171642.7AE56FCC4@maintenance.suse.de> SUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3183-1 Rating: important References: #1056127 #1056128 #1056129 #1056131 #1056132 #1056136 #1069530 Cross-References: CVE-2017-13728 CVE-2017-13729 CVE-2017-13730 CVE-2017-13731 CVE-2017-13732 CVE-2017-13733 CVE-2017-16879 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-13728: Fix infinite loop in the next_char function in comp_scan.c (bsc#1056136). - CVE-2017-13729: Fix illegal address access in the _nc_save_str (bsc#1056132). - CVE-2017-13730: Fix illegal address access in the function _nc_read_entry_source() (bsc#1056131). - CVE-2017-13731: Fix illegal address access in the function postprocess_termcap() (bsc#1056129). - CVE-2017-13732: Fix illegal address access in the function dump_uses() (bsc#1056128). - CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127). - CVE-2017-16879: Fix stack-based buffer overflow in the _nc_write_entry() function (bsc#1069530). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ncurses-13364=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ncurses-13364=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ncurses-13364=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): ncurses-devel-5.6-93.12.1 tack-5.6-93.12.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (x86_64): ncurses-devel-32bit-5.6-93.12.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libncurses5-5.6-93.12.1 libncurses6-5.6-93.12.1 ncurses-devel-5.6-93.12.1 ncurses-utils-5.6-93.12.1 tack-5.6-93.12.1 terminfo-5.6-93.12.1 terminfo-base-5.6-93.12.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libncurses5-32bit-5.6-93.12.1 libncurses6-32bit-5.6-93.12.1 ncurses-devel-32bit-5.6-93.12.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libncurses5-x86-5.6-93.12.1 libncurses6-x86-5.6-93.12.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ncurses-debuginfo-5.6-93.12.1 ncurses-debugsource-5.6-93.12.1 References: https://www.suse.com/security/cve/CVE-2017-13728.html https://www.suse.com/security/cve/CVE-2017-13729.html https://www.suse.com/security/cve/CVE-2017-13730.html https://www.suse.com/security/cve/CVE-2017-13731.html https://www.suse.com/security/cve/CVE-2017-13732.html https://www.suse.com/security/cve/CVE-2017-13733.html https://www.suse.com/security/cve/CVE-2017-16879.html https://bugzilla.suse.com/1056127 https://bugzilla.suse.com/1056128 https://bugzilla.suse.com/1056129 https://bugzilla.suse.com/1056131 https://bugzilla.suse.com/1056132 https://bugzilla.suse.com/1056136 https://bugzilla.suse.com/1069530 From sle-updates at lists.suse.com Fri Dec 1 10:17:59 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 18:17:59 +0100 (CET) Subject: SUSE-RU-2017:3184-1: moderate: Recommended update for open-vm-tools Message-ID: <20171201171759.36873FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for open-vm-tools ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3184-1 Rating: moderate References: #1027987 #1028866 #1031968 #1051627 #1051977 #1052129 #1054800 Affected Products: SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update provides open-vm-tools 10.1.10, bringing the following fixes and enhancements: - Fix setting the screen resolution under Wayland environments. (bsc#1054800) - Map certain PAM errors to VGAUTH_E_AUTHENTICATION_DENIED. - Fix timesync state to be uncalibrated when adjustment is larger than 60ms. - Fix a crash when the VSS provider is not installed. - Add support for the new copy and paste selection target named "text/rtf". - Previously Common Agent Framework (CAF) builds were linking against specific versions of PCRE and libiconv. That restriction has been removed. - Reverts a fix that was causing intermittent hangs during soft reboots of some Linux VMs. - Fix a problem that was causing VMs to freeze during snapshots. (bsc#1051627) - Fix unowned /var/lib/vmware directory, which was causing the vgauthd service initialization to fail. (bsc#1028866) - Fix a package dependency for open-vm-tools on libvmtools0. (bsc#1031968) - Fix a build failure caused by an upstream glibc change requiring the explicit inclusion of sys/sysmacros.h - Fix reporting authentication failures. - Make it possible to backup virtual machines with active Docker containers. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1980=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1980=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP2 (x86_64): libvmtools0-10.1.10-9.3.3 libvmtools0-debuginfo-10.1.10-9.3.3 open-vm-tools-10.1.10-9.3.3 open-vm-tools-debuginfo-10.1.10-9.3.3 open-vm-tools-debugsource-10.1.10-9.3.3 open-vm-tools-desktop-10.1.10-9.3.3 open-vm-tools-desktop-debuginfo-10.1.10-9.3.3 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libvmtools0-10.1.10-9.3.3 libvmtools0-debuginfo-10.1.10-9.3.3 open-vm-tools-10.1.10-9.3.3 open-vm-tools-debuginfo-10.1.10-9.3.3 open-vm-tools-debugsource-10.1.10-9.3.3 open-vm-tools-desktop-10.1.10-9.3.3 open-vm-tools-desktop-debuginfo-10.1.10-9.3.3 References: https://bugzilla.suse.com/1027987 https://bugzilla.suse.com/1028866 https://bugzilla.suse.com/1031968 https://bugzilla.suse.com/1051627 https://bugzilla.suse.com/1051977 https://bugzilla.suse.com/1052129 https://bugzilla.suse.com/1054800 From sle-updates at lists.suse.com Fri Dec 1 13:07:57 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 21:07:57 +0100 (CET) Subject: SUSE-RU-2017:3185-1: Recommended update for cryptctl Message-ID: <20171201200757.4AC08FCC0@maintenance.suse.de> SUSE Recommended Update: Recommended update for cryptctl ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3185-1 Rating: low References: #1056082 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update of cryptctl to version 2.3 provides the following enhancement: - Allow system administrators to issue mount/umount commands to client computers via key server. (bsc#1056082, fate#322292) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2017-1989=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP3 (ppc64le x86_64): cryptctl-2.3-2.5.1 cryptctl-debuginfo-2.3-2.5.1 cryptctl-debugsource-2.3-2.5.1 References: https://bugzilla.suse.com/1056082 From sle-updates at lists.suse.com Fri Dec 1 13:08:21 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 21:08:21 +0100 (CET) Subject: SUSE-RU-2017:3186-1: Recommended update for release-notes-sles Message-ID: <20171201200821.A7EDBFCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for release-notes-sles ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3186-1 Rating: low References: #1040813 #1050940 #1055590 #1058232 #1059136 #1064279 #1067244 #1069585 #1070336 Affected Products: SUSE Linux Enterprise Server 12-SP3 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: The Release Notes of SUSE Linux Enterprise Server 12 SP3 have been updated to document: - Corrected and extended file systems comparison table (bsc#1064279) - Support for sparse files on OCFS2; note on thread limit (bsc#1050940) - Nagios Monitoring Server Has Been Removed (fate#316136, bsc#1058232) - Direct Access to Files in Non-Volatile DIMMs (fate#319691, bsc#1069585) - Compatibility of Newly Created XFS File Systems With SLE 11 (fate#324448, bsc#1059136) - Icinga Monitoring Server Shipped as Part of SUSE Manager (fate#324454, bsc#1058232) - blogd Boot Log Daemon Available as an Alternative to Plymouth (fate#320593) - Support for New Hardware Instructions in Toolchain (fate#321496) - Supported Offline Migration Scenarios (fate#322404) - NVDIMM: Support for Device DAX (Direct Access) (fate#321135, bsc#1067244) - FCoE Storage Does Not Work with Cavium or QLogic Storage Controllers with FCoE Offload (fate#323796, bsc#1040813, bsc#1055590). Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1991=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP3 (noarch): release-notes-sles-12.3.20171129-2.12.1 References: https://bugzilla.suse.com/1040813 https://bugzilla.suse.com/1050940 https://bugzilla.suse.com/1055590 https://bugzilla.suse.com/1058232 https://bugzilla.suse.com/1059136 https://bugzilla.suse.com/1064279 https://bugzilla.suse.com/1067244 https://bugzilla.suse.com/1069585 https://bugzilla.suse.com/1070336 From sle-updates at lists.suse.com Fri Dec 1 13:09:58 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 21:09:58 +0100 (CET) Subject: SUSE-RU-2017:3187-1: Recommended update for release-notes-sles-for-sap Message-ID: <20171201200958.DE712FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for release-notes-sles-for-sap ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3187-1 Rating: low References: #1045952 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: he Release Notes of SUSE Linux Enterprise Server for SAP 12 SP1 have been updated to document: - SAP Tuning Options (fate#318076) - SAPHanaSR for GEO Scenarios not Supported on SLES 12 SP1 (fate#318794, bsc#1045952) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1992=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): release-notes-sles-for-sap-12.1.20171129-5.5.1 References: https://bugzilla.suse.com/1045952 From sle-updates at lists.suse.com Fri Dec 1 13:10:32 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 1 Dec 2017 21:10:32 +0100 (CET) Subject: SUSE-RU-2017:3188-1: Recommended update for release-notes-sles Message-ID: <20171201201032.E3C53FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for release-notes-sles ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3188-1 Rating: low References: #1058232 #1059136 #1069585 #1070361 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: The Release Notes of SUSE Linux Enterprise Server 12 SP2 have been updated to document: - virt-install: Parameter --sysinfo Allows Configuring sysinfo/SMBIOS Values (fate#319621) - Compatibility of Newly Created XFS File Systems With SLE 11 (fate#324448, bsc#1059136) - Icinga Monitoring Server Shipped as Part of SUSE Manager (fate#324454) - Nagios Monitoring Server Has Been Removed (fate#316136, bsc#1058232) - Direct Access to Files in Non-Volatile DIMMs (fate#319691, bsc#1069585) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1990=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1990=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): release-notes-sles-12.2.20171129-5.28.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): release-notes-sles-12.2.20171129-5.28.1 References: https://bugzilla.suse.com/1058232 https://bugzilla.suse.com/1059136 https://bugzilla.suse.com/1069585 https://bugzilla.suse.com/1070361 From sle-updates at lists.suse.com Fri Dec 1 16:07:04 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Sat, 2 Dec 2017 00:07:04 +0100 (CET) Subject: SUSE-RU-2017:3189-1: moderate: Recommended update for oracleasm Message-ID: <20171201230704.10134FCC0@maintenance.suse.de> SUSE Recommended Update: Recommended update for oracleasm ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3189-1 Rating: moderate References: #1059062 Affected Products: SUSE Linux Enterprise Server 12-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for oracleasm provides the following fix: - Properly implement bio_unmap_user to fix loading the kernel module. (bsc#1059062) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1994=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): oracleasm-kmp-default-2.0.8_k4.4.92_6.18-3.6.1 oracleasm-kmp-default-debuginfo-2.0.8_k4.4.92_6.18-3.6.1 References: https://bugzilla.suse.com/1059062 From sle-updates at lists.suse.com Fri Dec 1 16:07:39 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Sat, 2 Dec 2017 00:07:39 +0100 (CET) Subject: SUSE-RU-2017:3190-1: Recommended update for golang-github-prometheus-prometheus Message-ID: <20171201230739.6455FFCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for golang-github-prometheus-prometheus ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3190-1 Rating: low References: #1065377 #1067030 #1067341 Affected Products: SUSE Enterprise Storage 5 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This updates golang-github-prometheus-prometheus from version 2.0.0 rc0 to the final 2.0.0, which contains many enhancements and bug fixes. For details please refer to the package changelog. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Enterprise Storage 5: zypper in -t patch SUSE-Storage-5-2017-1993=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Enterprise Storage 5 (aarch64 x86_64): golang-github-prometheus-prometheus-2.0.0-2.5.1 References: https://bugzilla.suse.com/1065377 https://bugzilla.suse.com/1067030 https://bugzilla.suse.com/1067341 From sle-updates at lists.suse.com Mon Dec 4 07:07:05 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Mon, 4 Dec 2017 15:07:05 +0100 (CET) Subject: SUSE-SU-2017:3210-1: important: Security update for the Linux Kernel Message-ID: <20171204140705.92163FCD7@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3210-1 Rating: important References: #1047626 #1059465 #1066471 #1066472 #1069496 #860993 #975788 Cross-References: CVE-2014-0038 CVE-2017-1000405 CVE-2017-12193 CVE-2017-15102 CVE-2017-16525 CVE-2017-16527 CVE-2017-16529 CVE-2017-16531 CVE-2017-16535 CVE-2017-16536 CVE-2017-16537 CVE-2017-16649 CVE-2017-16650 CVE-2017-16939 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. (bnc#1069702) - CVE-2017-1000405: mm, thp: do not dirty huge pages on read fault (bnc#1069496). - CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1067085) - CVE-2014-0038: The compat_sys_recvmmsg function in net/compat.c, when CONFIG_X86_X32 is enabled, allowed local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter (bnc#860993). - CVE-2017-16650: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1067086) - CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066700) - CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference. (bnc#1066705) - CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (bnc#1066671) - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations. (bnc#1066192) - CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066650) - CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup. (bnc#1066618) - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066573) - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066606) - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066625) The following non-security bugs were fixed: - NVMe: No lock while DMA mapping data (bsc#975788). - bcache: Add bch_keylist_init_single() (bsc#1047626). - bcache: Add btree_map() functions (bsc#1047626). - bcache: Add on error panic/unregister setting (bsc#1047626). - bcache: Convert gc to a kthread (bsc#1047626). - bcache: Delete some slower inline asm (bsc#1047626). - bcache: Drop unneeded blk_sync_queue() calls (bsc#1047626). - bcache: Fix a bug recovering from unclean shutdown (bsc#1047626). - bcache: Fix a journalling reclaim after recovery bug (bsc#1047626). - bcache: Fix a null ptr deref in journal replay (bsc#1047626). - bcache: Fix an infinite loop in journal replay (bsc#1047626). - bcache: Fix bch_ptr_bad() (bsc#1047626). - bcache: Fix discard granularity (bsc#1047626). - bcache: Fix for can_attach_cache() (bsc#1047626). - bcache: Fix heap_peek() macro (bsc#1047626). - bcache: Fix moving_pred() (bsc#1047626). - bcache: Fix to remove the rcu_sched stalls (bsc#1047626). - bcache: Improve bucket_prio() calculation (bsc#1047626). - bcache: Improve priority_stats (bsc#1047626). - bcache: Minor btree cache fix (bsc#1047626). - bcache: Move keylist out of btree_op (bsc#1047626). - bcache: New writeback PD controller (bsc#1047626). - bcache: PRECEDING_KEY() (bsc#1047626). - bcache: Performance fix for when journal entry is full (bsc#1047626). - bcache: Remove redundant block_size assignment (bsc#1047626). - bcache: Remove redundant parameter for cache_alloc() (bsc#1047626). - bcache: Remove/fix some header dependencies (bsc#1047626). - bcache: Trivial error handling fix (bsc#1047626). - bcache: Use ida for bcache block dev minor (bsc#1047626). - bcache: allows use of register in udev to avoid "device_busy" error (bsc#1047626). - bcache: bch_allocator_thread() is not freezable (bsc#1047626). - bcache: bch_gc_thread() is not freezable (bsc#1047626). - bcache: bugfix - gc thread now gets woken when cache is full (bsc#1047626). - bcache: bugfix - moving_gc now moves only correct buckets (bsc#1047626). - bcache: cleaned up error handling around register_cache() (bsc#1047626). - bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device (bsc#1047626). - bcache: defensively handle format strings (bsc#1047626). - bcache: fix BUG_ON due to integer overflow with GC_SECTORS_USED (bsc#1047626). - bcache: fix a livelock when we cause a huge number of cache misses (bsc#1047626). - bcache: fix crash in bcache_btree_node_alloc_fail tracepoint (bsc#1047626). - bcache: fix for gc and writeback race (bsc#1047626). - bcache: fix for gc crashing when no sectors are used (bsc#1047626). - bcache: kill index() (bsc#1047626). - bcache: register_bcache(): call blkdev_put() when cache_alloc() fails (bsc#1047626). - bcache: stop moving_gc marking buckets that can't be moved (bsc#1047626). - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472). - mac80211: use constant time comparison with keys (bsc#1066471). - packet: fix use-after-free in fanout_add() - scsi: ILLEGAL REQUEST + ASC==27 produces target failure (bsc#1059465). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1995=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1995=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1995=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-1995=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (noarch): kernel-devel-3.12.74-60.64.66.1 kernel-macros-3.12.74-60.64.66.1 kernel-source-3.12.74-60.64.66.1 - SUSE OpenStack Cloud 6 (x86_64): kernel-default-3.12.74-60.64.66.1 kernel-default-base-3.12.74-60.64.66.1 kernel-default-base-debuginfo-3.12.74-60.64.66.1 kernel-default-debuginfo-3.12.74-60.64.66.1 kernel-default-debugsource-3.12.74-60.64.66.1 kernel-default-devel-3.12.74-60.64.66.1 kernel-syms-3.12.74-60.64.66.1 kernel-xen-3.12.74-60.64.66.1 kernel-xen-base-3.12.74-60.64.66.1 kernel-xen-base-debuginfo-3.12.74-60.64.66.1 kernel-xen-debuginfo-3.12.74-60.64.66.1 kernel-xen-debugsource-3.12.74-60.64.66.1 kernel-xen-devel-3.12.74-60.64.66.1 kgraft-patch-3_12_74-60_64_66-default-1-2.1 kgraft-patch-3_12_74-60_64_66-xen-1-2.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): kernel-default-3.12.74-60.64.66.1 kernel-default-base-3.12.74-60.64.66.1 kernel-default-base-debuginfo-3.12.74-60.64.66.1 kernel-default-debuginfo-3.12.74-60.64.66.1 kernel-default-debugsource-3.12.74-60.64.66.1 kernel-default-devel-3.12.74-60.64.66.1 kernel-syms-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): kernel-devel-3.12.74-60.64.66.1 kernel-macros-3.12.74-60.64.66.1 kernel-source-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kernel-xen-3.12.74-60.64.66.1 kernel-xen-base-3.12.74-60.64.66.1 kernel-xen-base-debuginfo-3.12.74-60.64.66.1 kernel-xen-debuginfo-3.12.74-60.64.66.1 kernel-xen-debugsource-3.12.74-60.64.66.1 kernel-xen-devel-3.12.74-60.64.66.1 kgraft-patch-3_12_74-60_64_66-default-1-2.1 kgraft-patch-3_12_74-60_64_66-xen-1-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): kernel-default-3.12.74-60.64.66.1 kernel-default-base-3.12.74-60.64.66.1 kernel-default-base-debuginfo-3.12.74-60.64.66.1 kernel-default-debuginfo-3.12.74-60.64.66.1 kernel-default-debugsource-3.12.74-60.64.66.1 kernel-default-devel-3.12.74-60.64.66.1 kernel-syms-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): kernel-devel-3.12.74-60.64.66.1 kernel-macros-3.12.74-60.64.66.1 kernel-source-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kernel-xen-3.12.74-60.64.66.1 kernel-xen-base-3.12.74-60.64.66.1 kernel-xen-base-debuginfo-3.12.74-60.64.66.1 kernel-xen-debuginfo-3.12.74-60.64.66.1 kernel-xen-debugsource-3.12.74-60.64.66.1 kernel-xen-devel-3.12.74-60.64.66.1 kgraft-patch-3_12_74-60_64_66-default-1-2.1 kgraft-patch-3_12_74-60_64_66-xen-1-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x): kernel-default-man-3.12.74-60.64.66.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.74-60.64.66.1 kernel-ec2-debuginfo-3.12.74-60.64.66.1 kernel-ec2-debugsource-3.12.74-60.64.66.1 kernel-ec2-devel-3.12.74-60.64.66.1 kernel-ec2-extra-3.12.74-60.64.66.1 kernel-ec2-extra-debuginfo-3.12.74-60.64.66.1 References: https://www.suse.com/security/cve/CVE-2014-0038.html https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-12193.html https://www.suse.com/security/cve/CVE-2017-15102.html https://www.suse.com/security/cve/CVE-2017-16525.html https://www.suse.com/security/cve/CVE-2017-16527.html https://www.suse.com/security/cve/CVE-2017-16529.html https://www.suse.com/security/cve/CVE-2017-16531.html https://www.suse.com/security/cve/CVE-2017-16535.html https://www.suse.com/security/cve/CVE-2017-16536.html https://www.suse.com/security/cve/CVE-2017-16537.html https://www.suse.com/security/cve/CVE-2017-16649.html https://www.suse.com/security/cve/CVE-2017-16650.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1047626 https://bugzilla.suse.com/1059465 https://bugzilla.suse.com/1066471 https://bugzilla.suse.com/1066472 https://bugzilla.suse.com/1069496 https://bugzilla.suse.com/860993 https://bugzilla.suse.com/975788 From sle-updates at lists.suse.com Mon Dec 4 16:06:53 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 5 Dec 2017 00:06:53 +0100 (CET) Subject: SUSE-RU-2017:3211-1: Recommended update for mcelog Message-ID: <20171204230653.74B94FCF3@maintenance.suse.de> SUSE Recommended Update: Recommended update for mcelog ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3211-1 Rating: low References: #1061637 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mcelog provides the following enhancement: - Added support for "skylake server" aka SKYLAKE_XEON. (bsc#1061637) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-mcelog-13365=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-mcelog-13365=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (x86_64): mcelog-1.0.2014.12.20-0.24.3.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (x86_64): mcelog-debuginfo-1.0.2014.12.20-0.24.3.1 mcelog-debugsource-1.0.2014.12.20-0.24.3.1 References: https://bugzilla.suse.com/1061637 From sle-updates at lists.suse.com Tue Dec 5 13:08:26 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 5 Dec 2017 21:08:26 +0100 (CET) Subject: SUSE-SU-2017:3212-1: important: Security update for xen Message-ID: <20171205200826.93372FCD7@maintenance.suse.de> SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3212-1 Rating: important References: #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-xen-13366=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-xen-13366=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-13366=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.8-45.16.1 xen-libs-4.2.5_21-45.16.1 xen-tools-domU-4.2.5_21-45.16.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): xen-4.2.5_21-45.16.1 xen-doc-html-4.2.5_21-45.16.1 xen-doc-pdf-4.2.5_21-45.16.1 xen-libs-32bit-4.2.5_21-45.16.1 xen-tools-4.2.5_21-45.16.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.8-45.16.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.8-45.16.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.8-45.16.1 xen-libs-4.2.5_21-45.16.1 xen-tools-domU-4.2.5_21-45.16.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_21-45.16.1 xen-debugsource-4.2.5_21-45.16.1 References: https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 From sle-updates at lists.suse.com Tue Dec 5 13:09:46 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 5 Dec 2017 21:09:46 +0100 (CET) Subject: SUSE-SU-2017:3213-1: important: Security update for MozillaFirefox Message-ID: <20171205200946.81C23FCC4@maintenance.suse.de> SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3213-1 Rating: important References: #1068101 Cross-References: CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox ESR 52.5 fixes the following issues: Security issues fixed: - CVE-2017-7826: Memory safety bugs fixed (bsc#1068101). - CVE-2017-7828: Use-after-free of PressShell while restyling layout (bsc#1068101). - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API (bsc#1068101). Mozilla Foundation Security Advisory (MFSA 2017-25): - https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/ Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1998=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1998=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1998=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1998=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1998=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1998=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1998=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1998=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1998=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1998=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1998=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 References: https://www.suse.com/security/cve/CVE-2017-7826.html https://www.suse.com/security/cve/CVE-2017-7828.html https://www.suse.com/security/cve/CVE-2017-7830.html https://bugzilla.suse.com/1068101 From sle-updates at lists.suse.com Tue Dec 5 13:10:23 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 5 Dec 2017 21:10:23 +0100 (CET) Subject: SUSE-SU-2017:3214-1: moderate: Security update for libXcursor Message-ID: <20171205201023.B5BE2FCC4@maintenance.suse.de> SUSE Security Update: Security update for libXcursor ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3214-1 Rating: moderate References: #1065386 Cross-References: CVE-2017-16612 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libXcursor fixes the following issues: Security issue fixed: - CVE-2017-16612: Fix integeroverflow while parsing images and a signedness issue while parsing comments (bsc#1065386). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2000=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2000=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2000=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2000=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2000=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2000=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2000=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libXcursor-debugsource-1.1.14-4.3.1 libXcursor-devel-1.1.14-4.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libXcursor-debugsource-1.1.14-4.3.1 libXcursor-devel-1.1.14-4.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libXcursor-debugsource-1.1.14-4.3.1 libXcursor1-1.1.14-4.3.1 libXcursor1-debuginfo-1.1.14-4.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libXcursor-debugsource-1.1.14-4.3.1 libXcursor1-1.1.14-4.3.1 libXcursor1-debuginfo-1.1.14-4.3.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libXcursor1-32bit-1.1.14-4.3.1 libXcursor1-debuginfo-32bit-1.1.14-4.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libXcursor-debugsource-1.1.14-4.3.1 libXcursor1-1.1.14-4.3.1 libXcursor1-debuginfo-1.1.14-4.3.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libXcursor1-32bit-1.1.14-4.3.1 libXcursor1-debuginfo-32bit-1.1.14-4.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libXcursor-debugsource-1.1.14-4.3.1 libXcursor1-1.1.14-4.3.1 libXcursor1-32bit-1.1.14-4.3.1 libXcursor1-debuginfo-1.1.14-4.3.1 libXcursor1-debuginfo-32bit-1.1.14-4.3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libXcursor-debugsource-1.1.14-4.3.1 libXcursor1-1.1.14-4.3.1 libXcursor1-32bit-1.1.14-4.3.1 libXcursor1-debuginfo-1.1.14-4.3.1 libXcursor1-debuginfo-32bit-1.1.14-4.3.1 References: https://www.suse.com/security/cve/CVE-2017-16612.html https://bugzilla.suse.com/1065386 From sle-updates at lists.suse.com Tue Dec 5 13:10:58 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 5 Dec 2017 21:10:58 +0100 (CET) Subject: SUSE-SU-2017:3215-1: important: Security update for shibboleth-sp Message-ID: <20171205201058.4EF58FCC4@maintenance.suse.de> SUSE Security Update: Security update for shibboleth-sp ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3215-1 Rating: important References: #1068689 Cross-References: CVE-2017-16852 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shibboleth-sp fixes the following issues: Security issue fixed: - CVE-2017-16852: Fix critical security checks in the Dynamic MetadataProvider plugin in Shibboleth Service (bsc#1068689). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2001=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2001=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2001=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2001=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2001=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 shibboleth-sp-devel-2.5.5-6.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 shibboleth-sp-devel-2.5.5-6.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libshibsp-lite6-2.5.5-6.3.1 libshibsp-lite6-debuginfo-2.5.5-6.3.1 libshibsp6-2.5.5-6.3.1 libshibsp6-debuginfo-2.5.5-6.3.1 shibboleth-sp-2.5.5-6.3.1 shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libshibsp-lite6-2.5.5-6.3.1 libshibsp-lite6-debuginfo-2.5.5-6.3.1 libshibsp6-2.5.5-6.3.1 libshibsp6-debuginfo-2.5.5-6.3.1 shibboleth-sp-2.5.5-6.3.1 shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libshibsp-lite6-2.5.5-6.3.1 libshibsp-lite6-debuginfo-2.5.5-6.3.1 libshibsp6-2.5.5-6.3.1 libshibsp6-debuginfo-2.5.5-6.3.1 shibboleth-sp-2.5.5-6.3.1 shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 References: https://www.suse.com/security/cve/CVE-2017-16852.html https://bugzilla.suse.com/1068689 From sle-updates at lists.suse.com Wed Dec 6 07:08:21 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 6 Dec 2017 15:08:21 +0100 (CET) Subject: SUSE-OU-2017:3224-1: Optional update for sap-suse-cluster-connector Message-ID: <20171206140821.34B0FFCC0@maintenance.suse.de> SUSE Optional Update: Optional update for sap-suse-cluster-connector ______________________________________________________________________________ Announcement ID: SUSE-OU-2017:3224-1 Rating: low References: #1064860 Affected Products: SUSE Linux Enterprise Server for SAP 11-SP4 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for sap-suse-cluster-connector provides the following fixes: - Initial package release (bsc#1064860) - Adds support for NetWeaver 7.4x+ systems - Match the new NW-HA-CLU 7.40 certification (fate#323465) Patch Instructions: To install this SUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 11-SP4: zypper in -t patch slesappsp4-sap-suse-cluster-connector-13367=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 11-SP4 (noarch): sap-suse-cluster-connector-3.0.0-5.5.1 References: https://bugzilla.suse.com/1064860 From sle-updates at lists.suse.com Wed Dec 6 13:08:44 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 6 Dec 2017 21:08:44 +0100 (CET) Subject: SUSE-SU-2017:3225-1: important: Security update for the Linux Kernel Message-ID: <20171206200844.A6BF1FCD7@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3225-1 Rating: important References: #1069496 #1069702 #1070805 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Live Patching 12-SP3 SUSE Linux Enterprise High Availability 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702). The following non-security bugs were fixed: Fix a build issue on ppc64le systems (bsc#1070805) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2006=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2006=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2006=1 - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2017-2006=1 - SUSE Linux Enterprise High Availability 12-SP3: zypper in -t patch SUSE-SLE-HA-12-SP3-2017-2006=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2006=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2006=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 kernel-default-extra-4.4.92-6.30.1 kernel-default-extra-debuginfo-4.4.92-6.30.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): kernel-obs-build-4.4.92-6.30.1 kernel-obs-build-debugsource-4.4.92-6.30.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): kernel-docs-4.4.92-6.30.2 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): kernel-default-4.4.92-6.30.1 kernel-default-base-4.4.92-6.30.1 kernel-default-base-debuginfo-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 kernel-default-devel-4.4.92-6.30.1 kernel-syms-4.4.92-6.30.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): kernel-devel-4.4.92-6.30.1 kernel-macros-4.4.92-6.30.1 kernel-source-4.4.92-6.30.1 - SUSE Linux Enterprise Server 12-SP3 (s390x): kernel-default-man-4.4.92-6.30.1 - SUSE Linux Enterprise Live Patching 12-SP3 (ppc64le x86_64): kgraft-patch-4_4_92-6_30-default-1-6.1 kgraft-patch-4_4_92-6_30-default-debuginfo-1-6.1 - SUSE Linux Enterprise High Availability 12-SP3 (ppc64le s390x x86_64): cluster-md-kmp-default-4.4.92-6.30.1 cluster-md-kmp-default-debuginfo-4.4.92-6.30.1 dlm-kmp-default-4.4.92-6.30.1 dlm-kmp-default-debuginfo-4.4.92-6.30.1 gfs2-kmp-default-4.4.92-6.30.1 gfs2-kmp-default-debuginfo-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 ocfs2-kmp-default-4.4.92-6.30.1 ocfs2-kmp-default-debuginfo-4.4.92-6.30.1 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): kernel-devel-4.4.92-6.30.1 kernel-macros-4.4.92-6.30.1 kernel-source-4.4.92-6.30.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): kernel-default-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 kernel-default-devel-4.4.92-6.30.1 kernel-default-extra-4.4.92-6.30.1 kernel-default-extra-debuginfo-4.4.92-6.30.1 kernel-syms-4.4.92-6.30.1 - SUSE Container as a Service Platform ALL (x86_64): kernel-default-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069496 https://bugzilla.suse.com/1069702 https://bugzilla.suse.com/1070805 From sle-updates at lists.suse.com Wed Dec 6 13:09:38 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 6 Dec 2017 21:09:38 +0100 (CET) Subject: SUSE-SU-2017:3226-1: important: Security update for the Linux Kernel Message-ID: <20171206200938.C9972FCC4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3226-1 Rating: important References: #1069496 #1069702 #1070805 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise High Availability 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702). The following non-security bugs were fixed: Fix a build issue on ppc64le systems (bsc#1070805) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-2007=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2007=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2007=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2007=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2007=1 - SUSE Linux Enterprise High Availability 12-SP2: zypper in -t patch SUSE-SLE-HA-12-SP2-2017-2007=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2007=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2007=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-extra-4.4.90-92.50.1 kernel-default-extra-debuginfo-4.4.90-92.50.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): kernel-obs-build-4.4.90-92.50.1 kernel-obs-build-debugsource-4.4.90-92.50.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): kernel-docs-4.4.90-92.50.3 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): kernel-default-4.4.90-92.50.1 kernel-default-base-4.4.90-92.50.1 kernel-default-base-debuginfo-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-devel-4.4.90-92.50.1 kernel-syms-4.4.90-92.50.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): kernel-devel-4.4.90-92.50.1 kernel-macros-4.4.90-92.50.1 kernel-source-4.4.90-92.50.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): kernel-default-4.4.90-92.50.1 kernel-default-base-4.4.90-92.50.1 kernel-default-base-debuginfo-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-devel-4.4.90-92.50.1 kernel-syms-4.4.90-92.50.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): kernel-devel-4.4.90-92.50.1 kernel-macros-4.4.90-92.50.1 kernel-source-4.4.90-92.50.1 - SUSE Linux Enterprise Server 12-SP2 (s390x): kernel-default-man-4.4.90-92.50.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_90-92_50-default-1-4.1 - SUSE Linux Enterprise High Availability 12-SP2 (ppc64le s390x x86_64): cluster-md-kmp-default-4.4.90-92.50.1 cluster-md-kmp-default-debuginfo-4.4.90-92.50.1 cluster-network-kmp-default-4.4.90-92.50.1 cluster-network-kmp-default-debuginfo-4.4.90-92.50.1 dlm-kmp-default-4.4.90-92.50.1 dlm-kmp-default-debuginfo-4.4.90-92.50.1 gfs2-kmp-default-4.4.90-92.50.1 gfs2-kmp-default-debuginfo-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 ocfs2-kmp-default-4.4.90-92.50.1 ocfs2-kmp-default-debuginfo-4.4.90-92.50.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): kernel-default-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-devel-4.4.90-92.50.1 kernel-default-extra-4.4.90-92.50.1 kernel-default-extra-debuginfo-4.4.90-92.50.1 kernel-syms-4.4.90-92.50.1 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): kernel-devel-4.4.90-92.50.1 kernel-macros-4.4.90-92.50.1 kernel-source-4.4.90-92.50.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): kernel-default-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069496 https://bugzilla.suse.com/1069702 https://bugzilla.suse.com/1070805 From sle-updates at lists.suse.com Wed Dec 6 16:07:52 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 00:07:52 +0100 (CET) Subject: SUSE-RU-2017:3227-1: Recommended update for aws-vpc-move-ip Message-ID: <20171206230752.A5631FCC0@maintenance.suse.de> SUSE Recommended Update: Recommended update for aws-vpc-move-ip ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3227-1 Rating: low References: #1053193 #1059165 Affected Products: SUSE Linux Enterprise High Availability 12-SP3 SUSE Linux Enterprise High Availability 12-SP2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for aws-vpc-move-ip provides the following fixes: - Monitoring operation of aws-vpc-move-ip could hang due to stalling aws command. (bsc#1059165) - Add advanced monitoring capabilities using AWS API calls. This can be enabled via the newly added 'monapi' boolean parameter. - Properly check for the return code of the 'ip addr delete' command to make sure the ip address is really removed in ec2ip_drop function. (bsc#1053193) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise High Availability 12-SP3: zypper in -t patch SUSE-SLE-HA-12-SP3-2017-2008=1 - SUSE Linux Enterprise High Availability 12-SP2: zypper in -t patch SUSE-SLE-HA-12-SP2-2017-2008=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise High Availability 12-SP3 (noarch): aws-vpc-move-ip-0.2.20171113-5.5.1 - SUSE Linux Enterprise High Availability 12-SP2 (noarch): aws-vpc-move-ip-0.2.20171113-5.5.1 References: https://bugzilla.suse.com/1053193 https://bugzilla.suse.com/1059165 From sle-updates at lists.suse.com Thu Dec 7 10:08:55 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 18:08:55 +0100 (CET) Subject: SUSE-SU-2017:3230-1: moderate: Security update for openssh Message-ID: <20171207170855.F3905FCC0@maintenance.suse.de> SUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3230-1 Rating: moderate References: #1006166 #1048367 #1065000 #1068310 #1069509 Cross-References: CVE-2008-1483 CVE-2017-15906 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 SUSE Container as a Service Platform ALL OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for openssh fixes the following issues: Security issue fixed: - CVE-2017-15906: Stricter checking of operations in read-only mode in sftp server (bsc#1065000). Bug fixes: - FIPS: Startup selfchecks (bsc#1068310). - FIPS: Silent complaints about unsupported key exchange methods (bsc#1006166). - Refine handling of sockets for X11 forwarding to remove reintroduced CVE-2008-1483 (bsc#1069509). - Test configuration before running daemon to prevent looping resulting in service shutdown (bsc#1048367) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2009=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2009=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2009=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2009=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2009=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2009=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2009=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): openssh-7.2p2-74.11.1 openssh-askpass-gnome-7.2p2-74.11.3 openssh-askpass-gnome-debuginfo-7.2p2-74.11.3 openssh-debuginfo-7.2p2-74.11.1 openssh-debugsource-7.2p2-74.11.1 openssh-fips-7.2p2-74.11.1 openssh-helpers-7.2p2-74.11.1 openssh-helpers-debuginfo-7.2p2-74.11.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): openssh-7.2p2-74.11.1 openssh-askpass-gnome-7.2p2-74.11.3 openssh-askpass-gnome-debuginfo-7.2p2-74.11.3 openssh-debuginfo-7.2p2-74.11.1 openssh-debugsource-7.2p2-74.11.1 openssh-fips-7.2p2-74.11.1 openssh-helpers-7.2p2-74.11.1 openssh-helpers-debuginfo-7.2p2-74.11.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): openssh-7.2p2-74.11.1 openssh-askpass-gnome-7.2p2-74.11.3 openssh-askpass-gnome-debuginfo-7.2p2-74.11.3 openssh-debuginfo-7.2p2-74.11.1 openssh-debugsource-7.2p2-74.11.1 openssh-fips-7.2p2-74.11.1 openssh-helpers-7.2p2-74.11.1 openssh-helpers-debuginfo-7.2p2-74.11.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): openssh-7.2p2-74.11.1 openssh-askpass-gnome-7.2p2-74.11.3 openssh-askpass-gnome-debuginfo-7.2p2-74.11.3 openssh-debuginfo-7.2p2-74.11.1 openssh-debugsource-7.2p2-74.11.1 openssh-helpers-7.2p2-74.11.1 openssh-helpers-debuginfo-7.2p2-74.11.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): openssh-7.2p2-74.11.1 openssh-askpass-gnome-7.2p2-74.11.3 openssh-askpass-gnome-debuginfo-7.2p2-74.11.3 openssh-debuginfo-7.2p2-74.11.1 openssh-debugsource-7.2p2-74.11.1 openssh-helpers-7.2p2-74.11.1 openssh-helpers-debuginfo-7.2p2-74.11.1 - SUSE Container as a Service Platform ALL (x86_64): openssh-7.2p2-74.11.1 openssh-debuginfo-7.2p2-74.11.1 openssh-debugsource-7.2p2-74.11.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): openssh-7.2p2-74.11.1 openssh-debuginfo-7.2p2-74.11.1 openssh-debugsource-7.2p2-74.11.1 References: https://www.suse.com/security/cve/CVE-2008-1483.html https://www.suse.com/security/cve/CVE-2017-15906.html https://bugzilla.suse.com/1006166 https://bugzilla.suse.com/1048367 https://bugzilla.suse.com/1065000 https://bugzilla.suse.com/1068310 https://bugzilla.suse.com/1069509 From sle-updates at lists.suse.com Thu Dec 7 13:10:00 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 21:10:00 +0100 (CET) Subject: SUSE-SU-2017:3231-1: moderate: Security update for procmail Message-ID: <20171207201000.7E307FCD7@maintenance.suse.de> SUSE Security Update: Security update for procmail ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3231-1 Rating: moderate References: #1068648 Cross-References: CVE-2017-16844 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for procmail fixes the following issues: Security issue fixed: - CVE-2017-16844: Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618. (bnc#1068648) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-procmail-13368=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-procmail-13368=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): procmail-3.22-240.8.3.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): procmail-debuginfo-3.22-240.8.3.1 procmail-debugsource-3.22-240.8.3.1 References: https://www.suse.com/security/cve/CVE-2017-16844.html https://bugzilla.suse.com/1068648 From sle-updates at lists.suse.com Thu Dec 7 13:10:34 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 21:10:34 +0100 (CET) Subject: SUSE-SU-2017:3232-1: moderate: Security update for openvswitch Message-ID: <20171207201034.5C280FCC4@maintenance.suse.de> SUSE Security Update: Security update for openvswitch ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3232-1 Rating: moderate References: #1054094 #1057357 #1061310 Cross-References: CVE-2017-14970 Affected Products: SUSE Linux Enterprise Server 12-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for openvswitch fixes the following issues: Security issue fixed: - CVE-2017-14970: Add upstream patches to fix memory leaks (bsc#1061310). Bug fixes: - Fix rpmlint warnings (bsc#1057357). - Add missing post/postun scriptlets for the ovn-common sub-package (bsc#1054094). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2017=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): openvswitch-2.7.0-3.10.1 openvswitch-debuginfo-2.7.0-3.10.1 openvswitch-debugsource-2.7.0-3.10.1 References: https://www.suse.com/security/cve/CVE-2017-14970.html https://bugzilla.suse.com/1054094 https://bugzilla.suse.com/1057357 https://bugzilla.suse.com/1061310 From sle-updates at lists.suse.com Thu Dec 7 13:11:23 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 21:11:23 +0100 (CET) Subject: SUSE-SU-2017:3233-1: important: Security update for MozillaFirefox Message-ID: <20171207201123.993DEFCC4@maintenance.suse.de> SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3233-1 Rating: important References: #1068101 Cross-References: CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox ESR 52.5 fixes the following issues: Security issues fixed: - CVE-2017-7826: Memory safety bugs fixed (bsc#1068101). - CVE-2017-7828: Use-after-free of PressShell while restyling layout (bsc#1068101). - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API (bsc#1068101). Mozilla Foundation Security Advisory (MFSA 2017-25): - https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/ Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-13369=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-13369=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-MozillaFirefox-13369=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-MozillaFirefox-13369=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-13369=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-13369=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-52.5.0esr-72.17.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-52.5.0esr-72.17.1 MozillaFirefox-translations-52.5.0esr-72.17.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): MozillaFirefox-52.5.0esr-72.17.1 MozillaFirefox-translations-52.5.0esr-72.17.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): MozillaFirefox-52.5.0esr-72.17.1 MozillaFirefox-translations-52.5.0esr-72.17.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-72.17.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-72.17.1 References: https://www.suse.com/security/cve/CVE-2017-7826.html https://www.suse.com/security/cve/CVE-2017-7828.html https://www.suse.com/security/cve/CVE-2017-7830.html https://bugzilla.suse.com/1068101 From sle-updates at lists.suse.com Thu Dec 7 13:11:58 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 21:11:58 +0100 (CET) Subject: SUSE-SU-2017:3234-1: important: Security update for opensaml Message-ID: <20171207201158.B32D7FCC4@maintenance.suse.de> SUSE Security Update: Security update for opensaml ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3234-1 Rating: important References: #1068685 Cross-References: CVE-2017-16853 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opensaml fixes the following issues: Security issue fixed: - CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks (bsc#1068685). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2011=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2011=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2011=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2011=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2011=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libsaml-devel-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libsaml-devel-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libsaml8-2.5.5-3.3.1 libsaml8-debuginfo-2.5.5-3.3.1 opensaml-bin-2.5.5-3.3.1 opensaml-bin-debuginfo-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 opensaml-schemas-2.5.5-3.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libsaml8-2.5.5-3.3.1 libsaml8-debuginfo-2.5.5-3.3.1 opensaml-bin-2.5.5-3.3.1 opensaml-bin-debuginfo-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 opensaml-schemas-2.5.5-3.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libsaml8-2.5.5-3.3.1 libsaml8-debuginfo-2.5.5-3.3.1 opensaml-bin-2.5.5-3.3.1 opensaml-bin-debuginfo-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 opensaml-schemas-2.5.5-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-16853.html https://bugzilla.suse.com/1068685 From sle-updates at lists.suse.com Thu Dec 7 13:12:26 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 21:12:26 +0100 (CET) Subject: SUSE-SU-2017:3235-1: important: Security update for java-1_6_0-ibm Message-ID: <20171207201226.DE5B0FCC4@maintenance.suse.de> SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3235-1 Rating: important References: #1070162 Cross-References: CVE-2016-9841 CVE-2017-10281 CVE-2017-10285 CVE-2017-10293 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_6_0-ibm fixes the following issues: Security issues fixed: - Security update to version 6.0.16.50 (bsc#1070162) * CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281 CVE-2017-10295 CVE-2017-10345 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2017-2018=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.50-50.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.50-50.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.50-50.3.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.50-50.3.1 References: https://www.suse.com/security/cve/CVE-2016-9841.html https://www.suse.com/security/cve/CVE-2017-10281.html https://www.suse.com/security/cve/CVE-2017-10285.html https://www.suse.com/security/cve/CVE-2017-10293.html https://www.suse.com/security/cve/CVE-2017-10295.html https://www.suse.com/security/cve/CVE-2017-10345.html https://www.suse.com/security/cve/CVE-2017-10346.html https://www.suse.com/security/cve/CVE-2017-10347.html https://www.suse.com/security/cve/CVE-2017-10348.html https://www.suse.com/security/cve/CVE-2017-10349.html https://www.suse.com/security/cve/CVE-2017-10350.html https://www.suse.com/security/cve/CVE-2017-10355.html https://www.suse.com/security/cve/CVE-2017-10356.html https://www.suse.com/security/cve/CVE-2017-10357.html https://www.suse.com/security/cve/CVE-2017-10388.html https://bugzilla.suse.com/1070162 From sle-updates at lists.suse.com Thu Dec 7 13:12:55 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 21:12:55 +0100 (CET) Subject: SUSE-SU-2017:3236-1: important: Security update for xen Message-ID: <20171207201255.65550FCC4@maintenance.suse.de> SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3236-1 Rating: important References: #1055047 #1056336 #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-13672 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056336) This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-2013=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2013=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2013=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): xen-4.5.5_20-22.36.3 xen-debugsource-4.5.5_20-22.36.3 xen-doc-html-4.5.5_20-22.36.3 xen-kmp-default-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-kmp-default-debuginfo-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-libs-32bit-4.5.5_20-22.36.3 xen-libs-4.5.5_20-22.36.3 xen-libs-debuginfo-32bit-4.5.5_20-22.36.3 xen-libs-debuginfo-4.5.5_20-22.36.3 xen-tools-4.5.5_20-22.36.3 xen-tools-debuginfo-4.5.5_20-22.36.3 xen-tools-domU-4.5.5_20-22.36.3 xen-tools-domU-debuginfo-4.5.5_20-22.36.3 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): xen-4.5.5_20-22.36.3 xen-debugsource-4.5.5_20-22.36.3 xen-doc-html-4.5.5_20-22.36.3 xen-kmp-default-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-kmp-default-debuginfo-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-libs-32bit-4.5.5_20-22.36.3 xen-libs-4.5.5_20-22.36.3 xen-libs-debuginfo-32bit-4.5.5_20-22.36.3 xen-libs-debuginfo-4.5.5_20-22.36.3 xen-tools-4.5.5_20-22.36.3 xen-tools-debuginfo-4.5.5_20-22.36.3 xen-tools-domU-4.5.5_20-22.36.3 xen-tools-domU-debuginfo-4.5.5_20-22.36.3 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): xen-4.5.5_20-22.36.3 xen-debugsource-4.5.5_20-22.36.3 xen-doc-html-4.5.5_20-22.36.3 xen-kmp-default-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-kmp-default-debuginfo-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-libs-32bit-4.5.5_20-22.36.3 xen-libs-4.5.5_20-22.36.3 xen-libs-debuginfo-32bit-4.5.5_20-22.36.3 xen-libs-debuginfo-4.5.5_20-22.36.3 xen-tools-4.5.5_20-22.36.3 xen-tools-debuginfo-4.5.5_20-22.36.3 xen-tools-domU-4.5.5_20-22.36.3 xen-tools-domU-debuginfo-4.5.5_20-22.36.3 References: https://www.suse.com/security/cve/CVE-2017-13672.html https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1056336 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 From sle-updates at lists.suse.com Thu Dec 7 13:14:17 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 7 Dec 2017 21:14:17 +0100 (CET) Subject: SUSE-SU-2017:3237-1: moderate: Security update for php7 Message-ID: <20171207201417.8C551FCC4@maintenance.suse.de> SUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3237-1 Rating: moderate References: #1063815 #1067441 #1069606 #1069631 Cross-References: CVE-2017-16642 CVE-2017-9228 CVE-2017-9229 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for php7 fixes the following issues: Security issues fixed: - CVE-2017-16642: Fix timelib_meridian error that could be used to leak information from the interpreter (bsc#1067441). - CVE-2017-9229: Fix invalid pointer dereference in left_adjust_char_head() (bsc#1069631). - CVE-2017-9228: Fix heap out-of-bounds write that occurs in bitset_set_range() during regex compilation (bsc#1069606). Bugs fixed: - Fix wrong reference when serialize/unserialize an object (bsc#1063815). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2016=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2016=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2017-2016=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): php7-debuginfo-7.0.7-50.23.1 php7-debugsource-7.0.7-50.23.1 php7-devel-7.0.7-50.23.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): php7-debuginfo-7.0.7-50.23.1 php7-debugsource-7.0.7-50.23.1 php7-devel-7.0.7-50.23.1 - SUSE Linux Enterprise Module for Web Scripting 12 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.0.7-50.23.1 apache2-mod_php7-debuginfo-7.0.7-50.23.1 php7-7.0.7-50.23.1 php7-bcmath-7.0.7-50.23.1 php7-bcmath-debuginfo-7.0.7-50.23.1 php7-bz2-7.0.7-50.23.1 php7-bz2-debuginfo-7.0.7-50.23.1 php7-calendar-7.0.7-50.23.1 php7-calendar-debuginfo-7.0.7-50.23.1 php7-ctype-7.0.7-50.23.1 php7-ctype-debuginfo-7.0.7-50.23.1 php7-curl-7.0.7-50.23.1 php7-curl-debuginfo-7.0.7-50.23.1 php7-dba-7.0.7-50.23.1 php7-dba-debuginfo-7.0.7-50.23.1 php7-debuginfo-7.0.7-50.23.1 php7-debugsource-7.0.7-50.23.1 php7-dom-7.0.7-50.23.1 php7-dom-debuginfo-7.0.7-50.23.1 php7-enchant-7.0.7-50.23.1 php7-enchant-debuginfo-7.0.7-50.23.1 php7-exif-7.0.7-50.23.1 php7-exif-debuginfo-7.0.7-50.23.1 php7-fastcgi-7.0.7-50.23.1 php7-fastcgi-debuginfo-7.0.7-50.23.1 php7-fileinfo-7.0.7-50.23.1 php7-fileinfo-debuginfo-7.0.7-50.23.1 php7-fpm-7.0.7-50.23.1 php7-fpm-debuginfo-7.0.7-50.23.1 php7-ftp-7.0.7-50.23.1 php7-ftp-debuginfo-7.0.7-50.23.1 php7-gd-7.0.7-50.23.1 php7-gd-debuginfo-7.0.7-50.23.1 php7-gettext-7.0.7-50.23.1 php7-gettext-debuginfo-7.0.7-50.23.1 php7-gmp-7.0.7-50.23.1 php7-gmp-debuginfo-7.0.7-50.23.1 php7-iconv-7.0.7-50.23.1 php7-iconv-debuginfo-7.0.7-50.23.1 php7-imap-7.0.7-50.23.1 php7-imap-debuginfo-7.0.7-50.23.1 php7-intl-7.0.7-50.23.1 php7-intl-debuginfo-7.0.7-50.23.1 php7-json-7.0.7-50.23.1 php7-json-debuginfo-7.0.7-50.23.1 php7-ldap-7.0.7-50.23.1 php7-ldap-debuginfo-7.0.7-50.23.1 php7-mbstring-7.0.7-50.23.1 php7-mbstring-debuginfo-7.0.7-50.23.1 php7-mcrypt-7.0.7-50.23.1 php7-mcrypt-debuginfo-7.0.7-50.23.1 php7-mysql-7.0.7-50.23.1 php7-mysql-debuginfo-7.0.7-50.23.1 php7-odbc-7.0.7-50.23.1 php7-odbc-debuginfo-7.0.7-50.23.1 php7-opcache-7.0.7-50.23.1 php7-opcache-debuginfo-7.0.7-50.23.1 php7-openssl-7.0.7-50.23.1 php7-openssl-debuginfo-7.0.7-50.23.1 php7-pcntl-7.0.7-50.23.1 php7-pcntl-debuginfo-7.0.7-50.23.1 php7-pdo-7.0.7-50.23.1 php7-pdo-debuginfo-7.0.7-50.23.1 php7-pgsql-7.0.7-50.23.1 php7-pgsql-debuginfo-7.0.7-50.23.1 php7-phar-7.0.7-50.23.1 php7-phar-debuginfo-7.0.7-50.23.1 php7-posix-7.0.7-50.23.1 php7-posix-debuginfo-7.0.7-50.23.1 php7-pspell-7.0.7-50.23.1 php7-pspell-debuginfo-7.0.7-50.23.1 php7-shmop-7.0.7-50.23.1 php7-shmop-debuginfo-7.0.7-50.23.1 php7-snmp-7.0.7-50.23.1 php7-snmp-debuginfo-7.0.7-50.23.1 php7-soap-7.0.7-50.23.1 php7-soap-debuginfo-7.0.7-50.23.1 php7-sockets-7.0.7-50.23.1 php7-sockets-debuginfo-7.0.7-50.23.1 php7-sqlite-7.0.7-50.23.1 php7-sqlite-debuginfo-7.0.7-50.23.1 php7-sysvmsg-7.0.7-50.23.1 php7-sysvmsg-debuginfo-7.0.7-50.23.1 php7-sysvsem-7.0.7-50.23.1 php7-sysvsem-debuginfo-7.0.7-50.23.1 php7-sysvshm-7.0.7-50.23.1 php7-sysvshm-debuginfo-7.0.7-50.23.1 php7-tokenizer-7.0.7-50.23.1 php7-tokenizer-debuginfo-7.0.7-50.23.1 php7-wddx-7.0.7-50.23.1 php7-wddx-debuginfo-7.0.7-50.23.1 php7-xmlreader-7.0.7-50.23.1 php7-xmlreader-debuginfo-7.0.7-50.23.1 php7-xmlrpc-7.0.7-50.23.1 php7-xmlrpc-debuginfo-7.0.7-50.23.1 php7-xmlwriter-7.0.7-50.23.1 php7-xmlwriter-debuginfo-7.0.7-50.23.1 php7-xsl-7.0.7-50.23.1 php7-xsl-debuginfo-7.0.7-50.23.1 php7-zip-7.0.7-50.23.1 php7-zip-debuginfo-7.0.7-50.23.1 php7-zlib-7.0.7-50.23.1 php7-zlib-debuginfo-7.0.7-50.23.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php7-pear-7.0.7-50.23.1 php7-pear-Archive_Tar-7.0.7-50.23.1 References: https://www.suse.com/security/cve/CVE-2017-16642.html https://www.suse.com/security/cve/CVE-2017-9228.html https://www.suse.com/security/cve/CVE-2017-9229.html https://bugzilla.suse.com/1063815 https://bugzilla.suse.com/1067441 https://bugzilla.suse.com/1069606 https://bugzilla.suse.com/1069631 From sle-updates at lists.suse.com Fri Dec 8 04:09:33 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 12:09:33 +0100 (CET) Subject: SUSE-SU-2017:3239-1: important: Security update for xen Message-ID: <20171208110933.33FAAFCC4@maintenance.suse.de> SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3239-1 Rating: important References: #1055047 #1056336 #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-13672 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056336) This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2019=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): xen-4.4.4_26-22.59.3 xen-debugsource-4.4.4_26-22.59.3 xen-doc-html-4.4.4_26-22.59.3 xen-kmp-default-4.4.4_26_k3.12.61_52.101-22.59.3 xen-kmp-default-debuginfo-4.4.4_26_k3.12.61_52.101-22.59.3 xen-libs-32bit-4.4.4_26-22.59.3 xen-libs-4.4.4_26-22.59.3 xen-libs-debuginfo-32bit-4.4.4_26-22.59.3 xen-libs-debuginfo-4.4.4_26-22.59.3 xen-tools-4.4.4_26-22.59.3 xen-tools-debuginfo-4.4.4_26-22.59.3 xen-tools-domU-4.4.4_26-22.59.3 xen-tools-domU-debuginfo-4.4.4_26-22.59.3 References: https://www.suse.com/security/cve/CVE-2017-13672.html https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1056336 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 From sle-updates at lists.suse.com Fri Dec 8 04:13:00 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 12:13:00 +0100 (CET) Subject: SUSE-SU-2017:3242-1: important: Security update for xen Message-ID: <20171208111300.40D22FCC4@maintenance.suse.de> SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3242-1 Rating: important References: #1055047 #1056336 #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-13672 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056336) This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-13372=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-13372=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-13372=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.4_26-61.17.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.4_26_3.0.101_108.13-61.17.1 xen-libs-4.4.4_26-61.17.1 xen-tools-domU-4.4.4_26-61.17.1 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.4_26-61.17.1 xen-doc-html-4.4.4_26-61.17.1 xen-libs-32bit-4.4.4_26-61.17.1 xen-tools-4.4.4_26-61.17.1 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.4_26_3.0.101_108.13-61.17.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.4_26-61.17.1 xen-debugsource-4.4.4_26-61.17.1 References: https://www.suse.com/security/cve/CVE-2017-13672.html https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1056336 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 From sle-updates at lists.suse.com Fri Dec 8 07:07:50 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 15:07:50 +0100 (CET) Subject: SUSE-RU-2017:3246-1: moderate: Recommended update for file Message-ID: <20171208140750.650CCFD15@maintenance.suse.de> SUSE Recommended Update: Recommended update for file ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3246-1 Rating: moderate References: #1070878 #1070958 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 SUSE Container as a Service Platform ALL OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for file fixes detection of JPEG files. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2021=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2021=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2021=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2021=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2021=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2021=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2021=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2021=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2021=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-devel-5.22-10.6.1 python-magic-5.22-10.6.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-devel-5.22-10.6.1 python-magic-5.22-10.6.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): file-5.22-10.6.1 file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-magic-5.22-10.6.1 libmagic1-5.22-10.6.1 libmagic1-debuginfo-5.22-10.6.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): file-5.22-10.6.1 file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-magic-5.22-10.6.1 libmagic1-5.22-10.6.1 libmagic1-debuginfo-5.22-10.6.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libmagic1-32bit-5.22-10.6.1 libmagic1-debuginfo-32bit-5.22-10.6.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): file-5.22-10.6.1 file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-magic-5.22-10.6.1 libmagic1-5.22-10.6.1 libmagic1-debuginfo-5.22-10.6.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libmagic1-32bit-5.22-10.6.1 libmagic1-debuginfo-32bit-5.22-10.6.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): file-5.22-10.6.1 file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-magic-5.22-10.6.1 libmagic1-32bit-5.22-10.6.1 libmagic1-5.22-10.6.1 libmagic1-debuginfo-32bit-5.22-10.6.1 libmagic1-debuginfo-5.22-10.6.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): file-5.22-10.6.1 file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-magic-5.22-10.6.1 libmagic1-32bit-5.22-10.6.1 libmagic1-5.22-10.6.1 libmagic1-debuginfo-32bit-5.22-10.6.1 libmagic1-debuginfo-5.22-10.6.1 - SUSE Container as a Service Platform ALL (x86_64): file-5.22-10.6.1 file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-magic-5.22-10.6.1 libmagic1-5.22-10.6.1 libmagic1-debuginfo-5.22-10.6.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): file-5.22-10.6.1 file-debuginfo-5.22-10.6.1 file-debugsource-5.22-10.6.1 file-magic-5.22-10.6.1 libmagic1-5.22-10.6.1 libmagic1-debuginfo-5.22-10.6.1 References: https://bugzilla.suse.com/1070878 https://bugzilla.suse.com/1070958 From sle-updates at lists.suse.com Fri Dec 8 10:09:59 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 18:09:59 +0100 (CET) Subject: SUSE-RU-2017:3247-1: Recommended update for google-compute-engine Message-ID: <20171208170959.A9CC0FD16@maintenance.suse.de> SUSE Recommended Update: Recommended update for google-compute-engine ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3247-1 Rating: low References: #1064356 #1065308 #1070895 #1070918 Affected Products: SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for google-compute-engine provides the following fixes: - Add apt configuration to prevent auto-removal of Google packages. - Rename set_hostname to prevent naming conflicts. - Remove logging when checking OS Login status. - Support the enable-oslogin metadata key for activating OS Login when appropriate. - Improve packaging to restart services. - OS Login is available in Beta. - Add status option to the OS Login control file. - Fix system hang during VM shutdown. - JSON parser accepts string types for int64 values. - JSON parser casts uid and gid to unsigned integers. - Remove fstab barrier options in EL 7. - Use curl to download metadata script files for SSL certificate validation. - Use netifaces for retrieving MAC address names if the import exists. - Ship the udevrules with the -init package only - Generate SSH host keys when none are present. - Improve logging when activating OS Login. - Fix parsing logic for expiration time on SSH public keys. - Fix home directory creation PAM config. - oslogin feature is now enabled by the initialization code when appropriate. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-2026=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Public Cloud 12 (aarch64 ppc64le s390x x86_64): google-compute-engine-oslogin-20171129-9.1 google-compute-engine-oslogin-debuginfo-20171129-9.1 - SUSE Linux Enterprise Module for Public Cloud 12 (noarch): google-compute-engine-init-20171129-9.1 References: https://bugzilla.suse.com/1064356 https://bugzilla.suse.com/1065308 https://bugzilla.suse.com/1070895 https://bugzilla.suse.com/1070918 From sle-updates at lists.suse.com Fri Dec 8 10:11:01 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 18:11:01 +0100 (CET) Subject: SUSE-RU-2017:3248-1: Recommended update for amazon-ssm-agent Message-ID: <20171208171101.F0C44FD16@maintenance.suse.de> SUSE Recommended Update: Recommended update for amazon-ssm-agent ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3248-1 Rating: low References: #1067256 Affected Products: SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for amazon-ssm-agent provides version 2.2.45.0 and brings the following fixes and improvements: - Added versioning support for Parameter Store. - Added additional gatherers for inventory, including windows service gatherer, windows registry gatherer, file metadata gatherer, windows role gatherer. - Added support for aws:downloadContent plugin to download content from GitHub, S3 and documents from SSM documents. - Added support for aws:runDocument plugin to execute SSM documents. - Improved speed of initial association application on boot. - Various aws:configurePackage service integration changes. - Improved home directory detection in non-x64 linux platforms to address cases where shared AWS SDK credentials were not available in on-prem instances. - Added exponential backoff in bucket region check for s3 upload. - Fixed an issue with orchestration directory cleanup for RunCommand. - Support for command execution out-of-process Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-2025=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Public Cloud 12 (ppc64le s390x x86_64): amazon-ssm-agent-2.2.45.0-4.12.1 References: https://bugzilla.suse.com/1067256 From sle-updates at lists.suse.com Fri Dec 8 10:11:42 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 18:11:42 +0100 (CET) Subject: SUSE-SU-2017:3249-1: important: Security update for the Linux Kernel Message-ID: <20171208171142.87248FCDB@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3249-1 Rating: important References: #1043652 #1047626 #1066192 #1066471 #1066472 #1066573 #1066606 #1066618 #1066625 #1066650 #1066671 #1066700 #1066705 #1067085 #1067086 #1067997 #1069496 #1069702 #1069708 #1070307 #1070781 #860993 Cross-References: CVE-2014-0038 CVE-2017-1000405 CVE-2017-12193 CVE-2017-15102 CVE-2017-16525 CVE-2017-16527 CVE-2017-16529 CVE-2017-16531 CVE-2017-16535 CVE-2017-16536 CVE-2017-16537 CVE-2017-16649 CVE-2017-16650 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has 8 fixes is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702 1069708). - CVE-2017-1000405: The Linux Kernel had a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() could be reached by get_user_pages(). In such case, the pmd would become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd could become dirty without going through a COW cycle. This bug was not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) could not be mapped using THP. Nevertheless, it did allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files could be overwritten (since their mapping could be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp (bnc#1069496 1070307). - CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067085). - CVE-2014-0038: The compat_sys_recvmmsg function in net/compat.c in the Linux kernel, when CONFIG_X86_X32 is enabled, allowed local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter (bnc#860993). - CVE-2017-16650: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067086). - CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066700). - CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference (bnc#1066705). - CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor (bnc#1066671). - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192). - CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066650). - CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup (bnc#1066618). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066625). The following non-security bugs were fixed: - Define sock_efree (bsc#1067997). - bcache: Add bch_keylist_init_single() (bsc#1047626). - bcache: Add btree_map() functions (bsc#1047626). - bcache: Add on error panic/unregister setting (bsc#1047626). - bcache: Convert gc to a kthread (bsc#1047626). - bcache: Delete some slower inline asm (bsc#1047626). - bcache: Drop unneeded blk_sync_queue() calls (bsc#1047626). - bcache: Fix a bug recovering from unclean shutdown (bsc#1047626). - bcache: Fix a journalling reclaim after recovery bug (bsc#1047626). - bcache: Fix a null ptr deref in journal replay (bsc#1047626). - bcache: Fix an infinite loop in journal replay (bsc#1047626). - bcache: Fix bch_ptr_bad() (bsc#1047626). - bcache: Fix discard granularity (bsc#1047626). - bcache: Fix for can_attach_cache() (bsc#1047626). - bcache: Fix heap_peek() macro (bsc#1047626). - bcache: Fix moving_pred() (bsc#1047626). - bcache: Fix to remove the rcu_sched stalls (bsc#1047626). - bcache: Improve bucket_prio() calculation (bsc#1047626). - bcache: Improve priority_stats (bsc#1047626). - bcache: Minor btree cache fix (bsc#1047626). - bcache: Move keylist out of btree_op (bsc#1047626). - bcache: New writeback PD controller (bsc#1047626). - bcache: PRECEDING_KEY() (bsc#1047626). - bcache: Performance fix for when journal entry is full (bsc#1047626). - bcache: Remove redundant block_size assignment (bsc#1047626). - bcache: Remove redundant parameter for cache_alloc() (bsc#1047626). - bcache: Remove/fix some header dependencies (bsc#1047626). - bcache: Trivial error handling fix (bsc#1047626). - bcache: Use ida for bcache block dev minor (bsc#1047626). - bcache: allows use of register in udev to avoid "device_busy" error (bsc#1047626). - bcache: bch_allocator_thread() is not freezable (bsc#1047626). - bcache: bch_gc_thread() is not freezable (bsc#1047626). - bcache: bugfix - gc thread now gets woken when cache is full (bsc#1047626). - bcache: bugfix - moving_gc now moves only correct buckets (bsc#1047626). - bcache: cleaned up error handling around register_cache() (bsc#1047626). - bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device (bsc#1047626). - bcache: defensively handle format strings (bsc#1047626). - bcache: fix BUG_ON due to integer overflow with GC_SECTORS_USED (bsc#1047626). - bcache: fix a livelock when we cause a huge number of cache misses (bsc#1047626). - bcache: fix crash in bcache_btree_node_alloc_fail tracepoint (bsc#1047626). - bcache: fix for gc and writeback race (bsc#1047626). - bcache: fix for gc crashing when no sectors are used (bsc#1047626). - bcache: kill index() (bsc#1047626). - bcache: only recovery I/O error for writethrough mode (bsc#1043652). - bcache: register_bcache(): call blkdev_put() when cache_alloc() fails (bsc#1047626). - bcache: stop moving_gc marking buckets that can't be moved (bsc#1047626). - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472). - mac80211: use constant time comparison with keys (bsc#1066471). - powerpc/powernv: Remove OPAL v1 takeover (bsc#1070781). - powerpc/vdso64: Use double word compare on pointers - powerpc: Convert cmp to cmpd in idle enter sequence Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2024=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-2024=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): kernel-default-3.12.61-52.106.1 kernel-default-base-3.12.61-52.106.1 kernel-default-base-debuginfo-3.12.61-52.106.1 kernel-default-debuginfo-3.12.61-52.106.1 kernel-default-debugsource-3.12.61-52.106.1 kernel-default-devel-3.12.61-52.106.1 kernel-syms-3.12.61-52.106.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): kernel-devel-3.12.61-52.106.1 kernel-macros-3.12.61-52.106.1 kernel-source-3.12.61-52.106.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kernel-xen-3.12.61-52.106.1 kernel-xen-base-3.12.61-52.106.1 kernel-xen-base-debuginfo-3.12.61-52.106.1 kernel-xen-debuginfo-3.12.61-52.106.1 kernel-xen-debugsource-3.12.61-52.106.1 kernel-xen-devel-3.12.61-52.106.1 kgraft-patch-3_12_61-52_106-default-1-5.1 kgraft-patch-3_12_61-52_106-xen-1-5.1 - SUSE Linux Enterprise Server 12-LTSS (s390x): kernel-default-man-3.12.61-52.106.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.61-52.106.1 kernel-ec2-debuginfo-3.12.61-52.106.1 kernel-ec2-debugsource-3.12.61-52.106.1 kernel-ec2-devel-3.12.61-52.106.1 kernel-ec2-extra-3.12.61-52.106.1 kernel-ec2-extra-debuginfo-3.12.61-52.106.1 References: https://www.suse.com/security/cve/CVE-2014-0038.html https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-12193.html https://www.suse.com/security/cve/CVE-2017-15102.html https://www.suse.com/security/cve/CVE-2017-16525.html https://www.suse.com/security/cve/CVE-2017-16527.html https://www.suse.com/security/cve/CVE-2017-16529.html https://www.suse.com/security/cve/CVE-2017-16531.html https://www.suse.com/security/cve/CVE-2017-16535.html https://www.suse.com/security/cve/CVE-2017-16536.html https://www.suse.com/security/cve/CVE-2017-16537.html https://www.suse.com/security/cve/CVE-2017-16649.html https://www.suse.com/security/cve/CVE-2017-16650.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1043652 https://bugzilla.suse.com/1047626 https://bugzilla.suse.com/1066192 https://bugzilla.suse.com/1066471 https://bugzilla.suse.com/1066472 https://bugzilla.suse.com/1066573 https://bugzilla.suse.com/1066606 https://bugzilla.suse.com/1066618 https://bugzilla.suse.com/1066625 https://bugzilla.suse.com/1066650 https://bugzilla.suse.com/1066671 https://bugzilla.suse.com/1066700 https://bugzilla.suse.com/1066705 https://bugzilla.suse.com/1067085 https://bugzilla.suse.com/1067086 https://bugzilla.suse.com/1067997 https://bugzilla.suse.com/1069496 https://bugzilla.suse.com/1069702 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 https://bugzilla.suse.com/1070781 https://bugzilla.suse.com/860993 From sle-updates at lists.suse.com Fri Dec 8 10:15:34 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 18:15:34 +0100 (CET) Subject: SUSE-RU-2017:3250-1: moderate: Recommended update for openssl Message-ID: <20171208171534.4E44CFD16@maintenance.suse.de> SUSE Recommended Update: Recommended update for openssl ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3250-1 Rating: moderate References: #1032261 #1034941 #1065363 Affected Products: SUSE Studio Onsite 1.3 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for openssl fixes the following issues: Bugs fixed: - Backported alternative certificate chain lookup patches (bsc#1032261) - Fixed a crash in DES_fcrypt (bsc#1065363) - Backport the DEFAULT_SUSE cipher list we use in SUSE Linux Enterprise 12 (bsc#1034941) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-openssl-13373=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-openssl-13373=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-openssl-13373=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-openssl-13373=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): libopenssl-devel-0.9.8j-0.106.3.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8j-0.106.3.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libopenssl-devel-32bit-0.9.8j-0.106.3.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libopenssl0_9_8-0.9.8j-0.106.3.1 libopenssl0_9_8-hmac-0.9.8j-0.106.3.1 openssl-0.9.8j-0.106.3.1 openssl-doc-0.9.8j-0.106.3.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.106.3.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.106.3.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libopenssl0_9_8-x86-0.9.8j-0.106.3.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): openssl-debuginfo-0.9.8j-0.106.3.1 openssl-debugsource-0.9.8j-0.106.3.1 References: https://bugzilla.suse.com/1032261 https://bugzilla.suse.com/1034941 https://bugzilla.suse.com/1065363 From sle-updates at lists.suse.com Fri Dec 8 10:16:31 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 18:16:31 +0100 (CET) Subject: SUSE-RU-2017:3251-1: moderate: Recommended update for nvme-cli Message-ID: <20171208171631.958DDFCDB@maintenance.suse.de> SUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3251-1 Rating: moderate References: #1049272 #1057498 #1063462 #1065430 Affected Products: SUSE Linux Enterprise Server 12-SP3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for nvme-cli provides the following fixes: - Allow override queue depth and nr io queues on connect-all. (bsc#1063462) - Generate Spec compliant UUID NQNs. (bsc#1057498) - Fix connecting when using the --hostid parameter. (bsc#1049272) - Decode KATO feature in nvme get-feature. (bsc#1065430) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2027=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): nvme-cli-1.2-6.6.1 nvme-cli-debuginfo-1.2-6.6.1 nvme-cli-debugsource-1.2-6.6.1 References: https://bugzilla.suse.com/1049272 https://bugzilla.suse.com/1057498 https://bugzilla.suse.com/1063462 https://bugzilla.suse.com/1065430 From sle-updates at lists.suse.com Fri Dec 8 10:17:40 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 18:17:40 +0100 (CET) Subject: SUSE-RU-2017:3252-1: moderate: Recommended update for compat-openssl098 Message-ID: <20171208171740.45275FCDB@maintenance.suse.de> SUSE Recommended Update: Recommended update for compat-openssl098 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3252-1 Rating: moderate References: #1032261 #1034941 #1065363 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP3 SUSE Linux Enterprise Server for SAP 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Module for Legacy Software 12 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for compat-openssl098 fixes the following issues: Bugs fixed: - Backport the alternative SSL root CA chain lookup patches (bsc#1032261) - Fixed a crash in DES_fcrypt (bsc#1065363) - backported the DEFAULT_SUSE cipher list alias (bsc#1034941) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2017-2022=1 - SUSE Linux Enterprise Server for SAP 12-SP2: zypper in -t patch SUSE-SLE-SAP-12-SP2-2017-2022=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2022=1 - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2017-2022=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2022=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2022=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP3 (x86_64): compat-openssl098-debugsource-0.9.8j-106.3.1 libopenssl0_9_8-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-0.9.8j-106.3.1 - SUSE Linux Enterprise Server for SAP 12-SP2 (x86_64): compat-openssl098-debugsource-0.9.8j-106.3.1 libopenssl0_9_8-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-0.9.8j-106.3.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): compat-openssl098-debugsource-0.9.8j-106.3.1 libopenssl0_9_8-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-0.9.8j-106.3.1 - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): compat-openssl098-debugsource-0.9.8j-106.3.1 libopenssl0_9_8-0.9.8j-106.3.1 libopenssl0_9_8-32bit-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): compat-openssl098-debugsource-0.9.8j-106.3.1 libopenssl0_9_8-0.9.8j-106.3.1 libopenssl0_9_8-32bit-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): compat-openssl098-debugsource-0.9.8j-106.3.1 libopenssl0_9_8-0.9.8j-106.3.1 libopenssl0_9_8-32bit-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-0.9.8j-106.3.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.3.1 References: https://bugzilla.suse.com/1032261 https://bugzilla.suse.com/1034941 https://bugzilla.suse.com/1065363 From sle-updates at lists.suse.com Fri Dec 8 10:18:36 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 8 Dec 2017 18:18:36 +0100 (CET) Subject: SUSE-SU-2017:3253-1: important: Fixing security issues on OBS toolchain Message-ID: <20171208171836.C7C0BFCDB@maintenance.suse.de> SUSE Security Update: Fixing security issues on OBS toolchain ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3253-1 Rating: important References: #1059858 #1061500 #1069904 #665768 #938556 Cross-References: CVE-2010-4226 CVE-2017-14804 CVE-2017-9274 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This OBS toolchain update fixes the following issues: Package 'build': - CVE-2010-4226: force use of bsdtar for VMs (bnc#665768) - CVE-2017-14804: Improve file name check extractbuild (bsc#1069904) - switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217) Package 'obs-service-source_validator': - CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556). - Update to version 0.7 - use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858) Package 'osc': - update to version 0.162.0 - add Recommends: ca-certificates to enable TLS verification without manually installing them. (bnc#1061500) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2028=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2028=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): build-20171128-9.3.2 build-initvm-s390-20171128-9.3.2 build-initvm-x86_64-20171128-9.3.2 build-mkbaselibs-20171128-9.3.2 obs-service-source_validator-0.7-9.3.1 osc-0.162.0-15.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): build-20171128-9.3.2 build-initvm-s390-20171128-9.3.2 build-initvm-x86_64-20171128-9.3.2 build-mkbaselibs-20171128-9.3.2 obs-service-source_validator-0.7-9.3.1 osc-0.162.0-15.3.1 References: https://www.suse.com/security/cve/CVE-2010-4226.html https://www.suse.com/security/cve/CVE-2017-14804.html https://www.suse.com/security/cve/CVE-2017-9274.html https://bugzilla.suse.com/1059858 https://bugzilla.suse.com/1061500 https://bugzilla.suse.com/1069904 https://bugzilla.suse.com/665768 https://bugzilla.suse.com/938556 From sle-updates at lists.suse.com Mon Dec 11 07:09:01 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Mon, 11 Dec 2017 15:09:01 +0100 (CET) Subject: SUSE-RU-2017:3262-1: Recommended update for libmspack Message-ID: <20171211140901.F251BFD26@maintenance.suse.de> SUSE Recommended Update: Recommended update for libmspack ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3262-1 Rating: low References: #1063072 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libmspack fixes the following issues: - Add a pkgconfig file for use with libmspack-devel (bsc#1063072) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-libmspack-13374=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-libmspack-13374=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-libmspack-13374=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libmspack-devel-0.0.20060920alpha-74.11.3.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libmspack0-0.0.20060920alpha-74.11.3.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): libmspack-debuginfo-0.0.20060920alpha-74.11.3.1 libmspack-debugsource-0.0.20060920alpha-74.11.3.1 References: https://bugzilla.suse.com/1063072 From sle-updates at lists.suse.com Mon Dec 11 10:09:52 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Mon, 11 Dec 2017 18:09:52 +0100 (CET) Subject: SUSE-RU-2017:3263-1: moderate: Recommended update for yast2-auth-client Message-ID: <20171211170952.A952EFCD2@maintenance.suse.de> SUSE Recommended Update: Recommended update for yast2-auth-client ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3263-1 Rating: moderate References: #1024841 #1032733 #1038077 #1038291 #1038720 #1040393 #1043184 #1043211 #1054436 #1056158 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update for yast2-auth-client fixes the following issues: - Fix a problem in the kerberos configuration file parser that was causing the removal of manually defined values in the default_ccache_name key (bsc#1054436). - Fix a bug that was causing PAM configuration to not allow local user logins if pam_unix2 is being used. (bsc#1056158) - Add the "auth" module name as an alias to "auth-client". (bsc#1043211, bsc#1043184, bsc#1032733) - Correctly install sss name databases even in the presence of special NSS database directives. (bsc#1024841) - Use lower case when doing Active Directory DNS lookups to fix using LDAP and kerberos. (bsc#1038720) - Restore the compatibility with autoyast XML files exported from SLES 12. (bsc#1040393) - Improve some UI captions to make them more consistent. - Fix a spelling problem in kerberos option name "noaddresses". - Fix some translations by removing the usage of interpolated strings, as this is not yet supported in Ruby gettext. (bsc#1038077) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2032=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2032=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2032=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2032=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2032=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): yast2-auth-client-3.3.17-9.8.3 - SUSE Linux Enterprise Server 12-SP3 (noarch): yast2-auth-client-3.3.17-9.8.3 - SUSE Linux Enterprise Server 12-SP2 (noarch): yast2-auth-client-3.3.17-9.8.3 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): yast2-auth-client-3.3.17-9.8.3 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): yast2-auth-client-3.3.17-9.8.3 References: https://bugzilla.suse.com/1024841 https://bugzilla.suse.com/1032733 https://bugzilla.suse.com/1038077 https://bugzilla.suse.com/1038291 https://bugzilla.suse.com/1038720 https://bugzilla.suse.com/1040393 https://bugzilla.suse.com/1043184 https://bugzilla.suse.com/1043211 https://bugzilla.suse.com/1054436 https://bugzilla.suse.com/1056158 From sle-updates at lists.suse.com Mon Dec 11 10:11:43 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Mon, 11 Dec 2017 18:11:43 +0100 (CET) Subject: SUSE-RU-2017:3264-1: Recommended update for gzip Message-ID: <20171211171143.46CF7FCE4@maintenance.suse.de> SUSE Recommended Update: Recommended update for gzip ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3264-1 Rating: low References: #1067891 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 SUSE Container as a Service Platform ALL OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gzip provides the following fix: - Fix mishandling of leading zeros in the end-of-block code (bsc#1067891) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2031=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2031=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2031=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2031=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2031=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2031=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2031=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): gzip-1.6-9.3.1 gzip-debuginfo-1.6-9.3.1 gzip-debugsource-1.6-9.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): gzip-1.6-9.3.1 gzip-debuginfo-1.6-9.3.1 gzip-debugsource-1.6-9.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): gzip-1.6-9.3.1 gzip-debuginfo-1.6-9.3.1 gzip-debugsource-1.6-9.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): gzip-1.6-9.3.1 gzip-debuginfo-1.6-9.3.1 gzip-debugsource-1.6-9.3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): gzip-1.6-9.3.1 gzip-debuginfo-1.6-9.3.1 gzip-debugsource-1.6-9.3.1 - SUSE Container as a Service Platform ALL (x86_64): gzip-1.6-9.3.1 gzip-debuginfo-1.6-9.3.1 gzip-debugsource-1.6-9.3.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): gzip-1.6-9.3.1 gzip-debuginfo-1.6-9.3.1 gzip-debugsource-1.6-9.3.1 References: https://bugzilla.suse.com/1067891 From sle-updates at lists.suse.com Mon Dec 11 13:09:32 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Mon, 11 Dec 2017 21:09:32 +0100 (CET) Subject: SUSE-SU-2017:3265-1: important: Security update for the Linux Kernel Message-ID: <20171211200932.96ED7FD30@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3265-1 Rating: important References: #1012917 #1013018 #1022967 #1024450 #1031358 #1036286 #1036629 #1037441 #1037667 #1037669 #1037994 #1039803 #1040609 #1042863 #1045154 #1045205 #1045327 #1045538 #1047523 #1050381 #1050431 #1051133 #1051932 #1052311 #1052365 #1052370 #1052593 #1053148 #1053152 #1053317 #1053802 #1053933 #1054070 #1054076 #1054093 #1054247 #1054305 #1054706 #1056230 #1056504 #1056588 #1057179 #1057796 #1058524 #1059051 #1060245 #1060665 #1061017 #1061180 #1062520 #1062842 #1063301 #1063544 #1063667 #1064803 #1064861 #1065180 #1066471 #1066472 #1066573 #1066606 #1066618 #1066625 #1066650 #1066671 #1066700 #1066705 #1067085 #1067816 #1067888 #909484 #984530 #996376 Cross-References: CVE-2017-1000112 CVE-2017-10661 CVE-2017-12762 CVE-2017-13080 CVE-2017-14051 CVE-2017-14140 CVE-2017-14340 CVE-2017-14489 CVE-2017-15102 CVE-2017-15265 CVE-2017-15274 CVE-2017-16525 CVE-2017-16527 CVE-2017-16529 CVE-2017-16531 CVE-2017-16535 CVE-2017-16536 CVE-2017-16537 CVE-2017-16649 CVE-2017-8831 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 20 vulnerabilities and has 53 fixes is now available. Description: The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067085). - CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066700). - CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference (bnc#1066705). - CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor (bnc#1066671). - CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066650). - CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup (bnc#1066618). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066625). - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2) allowed reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (bnc#1063667). - CVE-2017-15274: security/keys/keyctl.c in the Linux kernel did not consider the case of a NULL payload in conjunction with a nonzero length value, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192 (bnc#1045327). - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520). - CVE-2017-14489: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel allowed local users to cause a denial of service (panic) by leveraging incorrect length validation (bnc#1059051). - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel did not verify that a filesystem has a realtime device, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory (bnc#1058524). - CVE-2017-14140: The move_pages system call in mm/migrate.c in the Linux kernel doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR (bnc#1057179). - CVE-2017-14051: An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash) by leveraging root access (bnc#1056588). - CVE-2017-10661: Race condition in fs/timerfd.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bnc#1053152). - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. (bnc#1053148). - CVE-2017-8831: The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability (bnc#1037994). - CVE-2017-1000112: An exploitable memory corruption due to UFO to non-UFO path switch was fixed. (bnc#1052311 bnc#1052365). The following non-security bugs were fixed: - alsa: core: Fix unexpected error at replacing user TLV (bsc#1045538). - alsa: hda - fix Lewisburg audio issue (fate#319286). - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1045538). - alsa: timer: Add missing mutex lock for compat ioctls (bsc#1045538). - audit: Fix use after free in audit_remove_watch_rule() (bsc#1045205). - hid: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch (bnc#1022967). - kvm: SVM: Add a missing 'break' statement (bsc#1061017). - kvm: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously (bsc#1061017). - nfs: Cache aggressively when file is open for writing (bsc#1053933). - nfs: Do drop directory dentry when error clearly requires it (bsc#1051932). - nfs: Do not flush caches for a getattr that races with writeback (bsc#1053933). # Conflicts: # series.conf - nfs: Optimize fallocate by refreshing mapping when needed (bsc#1053933). - nfs: Remove asserts from the NFS XDR code (bsc#1063544). - nfs: invalidate file size when taking a lock (bsc#1053933). - pci: fix hotplug related issues (bnc#1054247, LTC#157731). - Update config files. (bsc#1057796) The CONFIG_MODULE_SIG_UEFI should be enabled on x86_64/xen architecture because xen can work with shim on x86_64. Enabling the following kernel config to load certificate from db/mok: +CONFIG_MODULE_SIG_BLACKLIST=y +CONFIG_MODULE_SIG_UEFI=y - af_key: do not use GFP_KERNEL in atomic contexts (bsc#1054093). - autofs: do not fail mount for transient error (bsc#1065180). - xen: avoid deadlock in xenbus (bnc#1047523). - blacklist.conf: Add PCI ASPM fix to blacklist (bsc#1045538) - blkback/blktap: do not leak stack data via response ring (bsc#1042863 XSA-216). - bnx2x: prevent crash when accessing PTP with interface down (bsc#1060665). - cx231xx-audio: fix NULL-deref at probe (bsc#1050431). - cx82310_eth: use skb_cow_head() to deal with cloned skbs (bsc#1045154). - dm bufio: fix integer overflow when limiting maximum cache size (git-fixes). - drm/mgag200: Fixes for G200eH3. (bnc#1062842) - fnic: Use the local variable instead of I/O flag to acquire io_req_lock in fnic_queuecommand() to avoid deadloack (bsc#1067816). - fuse: do not use iocb after it may have been freed (bsc#1054706). - fuse: fix fuse_write_end() if zero bytes were copied (bsc#1054706). - fuse: fsync() did not return IO errors (bsc#1054076). - fuse: fuse_flush must check mapping->flags for errors (bsc#1054706). - getcwd: Close race with d_move called by lustre (bsc#1052593). - gspca: konica: add missing endpoint sanity check (bsc#1050431). - i40e: Initialize 64-bit statistics TX ring seqcount (bsc#909484). - kabi fix for new hash_cred function (bsc#1012917). - kabi/severities: Ignore zpci symbol changes (bsc#1054247) - lib/mpi: mpi_read_raw_data(): fix nbits calculation (fate#314508). - lpfc: check for valid scsi cmnd in lpfc_scsi_cmd_iocb_cmpl() (bsc#1051133). - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472). - md/bitmap: disable bitmap_resize for file-backed bitmaps (bsc#1061180). - media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl (bsc#1050431). - net: Fix RCU splat in af_key (bsc#1054093). - netback: coalesce (guest) RX SKBs as needed (bsc#1056504). - nfs: Fix ugly referral attributes (git-fixes). - nfs: improve shinking of access cache (bsc#1012917). - powerpc/fadump: add reschedule point while releasing memory (bsc#1040609 bsc#1024450). - powerpc/fadump: avoid duplicates in crash memory ranges (bsc#1037669 bsc#1037667). - powerpc/fadump: provide a helpful error message (bsc#1037669 bsc#1037667). - powerpc/mm: Fix check of multiple 16G pages from device tree (bsc#1064861, git-fixes). - powerpc/prom: Increase minimum RMA size to 512MB (bsc#984530, bsc#1052370). - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888, git-fixes f2ab6219969f). - powerpc/slb: Force a full SLB flush when we insert for a bad EA (bsc#1054070). - powerpc/xics: Harden xics hypervisor backend (bnc#1056230). - powerpc: Correct instruction code for xxlor instruction (bsc#1064861, git-fixes). - powerpc: Fix emulation of mfocrf in emulate_step() (bsc#1064861, git-fixes). - powerpc: Fix the corrupt r3 error during MCE handling (bnc#1056230). - powerpc: Make sure IPI handlers see data written by IPI senders (bnc#1056230). - reiserfs: fix race in readdir (bsc#1039803). - s390/cpcmd,vmcp: avoid GFP_DMA allocations (bnc#1060245, LTC#159112). - s390/pci: do not cleanup in arch_setup_msi_irqs (bnc#1054247, LTC#157731). - s390/pci: fix handling of PEC 306 (bnc#1054247, LTC#157731). - s390/pci: improve error handling during fmb (de)registration (bnc#1054247, LTC#157731). - s390/pci: improve error handling during interrupt deregistration (bnc#1054247, LTC#157731). - s390/pci: improve pci hotplug (bnc#1054247, LTC#157731). - s390/pci: improve unreg_ioat error handling (bnc#1054247, LTC#157731). - s390/pci: introduce clp_get_state (bnc#1054247, LTC#157731). - s390/pci: provide more debug information (bnc#1054247, LTC#157731). - s390/qdio: avoid reschedule of outbound tasklet once killed (bnc#1063301, LTC#159885). - s390/topology: alternative topology for topology-less machines (bnc#1060245, LTC#159177). - s390/topology: enable / disable topology dynamically (bnc#1060245, LTC#159177). - scsi: avoid system stall due to host_busy race (bsc#1031358). - scsi: close race when updating blocked counters (bsc#1031358). - scsi: qla2xxx: Get mutex lock before checking optrom_state (bsc#1053317). - scsi: reset wait for IO completion (bsc#996376). - scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records (bnc#1060245, LTC#158494). - scsi: zfcp: fix missing trace records for early returns in TMF eh handlers (bnc#1060245, LTC#158494). - scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA (bnc#1060245, LTC#158494). - scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records (bnc#1060245, LTC#158494). - scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled (bnc#1060245, LTC#158493). - scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response (bnc#1060245, LTC#158494). - ser_gigaset: return -ENOMEM on error instead of success (bsc#1037441). - sunrpc: add RPCSEC_GSS hash_cred() function (bsc#1012917). - sunrpc: add auth_unix hash_cred() function (bsc#1012917). - sunrpc: add generic_auth hash_cred() function (bsc#1012917). - sunrpc: add hash_cred() function to rpc_authops struct (bsc#1012917). - sunrpc: replace generic auth_cred hash with auth-specific function (bsc#1012917). - sunrpc: use supplimental groups in auth hash (bsc#1012917). - supported.conf: clear mistaken external support flag for cifs.ko (bsc#1053802). - tpm: fix a kernel memory leak in tpm-sysfs.c (bsc#1050381). - usb-serial: check for NULL private data in pl2303_suse_disconnect (bsc#1064803). - uwb: fix device quirk on big-endian hosts (bsc#1036629). - virtio_scsi: do not call virtqueue_add_sgs(... GFP_NOIO) holding spinlock (bsc#1036286). - x86/microcode/intel: Disable late loading on model 79 (bsc#1054305). - xfs: fix inobt inode allocation search optimization (bsc#1013018). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-kernel-20171124-13375=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-kernel-20171124-13375=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-kernel-20171124-13375=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-kernel-20171124-13375=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (noarch): kernel-docs-3.0.101-108.18.3 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-3.0.101-108.18.1 kernel-default-base-3.0.101-108.18.1 kernel-default-devel-3.0.101-108.18.1 kernel-source-3.0.101-108.18.1 kernel-syms-3.0.101-108.18.1 kernel-trace-3.0.101-108.18.1 kernel-trace-base-3.0.101-108.18.1 kernel-trace-devel-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): kernel-ec2-3.0.101-108.18.1 kernel-ec2-base-3.0.101-108.18.1 kernel-ec2-devel-3.0.101-108.18.1 kernel-xen-3.0.101-108.18.1 kernel-xen-base-3.0.101-108.18.1 kernel-xen-devel-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-SP4 (s390x): kernel-default-man-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64): kernel-bigmem-3.0.101-108.18.1 kernel-bigmem-base-3.0.101-108.18.1 kernel-bigmem-devel-3.0.101-108.18.1 kernel-ppc64-3.0.101-108.18.1 kernel-ppc64-base-3.0.101-108.18.1 kernel-ppc64-devel-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-SP4 (i586): kernel-pae-3.0.101-108.18.1 kernel-pae-base-3.0.101-108.18.1 kernel-pae-devel-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-trace-extra-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-108.18.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-108.18.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-debuginfo-3.0.101-108.18.1 kernel-default-debugsource-3.0.101-108.18.1 kernel-trace-debuginfo-3.0.101-108.18.1 kernel-trace-debugsource-3.0.101-108.18.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 s390x x86_64): kernel-default-devel-debuginfo-3.0.101-108.18.1 kernel-trace-devel-debuginfo-3.0.101-108.18.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-108.18.1 kernel-ec2-debugsource-3.0.101-108.18.1 kernel-xen-debuginfo-3.0.101-108.18.1 kernel-xen-debugsource-3.0.101-108.18.1 kernel-xen-devel-debuginfo-3.0.101-108.18.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64): kernel-bigmem-debuginfo-3.0.101-108.18.1 kernel-bigmem-debugsource-3.0.101-108.18.1 kernel-ppc64-debuginfo-3.0.101-108.18.1 kernel-ppc64-debugsource-3.0.101-108.18.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586): kernel-pae-debuginfo-3.0.101-108.18.1 kernel-pae-debugsource-3.0.101-108.18.1 kernel-pae-devel-debuginfo-3.0.101-108.18.1 References: https://www.suse.com/security/cve/CVE-2017-1000112.html https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-12762.html https://www.suse.com/security/cve/CVE-2017-13080.html https://www.suse.com/security/cve/CVE-2017-14051.html https://www.suse.com/security/cve/CVE-2017-14140.html https://www.suse.com/security/cve/CVE-2017-14340.html https://www.suse.com/security/cve/CVE-2017-14489.html https://www.suse.com/security/cve/CVE-2017-15102.html https://www.suse.com/security/cve/CVE-2017-15265.html https://www.suse.com/security/cve/CVE-2017-15274.html https://www.suse.com/security/cve/CVE-2017-16525.html https://www.suse.com/security/cve/CVE-2017-16527.html https://www.suse.com/security/cve/CVE-2017-16529.html https://www.suse.com/security/cve/CVE-2017-16531.html https://www.suse.com/security/cve/CVE-2017-16535.html https://www.suse.com/security/cve/CVE-2017-16536.html https://www.suse.com/security/cve/CVE-2017-16537.html https://www.suse.com/security/cve/CVE-2017-16649.html https://www.suse.com/security/cve/CVE-2017-8831.html https://bugzilla.suse.com/1012917 https://bugzilla.suse.com/1013018 https://bugzilla.suse.com/1022967 https://bugzilla.suse.com/1024450 https://bugzilla.suse.com/1031358 https://bugzilla.suse.com/1036286 https://bugzilla.suse.com/1036629 https://bugzilla.suse.com/1037441 https://bugzilla.suse.com/1037667 https://bugzilla.suse.com/1037669 https://bugzilla.suse.com/1037994 https://bugzilla.suse.com/1039803 https://bugzilla.suse.com/1040609 https://bugzilla.suse.com/1042863 https://bugzilla.suse.com/1045154 https://bugzilla.suse.com/1045205 https://bugzilla.suse.com/1045327 https://bugzilla.suse.com/1045538 https://bugzilla.suse.com/1047523 https://bugzilla.suse.com/1050381 https://bugzilla.suse.com/1050431 https://bugzilla.suse.com/1051133 https://bugzilla.suse.com/1051932 https://bugzilla.suse.com/1052311 https://bugzilla.suse.com/1052365 https://bugzilla.suse.com/1052370 https://bugzilla.suse.com/1052593 https://bugzilla.suse.com/1053148 https://bugzilla.suse.com/1053152 https://bugzilla.suse.com/1053317 https://bugzilla.suse.com/1053802 https://bugzilla.suse.com/1053933 https://bugzilla.suse.com/1054070 https://bugzilla.suse.com/1054076 https://bugzilla.suse.com/1054093 https://bugzilla.suse.com/1054247 https://bugzilla.suse.com/1054305 https://bugzilla.suse.com/1054706 https://bugzilla.suse.com/1056230 https://bugzilla.suse.com/1056504 https://bugzilla.suse.com/1056588 https://bugzilla.suse.com/1057179 https://bugzilla.suse.com/1057796 https://bugzilla.suse.com/1058524 https://bugzilla.suse.com/1059051 https://bugzilla.suse.com/1060245 https://bugzilla.suse.com/1060665 https://bugzilla.suse.com/1061017 https://bugzilla.suse.com/1061180 https://bugzilla.suse.com/1062520 https://bugzilla.suse.com/1062842 https://bugzilla.suse.com/1063301 https://bugzilla.suse.com/1063544 https://bugzilla.suse.com/1063667 https://bugzilla.suse.com/1064803 https://bugzilla.suse.com/1064861 https://bugzilla.suse.com/1065180 https://bugzilla.suse.com/1066471 https://bugzilla.suse.com/1066472 https://bugzilla.suse.com/1066573 https://bugzilla.suse.com/1066606 https://bugzilla.suse.com/1066618 https://bugzilla.suse.com/1066625 https://bugzilla.suse.com/1066650 https://bugzilla.suse.com/1066671 https://bugzilla.suse.com/1066700 https://bugzilla.suse.com/1066705 https://bugzilla.suse.com/1067085 https://bugzilla.suse.com/1067816 https://bugzilla.suse.com/1067888 https://bugzilla.suse.com/909484 https://bugzilla.suse.com/984530 https://bugzilla.suse.com/996376 From sle-updates at lists.suse.com Tue Dec 12 07:07:22 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 12 Dec 2017 15:07:22 +0100 (CET) Subject: SUSE-RU-2017:3266-1: moderate: Recommended update for evolution, evolution-data-server Message-ID: <20171212140722.7A1F8FD15@maintenance.suse.de> SUSE Recommended Update: Recommended update for evolution, evolution-data-server ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3266-1 Rating: moderate References: #1071124 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for evolution and evolution-data-server provides fixes and enhancements. evolution (update to version 3.22.6): - Selected days drawn with incorrect color. - Don't preserve 'Pre-formatted' format if moving an empty block out of the quoted content. - Possible crash while refreshing spellcheck. - Print the history stack after removing item from it. - History could be saved twice if inserting HTML content. - Print current EEditorWebExtension method if CAMEL_DEBUG is active. - Previous signatures with images not sent properly. - Fix few memory leaks. - Do not override variable name from parent block. - Updated translations. evolution-data-server (update to version 3.22.7): - Ignore errors when getting message for a body-contains search. - Fix a ref/unref imbalance of CamelIMAPXStoreInfo. - Fix a memory leak in camel_imapx_server_append_message_sync(). - Unable to add additional Google calendar. - Avoid unneeded full flags folder update when no changes made. - Correct new module detection when installed by file rename. - Avoid call of g_debug() in the fork process. - Replace deprecated icalproperty_remove_parameter() with icalproperty_remove_parameter_by_kind(). - Replace deprecated icaltime_from_timet() with icaltime_from_timet_with_zone(). - Fix a memory leak. - Local flag changes could be missed and left unsaved on the server. - Notify about new messages early during folder update. - Fix possible use-after-free in CamelVeeFolder with parent_vee_store. - Test for parent_store availability around camel_folder_changed(). - Avoid crash when untagged response doesn't have a token. - Internal Google OAuth2 authentication fails with expired token. - Fix console runtime warnings from vFolder/vStore code on application quit. - Fix build with --disable-google-auth. - Folder summary can be leaked after its folder is freed. - Drop unused 'Deletes' table from folders.db. - Incorrect times provided in e_cal_recur_generate_instances(). - Port to WebKit2. - Junk check fails due to empty cache file. - Always build ESExp structure as a GObject descendant. - Correct version number reference in a developer comment. - Build developer documentation sections and types on the fly. - Default to "Leave messages on server" for new POP3 accounts. - Possible deadlock in camel_imapx_server_stop_idle_sync(). - Possible use-after-free on factory subprocess close. - Add error checks around factory subprocess backend loading. - 'STARTTLS not supported' error ignored. - Instead of query for UID, try to get the object directly. - Backend not initialized when asked to authenticate. - Add default folder names as iCloud provides them. - Release idle_lock before disconnecting the cancellable. - Crash under imapx_server_info_changed_cb(). Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2035=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2035=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2035=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (noarch): evolution-data-server-lang-3.22.7-18.4.5 evolution-lang-3.22.6-19.3.6 - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): evolution-3.22.6-19.3.6 evolution-data-server-3.22.7-18.4.5 evolution-data-server-32bit-3.22.7-18.4.5 evolution-data-server-debuginfo-3.22.7-18.4.5 evolution-data-server-debuginfo-32bit-3.22.7-18.4.5 evolution-data-server-debugsource-3.22.7-18.4.5 evolution-debuginfo-3.22.6-19.3.6 evolution-debugsource-3.22.6-19.3.6 gnome-autoar-debugsource-0.2.2-3.2.1 libcamel-1_2-59-3.22.7-18.4.5 libcamel-1_2-59-32bit-3.22.7-18.4.5 libcamel-1_2-59-debuginfo-3.22.7-18.4.5 libcamel-1_2-59-debuginfo-32bit-3.22.7-18.4.5 libebackend-1_2-10-3.22.7-18.4.5 libebackend-1_2-10-32bit-3.22.7-18.4.5 libebackend-1_2-10-debuginfo-3.22.7-18.4.5 libebackend-1_2-10-debuginfo-32bit-3.22.7-18.4.5 libebook-1_2-16-3.22.7-18.4.5 libebook-1_2-16-32bit-3.22.7-18.4.5 libebook-1_2-16-debuginfo-3.22.7-18.4.5 libebook-1_2-16-debuginfo-32bit-3.22.7-18.4.5 libebook-contacts-1_2-2-3.22.7-18.4.5 libebook-contacts-1_2-2-32bit-3.22.7-18.4.5 libebook-contacts-1_2-2-debuginfo-3.22.7-18.4.5 libebook-contacts-1_2-2-debuginfo-32bit-3.22.7-18.4.5 libecal-1_2-19-3.22.7-18.4.5 libecal-1_2-19-32bit-3.22.7-18.4.5 libecal-1_2-19-debuginfo-3.22.7-18.4.5 libecal-1_2-19-debuginfo-32bit-3.22.7-18.4.5 libedata-book-1_2-25-3.22.7-18.4.5 libedata-book-1_2-25-32bit-3.22.7-18.4.5 libedata-book-1_2-25-debuginfo-3.22.7-18.4.5 libedata-book-1_2-25-debuginfo-32bit-3.22.7-18.4.5 libedata-cal-1_2-28-3.22.7-18.4.5 libedata-cal-1_2-28-32bit-3.22.7-18.4.5 libedata-cal-1_2-28-debuginfo-3.22.7-18.4.5 libedata-cal-1_2-28-debuginfo-32bit-3.22.7-18.4.5 libedataserver-1_2-22-3.22.7-18.4.5 libedataserver-1_2-22-32bit-3.22.7-18.4.5 libedataserver-1_2-22-debuginfo-3.22.7-18.4.5 libedataserver-1_2-22-debuginfo-32bit-3.22.7-18.4.5 libedataserverui-1_2-1-3.22.7-18.4.5 libedataserverui-1_2-1-debuginfo-3.22.7-18.4.5 libgnome-autoar-0-0-0.2.2-3.2.1 libgnome-autoar-0-0-debuginfo-0.2.2-3.2.1 libgnome-autoar-gtk-0-0-0.2.2-3.2.1 libgnome-autoar-gtk-0-0-debuginfo-0.2.2-3.2.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): evolution-data-server-debuginfo-3.22.7-18.4.5 evolution-data-server-debugsource-3.22.7-18.4.5 evolution-data-server-devel-3.22.7-18.4.5 evolution-debuginfo-3.22.6-19.3.6 evolution-debugsource-3.22.6-19.3.6 evolution-devel-3.22.6-19.3.6 typelib-1_0-EBook-1_2-3.22.7-18.4.5 typelib-1_0-EBookContacts-1_2-3.22.7-18.4.5 typelib-1_0-EDataServer-1_2-3.22.7-18.4.5 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): evolution-3.22.6-19.3.6 evolution-data-server-3.22.7-18.4.5 evolution-data-server-32bit-3.22.7-18.4.5 evolution-data-server-debuginfo-3.22.7-18.4.5 evolution-data-server-debuginfo-32bit-3.22.7-18.4.5 evolution-data-server-debugsource-3.22.7-18.4.5 evolution-debuginfo-3.22.6-19.3.6 evolution-debugsource-3.22.6-19.3.6 gnome-autoar-debugsource-0.2.2-3.2.1 libcamel-1_2-59-3.22.7-18.4.5 libcamel-1_2-59-32bit-3.22.7-18.4.5 libcamel-1_2-59-debuginfo-3.22.7-18.4.5 libcamel-1_2-59-debuginfo-32bit-3.22.7-18.4.5 libebackend-1_2-10-3.22.7-18.4.5 libebackend-1_2-10-32bit-3.22.7-18.4.5 libebackend-1_2-10-debuginfo-3.22.7-18.4.5 libebackend-1_2-10-debuginfo-32bit-3.22.7-18.4.5 libebook-1_2-16-3.22.7-18.4.5 libebook-1_2-16-32bit-3.22.7-18.4.5 libebook-1_2-16-debuginfo-3.22.7-18.4.5 libebook-1_2-16-debuginfo-32bit-3.22.7-18.4.5 libebook-contacts-1_2-2-3.22.7-18.4.5 libebook-contacts-1_2-2-32bit-3.22.7-18.4.5 libebook-contacts-1_2-2-debuginfo-3.22.7-18.4.5 libebook-contacts-1_2-2-debuginfo-32bit-3.22.7-18.4.5 libecal-1_2-19-3.22.7-18.4.5 libecal-1_2-19-32bit-3.22.7-18.4.5 libecal-1_2-19-debuginfo-3.22.7-18.4.5 libecal-1_2-19-debuginfo-32bit-3.22.7-18.4.5 libedata-book-1_2-25-3.22.7-18.4.5 libedata-book-1_2-25-32bit-3.22.7-18.4.5 libedata-book-1_2-25-debuginfo-3.22.7-18.4.5 libedata-book-1_2-25-debuginfo-32bit-3.22.7-18.4.5 libedata-cal-1_2-28-3.22.7-18.4.5 libedata-cal-1_2-28-32bit-3.22.7-18.4.5 libedata-cal-1_2-28-debuginfo-3.22.7-18.4.5 libedata-cal-1_2-28-debuginfo-32bit-3.22.7-18.4.5 libedataserver-1_2-22-3.22.7-18.4.5 libedataserver-1_2-22-32bit-3.22.7-18.4.5 libedataserver-1_2-22-debuginfo-3.22.7-18.4.5 libedataserver-1_2-22-debuginfo-32bit-3.22.7-18.4.5 libedataserverui-1_2-1-3.22.7-18.4.5 libedataserverui-1_2-1-debuginfo-3.22.7-18.4.5 libgnome-autoar-0-0-0.2.2-3.2.1 libgnome-autoar-0-0-debuginfo-0.2.2-3.2.1 libgnome-autoar-gtk-0-0-0.2.2-3.2.1 libgnome-autoar-gtk-0-0-debuginfo-0.2.2-3.2.1 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): evolution-data-server-lang-3.22.7-18.4.5 evolution-lang-3.22.6-19.3.6 References: https://bugzilla.suse.com/1071124 From sle-updates at lists.suse.com Tue Dec 12 07:07:51 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 12 Dec 2017 15:07:51 +0100 (CET) Subject: SUSE-SU-2017:3267-1: important: Security update for the Linux Kernel Message-ID: <20171212140751.3DB24FD42@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3267-1 Rating: important References: #1012382 #1017461 #1020645 #1022595 #1022600 #1022914 #1022967 #1025461 #1028971 #1030061 #1034048 #1037890 #1052593 #1053919 #1055493 #1055567 #1055755 #1055896 #1056427 #1058135 #1058410 #1058624 #1059051 #1059465 #1059863 #1060197 #1060985 #1061017 #1061046 #1061064 #1061067 #1061172 #1061451 #1061831 #1061872 #1062520 #1062962 #1063460 #1063475 #1063501 #1063509 #1063520 #1063667 #1063695 #1064206 #1064388 #1064701 #964944 #966170 #966172 #966186 #966191 #966316 #966318 #969474 #969475 #969476 #969477 #971975 #974590 #996376 Cross-References: CVE-2017-12153 CVE-2017-13080 CVE-2017-14489 CVE-2017-15265 CVE-2017-15649 Affected Products: SUSE Linux Enterprise Real Time Extension 12-SP2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 56 fixes is now available. Description: The SUSE Linux Enterprise 12 SP2 Realtime kernel was updated to 4.4.95 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-12153: A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel This function did not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash (bnc#1058410 1058624). - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2) allowed reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (bnc#1063667). - CVE-2017-14489: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel allowed local users to cause a denial of service (panic) by leveraging incorrect length validation (bnc#1059051). - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520). - CVE-2017-15649: net/packet/af_packet.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346 (bnc#1064388). The following non-security bugs were fixed: - alsa: au88x0: avoid theoretical uninitialized access (bnc#1012382). - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382). - alsa: compress: Remove unused variable (bnc#1012382). - alsa: hda: Remove superfluous '-' added by printk conversion (bnc#1012382). - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382). - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382). - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382). - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital (bnc#1012382). - alsa: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (bnc#1012382). - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382). - alsa: usx2y: Suppress kernel warning at page allocation failures (bnc#1012382). - arc: Re-enable MMU upon Machine Check exception (bnc#1012382). - arm64: fault: Route pte translation faults via do_translation_fault (bnc#1012382). - arm64: Make sure SPsel is always set (bnc#1012382). - arm: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM (bnc#1012382). - arm: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes (bnc#1012382). - arm: pxa: add the number of DMA requestor lines (bnc#1012382). - arm: pxa: fix the number of DMA requestor lines (bnc#1012382). - arm: remove duplicate 'const' annotations' (bnc#1012382). - asoc: dapm: fix some pointer error handling (bnc#1012382). - asoc: dapm: handle probe deferrals (bnc#1012382). - audit: log 32-bit socketcalls (bnc#1012382). - bcache: correct cache_dirty_target in __update_writeback_rate() (bnc#1012382). - bcache: Correct return value for sysfs attach errors (bnc#1012382). - bcache: do not subtract sectors_to_gc for bypassed IO (bnc#1012382). - bcache: fix bch_hprint crash and improve output (bnc#1012382). - bcache: fix for gc and write-back race (bnc#1012382). - bcache: Fix leak of bdev reference (bnc#1012382). - bcache: initialize dirty stripes in flash_dev_run() (bnc#1012382). - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919) - block: Relax a check in blk_start_queue() (bnc#1012382). - bpf: one perf event close won't free bpf program attached by another perf event (bnc#1012382). - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382). - brcmfmac: add length check in brcmf_cfg80211_escan_handler() (bnc#1012382). - brcmfmac: setup passive scan if requested by user-space (bnc#1012382). - brcmsmac: make some local variables 'static const' to reduce stack size (bnc#1012382). - bridge: netlink: register netdevice before executing changelink (bnc#1012382). - bsg-lib: do not free job in bsg_prepare_job (bnc#1012382). - btrfs: add a node counter to each of the rbtrees (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: add cond_resched() calls when resolving backrefs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: allow backref search checks for shared extents (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, add tracepoints for prelim_ref insertion and merging (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, add unode_aux_to_inode_list helper (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, cleanup __ namespace abuse (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, constify some arguments (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: btrfs_check_shared should manage its own transaction (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: change how we decide to commit transactions during flushing (bsc#1060197). - btrfs: clean up extraneous computations in add_delayed_refs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: constify tracepoint arguments (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: convert prelimary reference tracking to use rbtrees (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: fix leak and use-after-free in resolve_indirect_refs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: fix NULL pointer dereference from free_reloc_roots() (bnc#1012382). - btrfs: prevent to set invalid default subvolid (bnc#1012382). - btrfs: propagate error to btrfs_cmp_data_prepare caller (bnc#1012382). - btrfs: qgroup: move noisy underflow warning to debugging build (bsc#1055755). - btrfs: remove ref_tree implementation from backref.c (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: struct-funcs, constify readers (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382). - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382). - can: gs_usb: fix busy loop if no more TX context is available (bnc#1012382). - ceph: avoid panic in create_session_open_msg() if utsname() returns NULL (bsc#1061451). - ceph: check negative offsets in ceph_llseek() (bsc#1061451). - ceph: clean up unsafe d_parent accesses in build_dentry_path (bnc#1012382). - cifs: fix circular locking dependency (bsc#1064701). - cifs: Fix SMB3.1.1 guest authentication to Samba (bnc#1012382). - cifs: Reconnect expired SMB sessions (bnc#1012382). - cifs: release auth_key.response for reconnect (bnc#1012382). - clockevents/drivers/cs5535: Improve resilience to spurious interrupts (bnc#1012382). - cpufreq: CPPC: add ACPI_PROCESSOR dependency (bnc#1012382). - crypto: AF_ALG - remove SGL terminator indicator when chaining (bnc#1012382). - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382). - crypto: talitos - Do not provide setkey for non hmac hashing algs (bnc#1012382). - crypto: talitos - fix sha224 (bnc#1012382). - crypto: xts - Add ECB dependency (bnc#1012382). - cxl: Fix driver use count (bnc#1012382). - direct-io: Prevent NULL pointer access in submit_page_section (bnc#1012382). - dmaengine: edma: Align the memcpy acnt array size with the transfer (bnc#1012382). - dmaengine: mmp-pdma: add number of requestors (bnc#1012382). - driver core: platform: Do not read past the end of "driver_override" buffer (bnc#1012382). - drivers: firmware: psci: drop duplicate const from psci_of_match (bnc#1012382). - drivers: hv: fcopy: restore correct transfer length (bnc#1012382). - drm: Add driver-private objects to atomic state (bsc#1055493). - drm/amdkfd: fix improper return value on error (bnc#1012382). - drm: bridge: add DT bindings for TI ths8135 (bnc#1012382). - drm/dp: Introduce MST topology state to track available link bandwidth (bsc#1055493). - drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define (bnc#1012382). - drm/i915/bios: ignore HDMI on port A (bnc#1012382). - drm/nouveau/bsp/g92: disable by default (bnc#1012382). - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382). - ext4: do not allow encrypted operations without keys (bnc#1012382). - ext4: fix incorrect quotaoff if the quota feature is enabled (bnc#1012382). - ext4: fix quota inconsistency during orphan cleanup for read-only mounts (bnc#1012382). - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets (bnc#1012382). - extcon: axp288: Use vbus-valid instead of -present to determine cable presence (bnc#1012382). - exynos-gsc: Do not swap cb/cr for semi planar formats (bnc#1012382). - f2fs: check hot_data for roll-forward recovery (bnc#1012382). - f2fs crypto: add missing locking for keyring_key access (bnc#1012382). - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382). - f2fs: do not wait for writeback in write_begin (bnc#1012382). - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382). - fix whitespace according to upstream commit - fix xen_swiotlb_dma_mmap prototype (bnc#1012382). - fs-cache: fix dereference of NULL user_key_payload (bnc#1012382). - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382). - fscrypto: require write access to mount to set encryption policy (bnc#1012382). - fs/epoll: cache leftmost node (bsc#1056427). - ftrace: Fix kmemleak in unregister_ftrace_graph (bnc#1012382). - ftrace: Fix memleak when unregistering dynamic ops when tracing disabled (bnc#1012382). - ftrace: Fix selftest goto location on error (bnc#1012382). - genirq: Fix for_each_action_of_desc() macro (bsc#1061064). - getcwd: Close race with d_move called by lustre (bsc#1052593). - gfs2: Fix debugfs glocks dump (bnc#1012382). - gfs2: Fix reference to ERR_PTR in gfs2_glock_iter_next (bnc#1012382). - gianfar: Fix Tx flow control deactivation (bnc#1012382). - hid: i2c-hid: allocate hid buffers for real worst case (bnc#1012382). - hid: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch (bnc#1022967). - hid: usbhid: fix out-of-bounds bug (bnc#1012382). - hpsa: correct lun data caching bitmap definition (bsc#1028971). - hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes (bnc#1012382). - i2c: at91: ensure state is restored after suspending (bnc#1012382). - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382). - i2c: meson: fix wrong variable usage in meson_i2c_put_data (bnc#1012382). - i40e: Initialize 64-bit statistics TX ring seqcount (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - i40iw: Add missing memory barriers (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - i40iw: Fix port number for query QP (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - ib/core: Fix for core panic (bsc#1022595 FATE#322350). - ib/core: Fix the validations of a multicast LID in attach or detach operations (bsc#1022595 FATE#322350). - ib/i40iw: Fix error code in i40iw_create_cq() (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - ib/ipoib: Fix deadlock over vlan_mutex (bnc#1012382). - ib/ipoib: Replace list_del of the neigh->list with list_del_init (bnc#1012382). - ib/ipoib: rtnl_unlock can not come after free_netdev (bnc#1012382). - ib/mlx5: Fix Raw Packet QP event handler assignment (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - ibmvnic: Set state UP (bsc#1062962). - ib/qib: fix false-postive maybe-uninitialized warning (bnc#1012382). - igb: re-assign hw address pointer on reset after PCI error (bnc#1012382). - iio: ad7793: Fix the serial interface reset (bnc#1012382). - iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications (bnc#1012382). - iio: adc: hx711: Add DT binding for avia,hx711 (bnc#1012382). - iio: adc: mcp320x: Fix oops on module unload (bnc#1012382). - iio: adc: mcp320x: Fix readout of negative voltages (bnc#1012382). - iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()' (bnc#1012382). - iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()' (bnc#1012382). - iio: adc: xilinx: Fix error handling (bnc#1012382). - iio: ad_sigma_delta: Implement a dedicated reset function (bnc#1012382). - iio: core: Return error for failed read_reg (bnc#1012382). - input: i8042 - add Gigabyte P57 to the keyboard reset table (bnc#1012382). - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382). - iommu/io-pgtable-arm: Check for leaf entry before dereferencing it (bnc#1012382). - iommu/vt-d: Avoid calling virt_to_phys() on null pointer (bsc#1061067). - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header (bnc#1012382). - ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (bnc#1012382). - ipv6: add rcu grace period before freeing fib6_node (bnc#1012382). - ipv6: fix memory leak with multiple tables during netns destruction (bnc#1012382). - ipv6: fix sparse warning on rt6i_node (bnc#1012382). - ipv6: fix typo in fib6_net_exit() (bnc#1012382). - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382). - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382). - iwlwifi: add workaround to disable wide channels in 5GHz (bnc#1012382). - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382). - ixgbe: Fix incorrect bitwise operations of PTP Rx timestamp flags (bsc#969474 FATE#319812 bsc#969475 FATE#319814). - kABI: protect struct l2tp_tunnel (kabi). - kABI: protect struct rm_data_op (kabi). - kABI: protect struct sdio_func (kabi). - keys: do not let add_key() update an uninstantiated key (bnc#1012382). - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382). - keys: Fix race between updating and finding a negative key (bnc#1012382). - keys: fix writing past end of user-supplied buffer in keyring_read() (bnc#1012382). - keys: prevent creating a different user's keyrings (bnc#1012382). - keys: prevent KEYCTL_READ on negative key (bnc#1012382). - kvm: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously (bsc#1061017). - kvm: nVMX: fix guest CR4 loading when emulating L2 to L1 exit (bnc#1012382). - kvm: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce() (bnc#1012382). - kvm: SVM: Add a missing 'break' statement (bsc#1061017). - kvm: VMX: do not change SN bit in vmx_update_pi_irte() (bsc#1061017). - kvm: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt (bsc#1061017). - kvm: VMX: use cmpxchg64 (bnc#1012382). - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382). - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382). - libata: transport: Remove circular dependency at free time (bnc#1012382). - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382). - locking/lockdep: Add nest_lock integrity test (bnc#1012382). - lsm: fix smack_inode_removexattr and xattr_getsecurity memleak (bnc#1012382). - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382). - mac80211: flush hw_roc_start work before cancelling the ROC (bnc#1012382). - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382). - md/bitmap: disable bitmap_resize for file-backed bitmaps (bsc#1061172). - md/linear: shutup lockdep warnning (bnc#1012382). - md/raid10: submit bio directly to replacement disk (bnc#1012382). - md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list (bnc#1012382). - md/raid5: release/flush io in raid5_do_work() (bnc#1012382). - media: uvcvideo: Prevent heap overflow when accessing mapped controls (bnc#1012382). - media: v4l2-compat-ioctl32: Fix timespec conversion (bnc#1012382). - mips: Ensure bss section ends on a long-aligned address (bnc#1012382). - mips: Fix minimum alignment requirement of IRQ stack (git-fixes). - mips: IRQ Stack: Unwind IRQ stack onto task stack (bnc#1012382). - mips: Lantiq: Fix another request_mem_region() return code check (bnc#1012382). - mips: math-emu: .: Fix cases of both infinite inputs (bnc#1012382). - mips: math-emu: .: Fix cases of input values with opposite signs (bnc#1012382). - mips: math-emu: .: Fix cases of both inputs zero (bnc#1012382). - mips: math-emu: .: Fix quiet NaN propagation (bnc#1012382). - mips: math-emu: .: Fix cases of both inputs negative (bnc#1012382). - mips: math-emu: MINA.: Fix some cases of infinity and zero inputs (bnc#1012382). - mips: math-emu: Remove pr_err() calls from fpu_emu() (bnc#1012382). - mips: ralink: Fix incorrect assignment on ralink_soc (bnc#1012382). - mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms array (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - mm/backing-dev.c: fix an error handling path in 'cgwb_create()' (bnc#1063475). - mm,compaction: serialize waitqueue_active() checks (for real) (bsc#971975). - mmc: sdio: fix alignment issue in struct sdio_func (bnc#1012382). - mm: discard memblock data later (bnc#1063460). - mm/memblock.c: reversed logic in memblock_discard() (bnc#1063460). - mm: meminit: mark init_reserved_page as __meminit (bnc#1063509). - mm/memory_hotplug: change pfn_to_section_nr/section_nr_to_pfn macro to inline function (bnc#1063501). - mm/memory_hotplug: define find_{smallest|biggest}_section_pfn as unsigned long (bnc#1063520). - mm: prevent double decrease of nr_reserved_highatomic (bnc#1012382). - net: core: Prevent from dereferencing null pointer when releasing SKB (bnc#1012382). - net: emac: Fix napi poll list corruption (bnc#1012382). - netfilter: invoke synchronize_rcu after set the _hook_ to NULL (bnc#1012382). - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value (bnc#1012382). - netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max (bnc#1012382). - net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs (bnc#1012382). - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (bnc#1012382). - net/mlx5e: Fix wrong delay calculation for overflow check scheduling (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5e: Schedule overflow check work to mlx5e workqueue (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5: Skip mlx5_unload_one if mlx5_load_one fails (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net: mvpp2: release reference to txq_cpu[] entry after unmapping (bnc#1012382). - net/packet: check length in getsockopt() called with PACKET_HDRLEN (bnc#1012382). - net: Set sk_prot_creator when cloning sockets to the right proto (bnc#1012382). - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382). - nfsd: Fix general protection fault in release_lock_stateid() (bnc#1012382). - nl80211: Define policy for packet pattern attributes (bnc#1012382). - nvme: protect against simultaneous shutdown invocations (FATE#319965 bnc#1012382 bsc#964944). - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382). - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382). - parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels (bnc#1012382). - parisc: perf: Fix potential NULL pointer dereference (bnc#1012382). - partitions/efi: Fix integer overflow in GPT size calculation (bnc#1012382). - pci: Allow PCI express root ports to find themselves (bsc#1061046). - pci: fix oops when try to find Root Port for a PCI device (bsc#1061046). - pci: Fix race condition with driver_override (bnc#1012382). - pci: shpchp: Enable bridge bus mastering if MSI is enabled (bnc#1012382). - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts (bnc#1012382). - perf/x86: Fix RDPMC vs. mm_struct tracking (bsc#1061831). - perf/x86: kABI Workaround for 'perf/x86: Fix RDPMC vs. mm_struct tracking' (bsc#1061831). - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set (bnc#1012382). - powerpc: Fix DAR reporting when alignment handler faults (bnc#1012382). - powerpc/pseries: Fix parent_dn reference leak in add_dt_node() (bnc#1012382). - qed: Fix stack corruption on probe (bsc#966318 FATE#320158 bsc#966316 FATE#320159). - qlge: avoid memcpy buffer overflow (bnc#1012382). - rcu: Allow for page faults in NMI handlers (bnc#1012382). - rds: ib: add error handle (bnc#1012382). - rds: RDMA: Fix the composite message user notification (bnc#1012382). - Revert "bsg-lib: do not free job in bsg_prepare_job" (bnc#1012382). - Revert "net: fix percpu memory leaks" (bnc#1012382). - Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()" (bnc#1012382). - Revert "net: use lib/percpu_counter API for fragmentation mem accounting" (bnc#1012382). - Revert "tty: goldfish: Fix a parameter of a call to free_irq" (bnc#1012382). - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382). - sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task() (bnc#1012382). - sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs (bnc#1012382). - scsi: hpsa: add 'ctlr_num' sysfs attribute (bsc#1028971). - scsi: hpsa: bump driver version (bsc#1022600 fate#321928). - scsi: hpsa: change driver version (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: Check for null device pointers (bsc#1028971). - scsi: hpsa: Check for null devices in ioaccel (bsc#1028971). - scsi: hpsa: Check for vpd support before sending (bsc#1028971). - scsi: hpsa: cleanup reset handler (bsc#1022600 fate#321928). - scsi: hpsa: correct call to hpsa_do_reset (bsc#1028971). - scsi: hpsa: correct logical resets (bsc#1028971). - scsi: hpsa: correct queue depth for externals (bsc#1022600 fate#321928). - scsi: hpsa: correct resets on retried commands (bsc#1022600 fate#321928). - scsi: hpsa: correct scsi 6byte lba calculation (bsc#1028971). - scsi: hpsa: Determine device external status earlier (bsc#1028971). - scsi: hpsa: do not get enclosure info for external devices (bsc#1022600 fate#321928). - scsi: hpsa: do not reset enclosures (bsc#1022600 fate#321928). - scsi: hpsa: do not timeout reset operations (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: fallback to use legacy REPORT PHYS command (bsc#1028971). - scsi: hpsa: fix volume offline state (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: limit outstanding rescans (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: Prevent sending bmic commands to externals (bsc#1028971). - scsi: hpsa: remove abort handler (bsc#1022600 fate#321928). - scsi: hpsa: remove coalescing settings for ioaccel2 (bsc#1028971). - scsi: hpsa: remove memory allocate failure message (bsc#1028971). - scsi: hpsa: Remove unneeded void pointer cast (bsc#1028971). - scsi: hpsa: rescan later if reset in progress (bsc#1022600 fate#321928). - scsi: hpsa: send ioaccel requests with 0 length down raid path (bsc#1022600 fate#321928). - scsi: hpsa: separate monitor events from rescan worker (bsc#1022600 fate#321928). - scsi: hpsa: update check for logical volume status (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: update identify physical device structure (bsc#1022600 fate#321928). - scsi: hpsa: update pci ids (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: update reset handler (bsc#1022600 fate#321928). - scsi: hpsa: use designated initializers (bsc#1028971). - scsi: hpsa: use %phN for short hex dumps (bsc#1028971). - scsi: ILLEGAL REQUEST + ASC==27 => target failure (bsc#1059465). - scsi: libfc: fix a deadlock in fc_rport_work (bsc#1063695). - scsi: megaraid_sas: Check valid aen class range to avoid kernel panic (bnc#1012382). - scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead (bnc#1012382). - scsi: reset wait for IO completion (bsc#996376). - scsi: scsi_dh_emc: return success in clariion_std_inquiry() (bnc#1012382). - scsi: scsi_transport_fc: Also check for NOTPRESENT in fc_remote_port_add() (bsc#1037890). - scsi: scsi_transport_fc: set scsi_target_id upon rescan (bsc#1058135). - scsi: sd: Do not override max_sectors_kb sysfs setting (bsc#1025461). - scsi: sd: Remove LBPRZ dependency for discards (bsc#1060985). - scsi: sg: close race condition in sg_remove_sfp_usercontext() (bsc#1064206). - scsi: sg: do not return bogus Sg_requests (bsc#1064206). - scsi: sg: factor out sg_fill_request_table() (bnc#1012382). - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (bnc#1012382). - scsi: sg: off by one in sg_ioctl() (bnc#1012382). - scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206). - scsi: sg: remove 'save_scat_len' (bnc#1012382). - scsi: sg: use standard lists for sg_requests (bnc#1012382). - scsi: storvsc: fix memory leak on ring buffer busy (bnc#1012382). - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path (bnc#1012382). - scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records (bnc#1012382). - scsi: zfcp: fix missing trace records for early returns in TMF eh handlers (bnc#1012382). - scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA (bnc#1012382). - scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records (bnc#1012382). - scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled (bnc#1012382). - scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response (bnc#1012382). - scsi: zfcp: trace high part of "new" 64 bit SCSI LUN (bnc#1012382). - sctp: potential read out of bounds in sctp_ulpevent_type_enabled() (bnc#1012382). - seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() (bnc#1012382). - sh_eth: use correct name for ECMR_MPDE bit (bnc#1012382). - skd: Avoid that module unloading triggers a use-after-free (bnc#1012382). - skd: Submit requests to firmware before triggering the doorbell (bnc#1012382). - slub: do not merge cache if slub_debug contains a never-merge flag (bnc#1012382). - smb3: Do not ignore O_SYNC/O_DSYNC and O_DIRECT flags (bnc#1012382). - smb: Validate negotiate (to protect against downgrade) even if signing off (bnc#1012382). - sparc64: Migrate hvcons irq to panicked cpu (bnc#1012382). - staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack (bnc#1012382). - stm class: Fix a use-after-free (bnc#1012382). - supported.conf: mark hid-multitouch as supported (FATE#323670) - swiotlb-xen: implement xen_swiotlb_dma_mmap callback (bnc#1012382). - target/iscsi: Fix unsolicited data seq_end_offset calculation (bnc#1012382). - team: call netdev_change_features out of team lock (bsc#1055567). - team: fix memory leaks (bnc#1012382). - timer/sysclt: Restrict timer migration sysctl values to 0 and 1 (bnc#1012382). - tipc: use only positive error codes in messages (bnc#1012382). - tpm_tis: Do not fall back to a hardcoded address for TPM2 (bsc#1020645, fate#321435, fate#321507, fate#321600, bsc#1034048). - tracing: Apply trace_clock changes to instance max buffer (bnc#1012382). - tracing: Erase irqsoff trace with empty write (bnc#1012382). - tracing: Fix trace_pipe behavior for instance traces (bnc#1012382). - ttpci: address stringop overflow warning (bnc#1012382). - tty: fix __tty_insert_flip_char regression (bnc#1012382). - tty: goldfish: Fix a parameter of a call to free_irq (bnc#1012382). - tty: improve tty_insert_flip_char() fast path (bnc#1012382). - tty: improve tty_insert_flip_char() slow path (bnc#1012382). - tun: bail out from tun_get_user() if the skb is empty (bnc#1012382). - uapi: fix linux/mroute6.h userspace compilation errors (bnc#1012382). - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382). - udpv6: Fix the checksum computation when HW checksum does not apply (bnc#1012382). - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382). - usb: chipidea: vbus event may exist before starting gadget (bnc#1012382). - usb: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (bnc#1012382). - usb: core: harden cdc_parse_cdc_header (bnc#1012382). - usb: devio: Do not corrupt user memory (bnc#1012382). - usb: devio: Revert "USB: devio: Do not corrupt user memory" (bnc#1012382). - usb: dummy-hcd: fix connection failures (wrong speed) (bnc#1012382). - usb: dummy-hcd: Fix deadlock caused by disconnect detection (bnc#1012382). - usb: dummy-hcd: Fix erroneous synchronization change (bnc#1012382). - usb: dummy-hcd: fix infinite-loop resubmission bug (bnc#1012382). - usb: fix out-of-bounds in usb_set_configuration (bnc#1012382). - usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options (bnc#1012382). - usb: gadgetfs: fix copy_to_user while holding spinlock (bnc#1012382). - usb: gadgetfs: Fix crash caused by inadequate synchronization (bnc#1012382). - usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write (bnc#1012382). - usb: gadget: mass_storage: set msg_registered after msg registered (bnc#1012382). - usb: gadget: udc: atmel: set vbus irqflags explicitly (bnc#1012382). - usb: g_mass_storage: Fix deadlock when driver is unbound (bnc#1012382). - usb: hub: Allow reset retry for USB2 devices on connect bounce (bnc#1012382). - usb: Increase quirk delay for USB devices (bnc#1012382). - usb: musb: Check for host-mode using is_host_active() on reset interrupt (bnc#1012382). - usb: musb: sunxi: Explicitly release USB PHY on exit (bnc#1012382). - usb: pci-quirks.c: Corrected timeout values used in handshake (bnc#1012382). - usb: plusb: Add support for PL-27A1 (bnc#1012382). - usb: quirks: add quirk for WORLDE MINI MIDI keyboard (bnc#1012382). - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet (bnc#1012382). - usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe (bnc#1012382). - usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction (bnc#1012382). - usb: serial: console: fix use-after-free after failed setup (bnc#1012382). - usb: serial: cp210x: add support for ELV TFD500 (bnc#1012382). - usb: serial: ftdi_sio: add id for Cypress WICED dev board (bnc#1012382). - usb: serial: metro-usb: add MS7820 device id (bnc#1012382). - usb: serial: mos7720: fix control-message error handling (bnc#1012382). - usb: serial: mos7840: fix control-message error handling (bnc#1012382). - usb: serial: option: add support for TP-Link LTE module (bnc#1012382). - usb: serial: qcserial: add Dell DW5818, DW5819 (bnc#1012382). - usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives (bnc#1012382). - usb: uas: fix bug in handling of alternate settings (bnc#1012382). - uwb: ensure that endpoint is interrupt (bnc#1012382). - uwb: properly check kthread_run return value (bnc#1012382). - vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets (bnc#1012382). - video: fbdev: aty: do not leak uninitialized padding in clk to userspace (bnc#1012382). - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit (bnc#1012382). - watchdog: kempld: fix gcc-4.3 build (bnc#1012382). - x86/alternatives: Fix alt_max_short macro to really be a max() (bnc#1012382). - x86/fpu: Do not let userspace set bogus xcomp_bv (bnc#1012382). - x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps (bnc#1012382). - x86/ldt: Fix off by one in get_segment_base() (bsc#1061872). - xfs/dmapi: fix incorrect file->f_path.dentry->d_inode usage (bsc#1055896). - xfs: handle error if xfs_btree_get_bufs fails (bsc#1059863). - xfs: remove kmem_zalloc_greedy (bnc#1012382). - xhci: fix finding correct bus_state structure for USB 3.1 hosts (bnc#1012382). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Real Time Extension 12-SP2: zypper in -t patch SUSE-SLE-RT-12-SP2-2017-2034=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Real Time Extension 12-SP2 (noarch): kernel-devel-rt-4.4.95-21.1 kernel-source-rt-4.4.95-21.1 - SUSE Linux Enterprise Real Time Extension 12-SP2 (x86_64): cluster-md-kmp-rt-4.4.95-21.1 cluster-md-kmp-rt-debuginfo-4.4.95-21.1 cluster-network-kmp-rt-4.4.95-21.1 cluster-network-kmp-rt-debuginfo-4.4.95-21.1 dlm-kmp-rt-4.4.95-21.1 dlm-kmp-rt-debuginfo-4.4.95-21.1 gfs2-kmp-rt-4.4.95-21.1 gfs2-kmp-rt-debuginfo-4.4.95-21.1 kernel-rt-4.4.95-21.1 kernel-rt-base-4.4.95-21.1 kernel-rt-base-debuginfo-4.4.95-21.1 kernel-rt-debuginfo-4.4.95-21.1 kernel-rt-debugsource-4.4.95-21.1 kernel-rt-devel-4.4.95-21.1 kernel-rt_debug-debuginfo-4.4.95-21.1 kernel-rt_debug-debugsource-4.4.95-21.1 kernel-rt_debug-devel-4.4.95-21.1 kernel-rt_debug-devel-debuginfo-4.4.95-21.1 kernel-syms-rt-4.4.95-21.1 ocfs2-kmp-rt-4.4.95-21.1 ocfs2-kmp-rt-debuginfo-4.4.95-21.1 References: https://www.suse.com/security/cve/CVE-2017-12153.html https://www.suse.com/security/cve/CVE-2017-13080.html https://www.suse.com/security/cve/CVE-2017-14489.html https://www.suse.com/security/cve/CVE-2017-15265.html https://www.suse.com/security/cve/CVE-2017-15649.html https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1017461 https://bugzilla.suse.com/1020645 https://bugzilla.suse.com/1022595 https://bugzilla.suse.com/1022600 https://bugzilla.suse.com/1022914 https://bugzilla.suse.com/1022967 https://bugzilla.suse.com/1025461 https://bugzilla.suse.com/1028971 https://bugzilla.suse.com/1030061 https://bugzilla.suse.com/1034048 https://bugzilla.suse.com/1037890 https://bugzilla.suse.com/1052593 https://bugzilla.suse.com/1053919 https://bugzilla.suse.com/1055493 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1055755 https://bugzilla.suse.com/1055896 https://bugzilla.suse.com/1056427 https://bugzilla.suse.com/1058135 https://bugzilla.suse.com/1058410 https://bugzilla.suse.com/1058624 https://bugzilla.suse.com/1059051 https://bugzilla.suse.com/1059465 https://bugzilla.suse.com/1059863 https://bugzilla.suse.com/1060197 https://bugzilla.suse.com/1060985 https://bugzilla.suse.com/1061017 https://bugzilla.suse.com/1061046 https://bugzilla.suse.com/1061064 https://bugzilla.suse.com/1061067 https://bugzilla.suse.com/1061172 https://bugzilla.suse.com/1061451 https://bugzilla.suse.com/1061831 https://bugzilla.suse.com/1061872 https://bugzilla.suse.com/1062520 https://bugzilla.suse.com/1062962 https://bugzilla.suse.com/1063460 https://bugzilla.suse.com/1063475 https://bugzilla.suse.com/1063501 https://bugzilla.suse.com/1063509 https://bugzilla.suse.com/1063520 https://bugzilla.suse.com/1063667 https://bugzilla.suse.com/1063695 https://bugzilla.suse.com/1064206 https://bugzilla.suse.com/1064388 https://bugzilla.suse.com/1064701 https://bugzilla.suse.com/964944 https://bugzilla.suse.com/966170 https://bugzilla.suse.com/966172 https://bugzilla.suse.com/966186 https://bugzilla.suse.com/966191 https://bugzilla.suse.com/966316 https://bugzilla.suse.com/966318 https://bugzilla.suse.com/969474 https://bugzilla.suse.com/969475 https://bugzilla.suse.com/969476 https://bugzilla.suse.com/969477 https://bugzilla.suse.com/971975 https://bugzilla.suse.com/974590 https://bugzilla.suse.com/996376 From sle-updates at lists.suse.com Wed Dec 13 13:08:34 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 13 Dec 2017 21:08:34 +0100 (CET) Subject: SUSE-SU-2017:3276-1: important: Security update for intel-SINIT Message-ID: <20171213200834.9E944FC9D@maintenance.suse.de> SUSE Security Update: Security update for intel-SINIT ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3276-1 Rating: important References: #1069754 Cross-References: CVE-2011-5174 Affected Products: SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for intel-SINIT fixes the following issues: Security issue fixed: - CVE-2011-5174: Fixed security issue in old SINIT files which allowed local users to bypass the TXT protection mechanism (bsc#1069754). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-intel-SINIT-13376=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (noarch): intel-SINIT-1-0.81.3.2 References: https://www.suse.com/security/cve/CVE-2011-5174.html https://bugzilla.suse.com/1069754 From sle-updates at lists.suse.com Wed Dec 13 13:09:00 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 13 Dec 2017 21:09:00 +0100 (CET) Subject: SUSE-SU-2017:3277-1: moderate: Security update for php5 Message-ID: <20171213200900.D2A53FCA4@maintenance.suse.de> SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3277-1 Rating: moderate References: #1067090 #1067441 #1069606 #1069631 Cross-References: CVE-2017-16642 CVE-2017-4025 CVE-2017-9228 CVE-2017-9229 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Module for Web Scripting 12 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for php5 fixes the following issues: Security issues fixed: - CVE-2017-16642: Fix timelib_meridian error that could be used to leak information from the interpreter (bsc#1067441). - CVE-2017-4025: Fix pathname truncation in set_include_path, tempnam, rmdir, and readlink (bsc#1067090). - CVE-2017-9228: Fix heap out-of-bounds write that occurs in bitset_set_range() during regex compilation (bsc#1069606). - CVE-2017-9229: Fix invalid pointer dereference in left_adjust_char_head() (bsc#1069631). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2040=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2040=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2017-2040=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): php5-debuginfo-5.5.14-109.13.1 php5-debugsource-5.5.14-109.13.1 php5-devel-5.5.14-109.13.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): php5-debuginfo-5.5.14-109.13.1 php5-debugsource-5.5.14-109.13.1 php5-devel-5.5.14-109.13.1 - SUSE Linux Enterprise Module for Web Scripting 12 (aarch64 ppc64le s390x x86_64): apache2-mod_php5-5.5.14-109.13.1 apache2-mod_php5-debuginfo-5.5.14-109.13.1 php5-5.5.14-109.13.1 php5-bcmath-5.5.14-109.13.1 php5-bcmath-debuginfo-5.5.14-109.13.1 php5-bz2-5.5.14-109.13.1 php5-bz2-debuginfo-5.5.14-109.13.1 php5-calendar-5.5.14-109.13.1 php5-calendar-debuginfo-5.5.14-109.13.1 php5-ctype-5.5.14-109.13.1 php5-ctype-debuginfo-5.5.14-109.13.1 php5-curl-5.5.14-109.13.1 php5-curl-debuginfo-5.5.14-109.13.1 php5-dba-5.5.14-109.13.1 php5-dba-debuginfo-5.5.14-109.13.1 php5-debuginfo-5.5.14-109.13.1 php5-debugsource-5.5.14-109.13.1 php5-dom-5.5.14-109.13.1 php5-dom-debuginfo-5.5.14-109.13.1 php5-enchant-5.5.14-109.13.1 php5-enchant-debuginfo-5.5.14-109.13.1 php5-exif-5.5.14-109.13.1 php5-exif-debuginfo-5.5.14-109.13.1 php5-fastcgi-5.5.14-109.13.1 php5-fastcgi-debuginfo-5.5.14-109.13.1 php5-fileinfo-5.5.14-109.13.1 php5-fileinfo-debuginfo-5.5.14-109.13.1 php5-fpm-5.5.14-109.13.1 php5-fpm-debuginfo-5.5.14-109.13.1 php5-ftp-5.5.14-109.13.1 php5-ftp-debuginfo-5.5.14-109.13.1 php5-gd-5.5.14-109.13.1 php5-gd-debuginfo-5.5.14-109.13.1 php5-gettext-5.5.14-109.13.1 php5-gettext-debuginfo-5.5.14-109.13.1 php5-gmp-5.5.14-109.13.1 php5-gmp-debuginfo-5.5.14-109.13.1 php5-iconv-5.5.14-109.13.1 php5-iconv-debuginfo-5.5.14-109.13.1 php5-imap-5.5.14-109.13.1 php5-imap-debuginfo-5.5.14-109.13.1 php5-intl-5.5.14-109.13.1 php5-intl-debuginfo-5.5.14-109.13.1 php5-json-5.5.14-109.13.1 php5-json-debuginfo-5.5.14-109.13.1 php5-ldap-5.5.14-109.13.1 php5-ldap-debuginfo-5.5.14-109.13.1 php5-mbstring-5.5.14-109.13.1 php5-mbstring-debuginfo-5.5.14-109.13.1 php5-mcrypt-5.5.14-109.13.1 php5-mcrypt-debuginfo-5.5.14-109.13.1 php5-mysql-5.5.14-109.13.1 php5-mysql-debuginfo-5.5.14-109.13.1 php5-odbc-5.5.14-109.13.1 php5-odbc-debuginfo-5.5.14-109.13.1 php5-opcache-5.5.14-109.13.1 php5-opcache-debuginfo-5.5.14-109.13.1 php5-openssl-5.5.14-109.13.1 php5-openssl-debuginfo-5.5.14-109.13.1 php5-pcntl-5.5.14-109.13.1 php5-pcntl-debuginfo-5.5.14-109.13.1 php5-pdo-5.5.14-109.13.1 php5-pdo-debuginfo-5.5.14-109.13.1 php5-pgsql-5.5.14-109.13.1 php5-pgsql-debuginfo-5.5.14-109.13.1 php5-phar-5.5.14-109.13.1 php5-phar-debuginfo-5.5.14-109.13.1 php5-posix-5.5.14-109.13.1 php5-posix-debuginfo-5.5.14-109.13.1 php5-pspell-5.5.14-109.13.1 php5-pspell-debuginfo-5.5.14-109.13.1 php5-shmop-5.5.14-109.13.1 php5-shmop-debuginfo-5.5.14-109.13.1 php5-snmp-5.5.14-109.13.1 php5-snmp-debuginfo-5.5.14-109.13.1 php5-soap-5.5.14-109.13.1 php5-soap-debuginfo-5.5.14-109.13.1 php5-sockets-5.5.14-109.13.1 php5-sockets-debuginfo-5.5.14-109.13.1 php5-sqlite-5.5.14-109.13.1 php5-sqlite-debuginfo-5.5.14-109.13.1 php5-suhosin-5.5.14-109.13.1 php5-suhosin-debuginfo-5.5.14-109.13.1 php5-sysvmsg-5.5.14-109.13.1 php5-sysvmsg-debuginfo-5.5.14-109.13.1 php5-sysvsem-5.5.14-109.13.1 php5-sysvsem-debuginfo-5.5.14-109.13.1 php5-sysvshm-5.5.14-109.13.1 php5-sysvshm-debuginfo-5.5.14-109.13.1 php5-tokenizer-5.5.14-109.13.1 php5-tokenizer-debuginfo-5.5.14-109.13.1 php5-wddx-5.5.14-109.13.1 php5-wddx-debuginfo-5.5.14-109.13.1 php5-xmlreader-5.5.14-109.13.1 php5-xmlreader-debuginfo-5.5.14-109.13.1 php5-xmlrpc-5.5.14-109.13.1 php5-xmlrpc-debuginfo-5.5.14-109.13.1 php5-xmlwriter-5.5.14-109.13.1 php5-xmlwriter-debuginfo-5.5.14-109.13.1 php5-xsl-5.5.14-109.13.1 php5-xsl-debuginfo-5.5.14-109.13.1 php5-zip-5.5.14-109.13.1 php5-zip-debuginfo-5.5.14-109.13.1 php5-zlib-5.5.14-109.13.1 php5-zlib-debuginfo-5.5.14-109.13.1 - SUSE Linux Enterprise Module for Web Scripting 12 (noarch): php5-pear-5.5.14-109.13.1 References: https://www.suse.com/security/cve/CVE-2017-16642.html https://www.suse.com/security/cve/CVE-2017-4025.html https://www.suse.com/security/cve/CVE-2017-9228.html https://www.suse.com/security/cve/CVE-2017-9229.html https://bugzilla.suse.com/1067090 https://bugzilla.suse.com/1067441 https://bugzilla.suse.com/1069606 https://bugzilla.suse.com/1069631 From sle-updates at lists.suse.com Wed Dec 13 13:09:47 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 13 Dec 2017 21:09:47 +0100 (CET) Subject: SUSE-SU-2017:3278-1: moderate: Security update for libapr-util1 Message-ID: <20171213200947.D2427FCA4@maintenance.suse.de> SUSE Security Update: Security update for libapr-util1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3278-1 Rating: moderate References: #1064990 Cross-References: CVE-2017-12618 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libapr-util1 fixes the following issues: Security issue fixed: - CVE-2017-12618: DoS via crafted SDBM database files in apr_sdbm*() functions (bsc#1064990) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2039=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2039=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2039=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2039=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2039=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libapr-util1-1.5.3-2.3.1 libapr-util1-debuginfo-1.5.3-2.3.1 libapr-util1-debugsource-1.5.3-2.3.1 libapr-util1-devel-1.5.3-2.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libapr-util1-1.5.3-2.3.1 libapr-util1-debuginfo-1.5.3-2.3.1 libapr-util1-debugsource-1.5.3-2.3.1 libapr-util1-devel-1.5.3-2.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libapr-util1-1.5.3-2.3.1 libapr-util1-dbd-sqlite3-1.5.3-2.3.1 libapr-util1-dbd-sqlite3-debuginfo-1.5.3-2.3.1 libapr-util1-debuginfo-1.5.3-2.3.1 libapr-util1-debugsource-1.5.3-2.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libapr-util1-1.5.3-2.3.1 libapr-util1-dbd-sqlite3-1.5.3-2.3.1 libapr-util1-dbd-sqlite3-debuginfo-1.5.3-2.3.1 libapr-util1-debuginfo-1.5.3-2.3.1 libapr-util1-debugsource-1.5.3-2.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libapr-util1-1.5.3-2.3.1 libapr-util1-dbd-sqlite3-1.5.3-2.3.1 libapr-util1-dbd-sqlite3-debuginfo-1.5.3-2.3.1 libapr-util1-debuginfo-1.5.3-2.3.1 libapr-util1-debugsource-1.5.3-2.3.1 References: https://www.suse.com/security/cve/CVE-2017-12618.html https://bugzilla.suse.com/1064990 From sle-updates at lists.suse.com Wed Dec 13 13:10:16 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 13 Dec 2017 21:10:16 +0100 (CET) Subject: SUSE-SU-2017:3279-1: important: Security update for tomcat Message-ID: <20171213201016.DBCC8FCA4@maintenance.suse.de> SUSE Security Update: Security update for tomcat ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3279-1 Rating: important References: #1002639 #1019016 #1042910 #1053352 #1059554 #977410 Cross-References: CVE-2017-12617 CVE-2017-5664 CVE-2017-7674 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for tomcat fixes the following issues: Security issues fixed: - CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910). - CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352) - CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554) Non security issues fixed: - Fix tomcat-digest classpath error (bsc#977410) - Read setenv.sh when starting Tomcat with catalina.sh (bsc#1002639) - Fix packaged /etc/alternatives symlinks for api libs that caused rpm -V to report link mismatch (bsc#1019016) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-2038=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2038=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2038=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (noarch): tomcat-8.0.43-10.24.1 tomcat-admin-webapps-8.0.43-10.24.1 tomcat-docs-webapp-8.0.43-10.24.1 tomcat-el-3_0-api-8.0.43-10.24.1 tomcat-javadoc-8.0.43-10.24.1 tomcat-jsp-2_3-api-8.0.43-10.24.1 tomcat-lib-8.0.43-10.24.1 tomcat-servlet-3_1-api-8.0.43-10.24.1 tomcat-webapps-8.0.43-10.24.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): tomcat-8.0.43-10.24.1 tomcat-admin-webapps-8.0.43-10.24.1 tomcat-docs-webapp-8.0.43-10.24.1 tomcat-el-3_0-api-8.0.43-10.24.1 tomcat-javadoc-8.0.43-10.24.1 tomcat-jsp-2_3-api-8.0.43-10.24.1 tomcat-lib-8.0.43-10.24.1 tomcat-servlet-3_1-api-8.0.43-10.24.1 tomcat-webapps-8.0.43-10.24.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): tomcat-8.0.43-10.24.1 tomcat-admin-webapps-8.0.43-10.24.1 tomcat-docs-webapp-8.0.43-10.24.1 tomcat-el-3_0-api-8.0.43-10.24.1 tomcat-javadoc-8.0.43-10.24.1 tomcat-jsp-2_3-api-8.0.43-10.24.1 tomcat-lib-8.0.43-10.24.1 tomcat-servlet-3_1-api-8.0.43-10.24.1 tomcat-webapps-8.0.43-10.24.1 References: https://www.suse.com/security/cve/CVE-2017-12617.html https://www.suse.com/security/cve/CVE-2017-5664.html https://www.suse.com/security/cve/CVE-2017-7674.html https://bugzilla.suse.com/1002639 https://bugzilla.suse.com/1019016 https://bugzilla.suse.com/1042910 https://bugzilla.suse.com/1053352 https://bugzilla.suse.com/1059554 https://bugzilla.suse.com/977410 From sle-updates at lists.suse.com Wed Dec 13 13:11:27 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 13 Dec 2017 21:11:27 +0100 (CET) Subject: SUSE-RU-2017:3280-1: Recommended update for util-linux Message-ID: <20171213201127.DDC06FCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for util-linux ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3280-1 Rating: low References: #1039276 #1040968 #1055446 #1066500 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for util-linux provides the following fixes: - Allow unmounting of filesystems without calling stat() on the mount point, when "-c" is used. (bsc#1040968) - Fix an infinite loop, a crash and report the correct minimum and maximum frequencies in lscpu for some processors. (bsc#1055446) - Fix a lscpu failure on Sydney Amazon EC2 region. (bsc#1066500) - If multiple subvolumes are mounted, report the default subvolume. (bsc#1039276) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2036=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2036=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2036=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2036=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2036=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): libuuid-devel-2.29.2-3.5.1 util-linux-debuginfo-2.29.2-3.5.1 util-linux-debugsource-2.29.2-3.5.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libblkid-devel-2.29.2-3.5.1 libmount-devel-2.29.2-3.5.1 libsmartcols-devel-2.29.2-3.5.1 libuuid-devel-2.29.2-3.5.1 util-linux-debuginfo-2.29.2-3.5.1 util-linux-debugsource-2.29.2-3.5.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libblkid1-2.29.2-3.5.1 libblkid1-debuginfo-2.29.2-3.5.1 libfdisk1-2.29.2-3.5.1 libfdisk1-debuginfo-2.29.2-3.5.1 libmount1-2.29.2-3.5.1 libmount1-debuginfo-2.29.2-3.5.1 libsmartcols1-2.29.2-3.5.1 libsmartcols1-debuginfo-2.29.2-3.5.1 libuuid1-2.29.2-3.5.1 libuuid1-debuginfo-2.29.2-3.5.1 python-libmount-2.29.2-3.5.4 python-libmount-debuginfo-2.29.2-3.5.4 python-libmount-debugsource-2.29.2-3.5.4 util-linux-2.29.2-3.5.1 util-linux-debuginfo-2.29.2-3.5.1 util-linux-debugsource-2.29.2-3.5.1 util-linux-systemd-2.29.2-3.5.4 util-linux-systemd-debuginfo-2.29.2-3.5.4 util-linux-systemd-debugsource-2.29.2-3.5.4 uuidd-2.29.2-3.5.4 uuidd-debuginfo-2.29.2-3.5.4 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libblkid1-32bit-2.29.2-3.5.1 libblkid1-debuginfo-32bit-2.29.2-3.5.1 libmount1-32bit-2.29.2-3.5.1 libmount1-debuginfo-32bit-2.29.2-3.5.1 libuuid1-32bit-2.29.2-3.5.1 libuuid1-debuginfo-32bit-2.29.2-3.5.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): util-linux-lang-2.29.2-3.5.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libblkid1-2.29.2-3.5.1 libblkid1-32bit-2.29.2-3.5.1 libblkid1-debuginfo-2.29.2-3.5.1 libblkid1-debuginfo-32bit-2.29.2-3.5.1 libfdisk1-2.29.2-3.5.1 libfdisk1-debuginfo-2.29.2-3.5.1 libmount1-2.29.2-3.5.1 libmount1-32bit-2.29.2-3.5.1 libmount1-debuginfo-2.29.2-3.5.1 libmount1-debuginfo-32bit-2.29.2-3.5.1 libsmartcols1-2.29.2-3.5.1 libsmartcols1-debuginfo-2.29.2-3.5.1 libuuid-devel-2.29.2-3.5.1 libuuid1-2.29.2-3.5.1 libuuid1-32bit-2.29.2-3.5.1 libuuid1-debuginfo-2.29.2-3.5.1 libuuid1-debuginfo-32bit-2.29.2-3.5.1 python-libmount-2.29.2-3.5.4 python-libmount-debuginfo-2.29.2-3.5.4 python-libmount-debugsource-2.29.2-3.5.4 util-linux-2.29.2-3.5.1 util-linux-debuginfo-2.29.2-3.5.1 util-linux-debugsource-2.29.2-3.5.1 util-linux-systemd-2.29.2-3.5.4 util-linux-systemd-debuginfo-2.29.2-3.5.4 util-linux-systemd-debugsource-2.29.2-3.5.4 uuidd-2.29.2-3.5.4 uuidd-debuginfo-2.29.2-3.5.4 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): util-linux-lang-2.29.2-3.5.1 - SUSE Container as a Service Platform ALL (x86_64): libblkid1-2.29.2-3.5.1 libblkid1-debuginfo-2.29.2-3.5.1 libfdisk1-2.29.2-3.5.1 libfdisk1-debuginfo-2.29.2-3.5.1 libmount1-2.29.2-3.5.1 libmount1-debuginfo-2.29.2-3.5.1 libsmartcols1-2.29.2-3.5.1 libsmartcols1-debuginfo-2.29.2-3.5.1 libuuid1-2.29.2-3.5.1 libuuid1-debuginfo-2.29.2-3.5.1 util-linux-2.29.2-3.5.1 util-linux-debuginfo-2.29.2-3.5.1 util-linux-debugsource-2.29.2-3.5.1 util-linux-systemd-2.29.2-3.5.4 util-linux-systemd-debuginfo-2.29.2-3.5.4 util-linux-systemd-debugsource-2.29.2-3.5.4 References: https://bugzilla.suse.com/1039276 https://bugzilla.suse.com/1040968 https://bugzilla.suse.com/1055446 https://bugzilla.suse.com/1066500 From sle-updates at lists.suse.com Wed Dec 13 16:08:49 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 00:08:49 +0100 (CET) Subject: SUSE-RU-2017:3281-1: Recommended update for libXext Message-ID: <20171213230849.23F46FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for libXext ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3281-1 Rating: low References: #1067406 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libXext provides the following fix: - Remove warning messages about missing Xge extension when translating events in a mixed Xlib/xcb scenario, causing the ~/.xsession-errors file to be massively filled. (bsc#1067406) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2042=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2042=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2042=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2042=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2042=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2042=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2042=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libXext-debugsource-1.3.2-4.3.1 libXext-devel-1.3.2-4.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libXext-debugsource-1.3.2-4.3.1 libXext-devel-1.3.2-4.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libXext-debugsource-1.3.2-4.3.1 libXext6-1.3.2-4.3.1 libXext6-debuginfo-1.3.2-4.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libXext-debugsource-1.3.2-4.3.1 libXext6-1.3.2-4.3.1 libXext6-debuginfo-1.3.2-4.3.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libXext6-32bit-1.3.2-4.3.1 libXext6-debuginfo-32bit-1.3.2-4.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libXext-debugsource-1.3.2-4.3.1 libXext6-1.3.2-4.3.1 libXext6-debuginfo-1.3.2-4.3.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libXext6-32bit-1.3.2-4.3.1 libXext6-debuginfo-32bit-1.3.2-4.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libXext-debugsource-1.3.2-4.3.1 libXext6-1.3.2-4.3.1 libXext6-32bit-1.3.2-4.3.1 libXext6-debuginfo-1.3.2-4.3.1 libXext6-debuginfo-32bit-1.3.2-4.3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libXext-debugsource-1.3.2-4.3.1 libXext6-1.3.2-4.3.1 libXext6-32bit-1.3.2-4.3.1 libXext6-debuginfo-1.3.2-4.3.1 libXext6-debuginfo-32bit-1.3.2-4.3.1 References: https://bugzilla.suse.com/1067406 From sle-updates at lists.suse.com Wed Dec 13 16:09:19 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 00:09:19 +0100 (CET) Subject: SUSE-RU-2017:3282-1: Recommended update for pcp Message-ID: <20171213230919.89711FCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for pcp ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3282-1 Rating: low References: #1055503 #1056397 #841204 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update provides Performance Co-Pilot (pcp) 3.11.9, which brings many fixes and enhancements. With this version update, the PCP performance metrics have been split in multiple sub-packages that supplement the main "pcp" package. Users are advised to review the list of pcp-pmda-* packages available in 3.11.9: activemq apache bash bind2 bonding cifs cisco dbping dm docker ds389 ds389log elasticsearch gfs2 gluster gpfs gpsd infiniband kvm libvirt lio lmsensors logger lustre lustrecomm mailq memcache mic mounts mysql named netfilter news nfsclient nginx nutcracker nvidia-gpu oracle papi pdns perfevent postfix redis roomtemp rpm rsyslog samba sendmail shping slurm snmp summary systemd trace unbound vmware weblog zimbra zswap. Two other main features have been included in this update: "pcp-gui" provides visualization tools for the Performance Co-Pilot toolkit while "pcp-webapi" provides a daemon (pmwebd) that binds a large subset of the Performance Co-Pilot client API (PMAPI) to RESTful web applications using the HTTP (PMWEBAPI) protocol. A comprehensive list of changes between versions 3.6.10 and 3.11.9 is available at https://github.com/performancecopilot/pcp/blob/master/CHANGELOG Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2043=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2043=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libpcp-devel-3.11.9-6.7.2 libpcp3-3.11.9-6.7.2 libpcp3-debuginfo-3.11.9-6.7.2 libpcp_gui2-3.11.9-6.7.2 libpcp_gui2-debuginfo-3.11.9-6.7.2 libpcp_import1-3.11.9-6.7.2 libpcp_import1-debuginfo-3.11.9-6.7.2 libpcp_mmv1-3.11.9-6.7.2 libpcp_mmv1-debuginfo-3.11.9-6.7.2 libpcp_trace2-3.11.9-6.7.2 libpcp_trace2-debuginfo-3.11.9-6.7.2 libpcp_web1-3.11.9-6.7.2 libpcp_web1-debuginfo-3.11.9-6.7.2 pcp-3.11.9-6.7.2 pcp-conf-3.11.9-6.7.2 pcp-debuginfo-3.11.9-6.7.2 pcp-debugsource-3.11.9-6.7.2 pcp-devel-3.11.9-6.7.2 pcp-devel-debuginfo-3.11.9-6.7.2 pcp-export-pcp2graphite-3.11.9-6.7.2 pcp-export-pcp2influxdb-3.11.9-6.7.2 pcp-export-zabbix-agent-3.11.9-6.7.2 pcp-export-zabbix-agent-debuginfo-3.11.9-6.7.2 pcp-gui-3.11.9-6.7.2 pcp-gui-debuginfo-3.11.9-6.7.2 pcp-import-collectl2pcp-3.11.9-6.7.2 pcp-import-collectl2pcp-debuginfo-3.11.9-6.7.2 pcp-import-ganglia2pcp-3.11.9-6.7.2 pcp-import-iostat2pcp-3.11.9-6.7.2 pcp-import-mrtg2pcp-3.11.9-6.7.2 pcp-import-sar2pcp-3.11.9-6.7.2 pcp-manager-3.11.9-6.7.2 pcp-manager-debuginfo-3.11.9-6.7.2 pcp-pmda-activemq-3.11.9-6.7.2 pcp-pmda-apache-3.11.9-6.7.2 pcp-pmda-apache-debuginfo-3.11.9-6.7.2 pcp-pmda-bash-3.11.9-6.7.2 pcp-pmda-bash-debuginfo-3.11.9-6.7.2 pcp-pmda-bind2-3.11.9-6.7.2 pcp-pmda-bonding-3.11.9-6.7.2 pcp-pmda-cifs-3.11.9-6.7.2 pcp-pmda-cifs-debuginfo-3.11.9-6.7.2 pcp-pmda-cisco-3.11.9-6.7.2 pcp-pmda-cisco-debuginfo-3.11.9-6.7.2 pcp-pmda-dbping-3.11.9-6.7.2 pcp-pmda-dm-3.11.9-6.7.2 pcp-pmda-dm-debuginfo-3.11.9-6.7.2 pcp-pmda-docker-3.11.9-6.7.2 pcp-pmda-docker-debuginfo-3.11.9-6.7.2 pcp-pmda-ds389-3.11.9-6.7.2 pcp-pmda-ds389log-3.11.9-6.7.2 pcp-pmda-elasticsearch-3.11.9-6.7.2 pcp-pmda-gfs2-3.11.9-6.7.2 pcp-pmda-gfs2-debuginfo-3.11.9-6.7.2 pcp-pmda-gluster-3.11.9-6.7.2 pcp-pmda-gpfs-3.11.9-6.7.2 pcp-pmda-gpsd-3.11.9-6.7.2 pcp-pmda-kvm-3.11.9-6.7.2 pcp-pmda-libvirt-3.11.9-6.7.2 pcp-pmda-lio-3.11.9-6.7.2 pcp-pmda-lmsensors-3.11.9-6.7.2 pcp-pmda-lmsensors-debuginfo-3.11.9-6.7.2 pcp-pmda-logger-3.11.9-6.7.2 pcp-pmda-logger-debuginfo-3.11.9-6.7.2 pcp-pmda-lustre-3.11.9-6.7.2 pcp-pmda-lustrecomm-3.11.9-6.7.2 pcp-pmda-lustrecomm-debuginfo-3.11.9-6.7.2 pcp-pmda-mailq-3.11.9-6.7.2 pcp-pmda-mailq-debuginfo-3.11.9-6.7.2 pcp-pmda-memcache-3.11.9-6.7.2 pcp-pmda-mic-3.11.9-6.7.2 pcp-pmda-mounts-3.11.9-6.7.2 pcp-pmda-mounts-debuginfo-3.11.9-6.7.2 pcp-pmda-mysql-3.11.9-6.7.2 pcp-pmda-named-3.11.9-6.7.2 pcp-pmda-netfilter-3.11.9-6.7.2 pcp-pmda-news-3.11.9-6.7.2 pcp-pmda-nfsclient-3.11.9-6.7.2 pcp-pmda-nginx-3.11.9-6.7.2 pcp-pmda-nutcracker-3.11.9-6.7.2 pcp-pmda-nvidia-gpu-3.11.9-6.7.2 pcp-pmda-nvidia-gpu-debuginfo-3.11.9-6.7.2 pcp-pmda-oracle-3.11.9-6.7.2 pcp-pmda-pdns-3.11.9-6.7.2 pcp-pmda-postfix-3.11.9-6.7.2 pcp-pmda-redis-3.11.9-6.7.2 pcp-pmda-roomtemp-3.11.9-6.7.2 pcp-pmda-roomtemp-debuginfo-3.11.9-6.7.2 pcp-pmda-rpm-3.11.9-6.7.2 pcp-pmda-rpm-debuginfo-3.11.9-6.7.2 pcp-pmda-rsyslog-3.11.9-6.7.2 pcp-pmda-samba-3.11.9-6.7.2 pcp-pmda-sendmail-3.11.9-6.7.2 pcp-pmda-sendmail-debuginfo-3.11.9-6.7.2 pcp-pmda-shping-3.11.9-6.7.2 pcp-pmda-shping-debuginfo-3.11.9-6.7.2 pcp-pmda-slurm-3.11.9-6.7.2 pcp-pmda-snmp-3.11.9-6.7.2 pcp-pmda-summary-3.11.9-6.7.2 pcp-pmda-summary-debuginfo-3.11.9-6.7.2 pcp-pmda-systemd-3.11.9-6.7.2 pcp-pmda-systemd-debuginfo-3.11.9-6.7.2 pcp-pmda-trace-3.11.9-6.7.2 pcp-pmda-trace-debuginfo-3.11.9-6.7.2 pcp-pmda-unbound-3.11.9-6.7.2 pcp-pmda-vmware-3.11.9-6.7.2 pcp-pmda-weblog-3.11.9-6.7.2 pcp-pmda-weblog-debuginfo-3.11.9-6.7.2 pcp-pmda-zimbra-3.11.9-6.7.2 pcp-pmda-zswap-3.11.9-6.7.2 pcp-system-tools-3.11.9-6.7.2 pcp-webapi-3.11.9-6.7.2 pcp-webapi-debuginfo-3.11.9-6.7.2 perl-PCP-LogImport-3.11.9-6.7.2 perl-PCP-LogImport-debuginfo-3.11.9-6.7.2 perl-PCP-LogSummary-3.11.9-6.7.2 perl-PCP-MMV-3.11.9-6.7.2 perl-PCP-MMV-debuginfo-3.11.9-6.7.2 perl-PCP-PMDA-3.11.9-6.7.2 perl-PCP-PMDA-debuginfo-3.11.9-6.7.2 python-pcp-3.11.9-6.7.2 python-pcp-debuginfo-3.11.9-6.7.2 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le x86_64): pcp-pmda-infiniband-3.11.9-6.7.2 pcp-pmda-infiniband-debuginfo-3.11.9-6.7.2 pcp-pmda-papi-3.11.9-6.7.2 pcp-pmda-papi-debuginfo-3.11.9-6.7.2 pcp-pmda-perfevent-3.11.9-6.7.2 pcp-pmda-perfevent-debuginfo-3.11.9-6.7.2 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): pcp-doc-3.11.9-6.7.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libpcp-devel-3.11.9-6.7.2 libpcp3-3.11.9-6.7.2 libpcp3-debuginfo-3.11.9-6.7.2 libpcp_gui2-3.11.9-6.7.2 libpcp_gui2-debuginfo-3.11.9-6.7.2 libpcp_import1-3.11.9-6.7.2 libpcp_import1-debuginfo-3.11.9-6.7.2 libpcp_mmv1-3.11.9-6.7.2 libpcp_mmv1-debuginfo-3.11.9-6.7.2 libpcp_trace2-3.11.9-6.7.2 libpcp_trace2-debuginfo-3.11.9-6.7.2 libpcp_web1-3.11.9-6.7.2 libpcp_web1-debuginfo-3.11.9-6.7.2 pcp-3.11.9-6.7.2 pcp-conf-3.11.9-6.7.2 pcp-debuginfo-3.11.9-6.7.2 pcp-debugsource-3.11.9-6.7.2 pcp-devel-3.11.9-6.7.2 pcp-devel-debuginfo-3.11.9-6.7.2 pcp-export-pcp2graphite-3.11.9-6.7.2 pcp-export-pcp2influxdb-3.11.9-6.7.2 pcp-export-zabbix-agent-3.11.9-6.7.2 pcp-export-zabbix-agent-debuginfo-3.11.9-6.7.2 pcp-gui-3.11.9-6.7.2 pcp-gui-debuginfo-3.11.9-6.7.2 pcp-import-collectl2pcp-3.11.9-6.7.2 pcp-import-collectl2pcp-debuginfo-3.11.9-6.7.2 pcp-import-ganglia2pcp-3.11.9-6.7.2 pcp-import-iostat2pcp-3.11.9-6.7.2 pcp-import-mrtg2pcp-3.11.9-6.7.2 pcp-import-sar2pcp-3.11.9-6.7.2 pcp-manager-3.11.9-6.7.2 pcp-manager-debuginfo-3.11.9-6.7.2 pcp-pmda-activemq-3.11.9-6.7.2 pcp-pmda-apache-3.11.9-6.7.2 pcp-pmda-apache-debuginfo-3.11.9-6.7.2 pcp-pmda-bash-3.11.9-6.7.2 pcp-pmda-bash-debuginfo-3.11.9-6.7.2 pcp-pmda-bind2-3.11.9-6.7.2 pcp-pmda-bonding-3.11.9-6.7.2 pcp-pmda-cifs-3.11.9-6.7.2 pcp-pmda-cifs-debuginfo-3.11.9-6.7.2 pcp-pmda-cisco-3.11.9-6.7.2 pcp-pmda-cisco-debuginfo-3.11.9-6.7.2 pcp-pmda-dbping-3.11.9-6.7.2 pcp-pmda-dm-3.11.9-6.7.2 pcp-pmda-dm-debuginfo-3.11.9-6.7.2 pcp-pmda-docker-3.11.9-6.7.2 pcp-pmda-docker-debuginfo-3.11.9-6.7.2 pcp-pmda-ds389-3.11.9-6.7.2 pcp-pmda-ds389log-3.11.9-6.7.2 pcp-pmda-elasticsearch-3.11.9-6.7.2 pcp-pmda-gfs2-3.11.9-6.7.2 pcp-pmda-gfs2-debuginfo-3.11.9-6.7.2 pcp-pmda-gluster-3.11.9-6.7.2 pcp-pmda-gpfs-3.11.9-6.7.2 pcp-pmda-gpsd-3.11.9-6.7.2 pcp-pmda-kvm-3.11.9-6.7.2 pcp-pmda-libvirt-3.11.9-6.7.2 pcp-pmda-lio-3.11.9-6.7.2 pcp-pmda-lmsensors-3.11.9-6.7.2 pcp-pmda-lmsensors-debuginfo-3.11.9-6.7.2 pcp-pmda-logger-3.11.9-6.7.2 pcp-pmda-logger-debuginfo-3.11.9-6.7.2 pcp-pmda-lustre-3.11.9-6.7.2 pcp-pmda-lustrecomm-3.11.9-6.7.2 pcp-pmda-lustrecomm-debuginfo-3.11.9-6.7.2 pcp-pmda-mailq-3.11.9-6.7.2 pcp-pmda-mailq-debuginfo-3.11.9-6.7.2 pcp-pmda-memcache-3.11.9-6.7.2 pcp-pmda-mic-3.11.9-6.7.2 pcp-pmda-mounts-3.11.9-6.7.2 pcp-pmda-mounts-debuginfo-3.11.9-6.7.2 pcp-pmda-mysql-3.11.9-6.7.2 pcp-pmda-named-3.11.9-6.7.2 pcp-pmda-netfilter-3.11.9-6.7.2 pcp-pmda-news-3.11.9-6.7.2 pcp-pmda-nfsclient-3.11.9-6.7.2 pcp-pmda-nginx-3.11.9-6.7.2 pcp-pmda-nutcracker-3.11.9-6.7.2 pcp-pmda-nvidia-gpu-3.11.9-6.7.2 pcp-pmda-nvidia-gpu-debuginfo-3.11.9-6.7.2 pcp-pmda-oracle-3.11.9-6.7.2 pcp-pmda-pdns-3.11.9-6.7.2 pcp-pmda-postfix-3.11.9-6.7.2 pcp-pmda-redis-3.11.9-6.7.2 pcp-pmda-roomtemp-3.11.9-6.7.2 pcp-pmda-roomtemp-debuginfo-3.11.9-6.7.2 pcp-pmda-rpm-3.11.9-6.7.2 pcp-pmda-rpm-debuginfo-3.11.9-6.7.2 pcp-pmda-rsyslog-3.11.9-6.7.2 pcp-pmda-samba-3.11.9-6.7.2 pcp-pmda-sendmail-3.11.9-6.7.2 pcp-pmda-sendmail-debuginfo-3.11.9-6.7.2 pcp-pmda-shping-3.11.9-6.7.2 pcp-pmda-shping-debuginfo-3.11.9-6.7.2 pcp-pmda-slurm-3.11.9-6.7.2 pcp-pmda-snmp-3.11.9-6.7.2 pcp-pmda-summary-3.11.9-6.7.2 pcp-pmda-summary-debuginfo-3.11.9-6.7.2 pcp-pmda-systemd-3.11.9-6.7.2 pcp-pmda-systemd-debuginfo-3.11.9-6.7.2 pcp-pmda-trace-3.11.9-6.7.2 pcp-pmda-trace-debuginfo-3.11.9-6.7.2 pcp-pmda-unbound-3.11.9-6.7.2 pcp-pmda-vmware-3.11.9-6.7.2 pcp-pmda-weblog-3.11.9-6.7.2 pcp-pmda-weblog-debuginfo-3.11.9-6.7.2 pcp-pmda-zimbra-3.11.9-6.7.2 pcp-pmda-zswap-3.11.9-6.7.2 pcp-system-tools-3.11.9-6.7.2 pcp-webapi-3.11.9-6.7.2 pcp-webapi-debuginfo-3.11.9-6.7.2 perl-PCP-LogImport-3.11.9-6.7.2 perl-PCP-LogImport-debuginfo-3.11.9-6.7.2 perl-PCP-LogSummary-3.11.9-6.7.2 perl-PCP-MMV-3.11.9-6.7.2 perl-PCP-MMV-debuginfo-3.11.9-6.7.2 perl-PCP-PMDA-3.11.9-6.7.2 perl-PCP-PMDA-debuginfo-3.11.9-6.7.2 python-pcp-3.11.9-6.7.2 python-pcp-debuginfo-3.11.9-6.7.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le x86_64): pcp-pmda-infiniband-3.11.9-6.7.2 pcp-pmda-infiniband-debuginfo-3.11.9-6.7.2 pcp-pmda-papi-3.11.9-6.7.2 pcp-pmda-papi-debuginfo-3.11.9-6.7.2 pcp-pmda-perfevent-3.11.9-6.7.2 pcp-pmda-perfevent-debuginfo-3.11.9-6.7.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): pcp-doc-3.11.9-6.7.2 References: https://bugzilla.suse.com/1055503 https://bugzilla.suse.com/1056397 https://bugzilla.suse.com/841204 From sle-updates at lists.suse.com Wed Dec 13 16:10:04 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 00:10:04 +0100 (CET) Subject: SUSE-RU-2017:3283-1: Recommended update for util-linux Message-ID: <20171213231004.5B3AEFCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for util-linux ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3283-1 Rating: low References: #1039276 #1040968 #1052190 #1055446 #1066500 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for util-linux fixes the following issues: - Allow unmounting of filesystems without calling stat() on the mount point, when "-c" is used. (bsc#1040968) - Fix an infinite loop, a crash and report the correct minimum and maximum frequencies in lscpu for some processors. (bsc#1055446) - Fix a lscpu failure on Sydney Amazon EC2 region. (bsc#1066500) - Add length check in probe_nilfs2 before calling crc32 to fix some crashes when running mount/fsck blkid. (bsc#1052190) - If multiple subvolumes are mounted, report the default subvolume. (bsc#1039276) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-2041=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2041=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2041=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2041=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2041=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2041=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): libuuid-devel-2.28-44.14.2 util-linux-debuginfo-2.28-44.14.2 util-linux-debugsource-2.28-44.14.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libblkid-devel-2.28-44.14.2 libmount-devel-2.28-44.14.2 libsmartcols-devel-2.28-44.14.2 libuuid-devel-2.28-44.14.2 util-linux-debuginfo-2.28-44.14.2 util-linux-debugsource-2.28-44.14.2 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libblkid1-2.28-44.14.2 libblkid1-debuginfo-2.28-44.14.2 libfdisk1-2.28-44.14.2 libfdisk1-debuginfo-2.28-44.14.2 libmount1-2.28-44.14.2 libmount1-debuginfo-2.28-44.14.2 libsmartcols1-2.28-44.14.2 libsmartcols1-debuginfo-2.28-44.14.2 libuuid1-2.28-44.14.2 libuuid1-debuginfo-2.28-44.14.2 python-libmount-2.28-44.14.6 python-libmount-debuginfo-2.28-44.14.6 python-libmount-debugsource-2.28-44.14.6 util-linux-2.28-44.14.2 util-linux-debuginfo-2.28-44.14.2 util-linux-debugsource-2.28-44.14.2 util-linux-systemd-2.28-44.14.7 util-linux-systemd-debuginfo-2.28-44.14.7 util-linux-systemd-debugsource-2.28-44.14.7 uuidd-2.28-44.14.7 uuidd-debuginfo-2.28-44.14.7 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): util-linux-lang-2.28-44.14.2 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libblkid1-2.28-44.14.2 libblkid1-debuginfo-2.28-44.14.2 libfdisk1-2.28-44.14.2 libfdisk1-debuginfo-2.28-44.14.2 libmount1-2.28-44.14.2 libmount1-debuginfo-2.28-44.14.2 libsmartcols1-2.28-44.14.2 libsmartcols1-debuginfo-2.28-44.14.2 libuuid1-2.28-44.14.2 libuuid1-debuginfo-2.28-44.14.2 python-libmount-2.28-44.14.6 python-libmount-debuginfo-2.28-44.14.6 python-libmount-debugsource-2.28-44.14.6 util-linux-2.28-44.14.2 util-linux-debuginfo-2.28-44.14.2 util-linux-debugsource-2.28-44.14.2 util-linux-systemd-2.28-44.14.7 util-linux-systemd-debuginfo-2.28-44.14.7 util-linux-systemd-debugsource-2.28-44.14.7 uuidd-2.28-44.14.7 uuidd-debuginfo-2.28-44.14.7 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libblkid1-32bit-2.28-44.14.2 libblkid1-debuginfo-32bit-2.28-44.14.2 libmount1-32bit-2.28-44.14.2 libmount1-debuginfo-32bit-2.28-44.14.2 libuuid1-32bit-2.28-44.14.2 libuuid1-debuginfo-32bit-2.28-44.14.2 - SUSE Linux Enterprise Server 12-SP2 (noarch): util-linux-lang-2.28-44.14.2 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): util-linux-lang-2.28-44.14.2 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libblkid1-2.28-44.14.2 libblkid1-32bit-2.28-44.14.2 libblkid1-debuginfo-2.28-44.14.2 libblkid1-debuginfo-32bit-2.28-44.14.2 libfdisk1-2.28-44.14.2 libfdisk1-debuginfo-2.28-44.14.2 libmount1-2.28-44.14.2 libmount1-32bit-2.28-44.14.2 libmount1-debuginfo-2.28-44.14.2 libmount1-debuginfo-32bit-2.28-44.14.2 libsmartcols1-2.28-44.14.2 libsmartcols1-debuginfo-2.28-44.14.2 libuuid-devel-2.28-44.14.2 libuuid1-2.28-44.14.2 libuuid1-32bit-2.28-44.14.2 libuuid1-debuginfo-2.28-44.14.2 libuuid1-debuginfo-32bit-2.28-44.14.2 python-libmount-2.28-44.14.6 python-libmount-debuginfo-2.28-44.14.6 python-libmount-debugsource-2.28-44.14.6 util-linux-2.28-44.14.2 util-linux-debuginfo-2.28-44.14.2 util-linux-debugsource-2.28-44.14.2 util-linux-systemd-2.28-44.14.7 util-linux-systemd-debuginfo-2.28-44.14.7 util-linux-systemd-debugsource-2.28-44.14.7 uuidd-2.28-44.14.7 uuidd-debuginfo-2.28-44.14.7 - OpenStack Cloud Magnum Orchestration 7 (x86_64): libblkid1-2.28-44.14.2 libblkid1-debuginfo-2.28-44.14.2 libfdisk1-2.28-44.14.2 libfdisk1-debuginfo-2.28-44.14.2 libmount1-2.28-44.14.2 libmount1-debuginfo-2.28-44.14.2 libsmartcols1-2.28-44.14.2 libsmartcols1-debuginfo-2.28-44.14.2 libuuid1-2.28-44.14.2 libuuid1-debuginfo-2.28-44.14.2 util-linux-2.28-44.14.2 util-linux-debuginfo-2.28-44.14.2 util-linux-debugsource-2.28-44.14.2 util-linux-systemd-2.28-44.14.7 util-linux-systemd-debuginfo-2.28-44.14.7 util-linux-systemd-debugsource-2.28-44.14.7 References: https://bugzilla.suse.com/1039276 https://bugzilla.suse.com/1040968 https://bugzilla.suse.com/1052190 https://bugzilla.suse.com/1055446 https://bugzilla.suse.com/1066500 From sle-updates at lists.suse.com Thu Dec 14 07:08:27 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:08:27 +0100 (CET) Subject: SUSE-SU-2017:3284-1: important: Security update for the Linux Kernel (Live Patch 11 for SLE 12 SP2) Message-ID: <20171214140827.50016FCD7@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 11 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3284-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.74-92_32 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2055=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_74-92_32-default-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 07:09:20 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:09:20 +0100 (CET) Subject: SUSE-SU-2017:3285-1: important: Security update for the Linux Kernel (Live Patch 14 for SLE 12 SP2) Message-ID: <20171214140920.55867FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 14 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3285-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.90-92_45 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2056=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_90-92_45-default-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 07:10:05 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:10:05 +0100 (CET) Subject: SUSE-SU-2017:3286-1: important: Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP2) Message-ID: <20171214141005.0FA8EFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 8 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3286-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.59-92_20 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2047=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_59-92_20-default-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 07:11:04 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:11:04 +0100 (CET) Subject: SUSE-SU-2017:3287-1: important: Security update for the Linux Kernel (Live Patch 20 for SLE 12) Message-ID: <20171214141104.294EFFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 20 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3287-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_69 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2063=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_69-default-8-2.1 kgraft-patch-3_12_61-52_69-xen-8-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:11:39 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:11:39 +0100 (CET) Subject: SUSE-SU-2017:3288-1: important: Security update for the Linux Kernel (Live Patch 4 for SLE 12 SP2) Message-ID: <20171214141139.652F9FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 4 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3288-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.38-93 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2050=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_38-93-default-11-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:12:30 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:12:30 +0100 (CET) Subject: SUSE-SU-2017:3289-1: important: Security update for the Linux Kernel (Live Patch 17 for SLE 12) Message-ID: <20171214141230.1C1B5FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 17 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3289-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.60-52_60 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2060=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_60-default-11-2.1 kgraft-patch-3_12_60-52_60-xen-11-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:13:05 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:13:05 +0100 (CET) Subject: SUSE-SU-2017:3290-1: important: Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP2) Message-ID: <20171214141305.BE883FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 5 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3290-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.49-92_11 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2057=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_49-92_11-default-9-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:13:52 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:13:52 +0100 (CET) Subject: SUSE-SU-2017:3291-1: important: Security update for the Linux Kernel (Live Patch 6 for SLE 12 SP2) Message-ID: <20171214141352.292E3FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 6 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3291-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.49-92_14 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2052=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_49-92_14-default-8-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:14:39 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:14:39 +0100 (CET) Subject: SUSE-SU-2017:3292-1: important: Security update for the Linux Kernel (Live Patch 2 for SLE 12 SP2) Message-ID: <20171214141439.CD533FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 2 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3292-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.21-84 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2049=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_21-84-default-11-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:15:33 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:15:33 +0100 (CET) Subject: SUSE-SU-2017:3293-1: important: Security update for the Linux Kernel (Live Patch 24 for SLE 12) Message-ID: <20171214141533.84A1AFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 24 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3293-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_83 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2067=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_83-default-5-2.1 kgraft-patch-3_12_61-52_83-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:16:11 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:16:11 +0100 (CET) Subject: SUSE-RU-2017:3294-1: important: Recommended update for the Linux Kernel (Live Patch 15 for SLE 12 SP2) Message-ID: <20171214141611.CB903FCD2@maintenance.suse.de> SUSE Recommended Update: Recommended update for the Linux Kernel (Live Patch 15 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3294-1 Rating: important References: #1055567 #1062847 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for the Linux Kernel 4.4.90-92_50 fixes several issues. The following bugs were fixed: - Fixed "Server does not shut down correctly if NIC teaming is enabled") (bsc#1062847) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2045=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_90-92_50-default-2-2.1 References: https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 From sle-updates at lists.suse.com Thu Dec 14 07:16:45 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:16:45 +0100 (CET) Subject: SUSE-SU-2017:3295-1: important: Security update for the Linux Kernel (Live Patch 12 for SLE 12 SP2) Message-ID: <20171214141645.67521FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 12 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3295-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.74-92_35 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2053=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_74-92_35-default-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 07:17:39 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:17:39 +0100 (CET) Subject: SUSE-SU-2017:3296-1: important: Security update for the Linux Kernel (Live Patch 9 for SLE 12 SP2) Message-ID: <20171214141739.5D98EFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 9 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3296-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.59-92_24 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2046=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_59-92_24-default-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 07:18:39 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:18:39 +0100 (CET) Subject: SUSE-SU-2017:3297-1: important: Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP2) Message-ID: <20171214141839.2C9D9FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3297-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.74-92_38 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2054=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_74-92_38-default-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 07:19:34 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:19:34 +0100 (CET) Subject: SUSE-RU-2017:3298-1: Recommended update for psmisc Message-ID: <20171214141934.1C1B6FCD2@maintenance.suse.de> SUSE Recommended Update: Recommended update for psmisc ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3298-1 Rating: low References: #908068 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for psmisc provides the following fixes: - Use mountinfo to distinguish different mounts with same device number as it happens with NFS shares. (bsc#908068) - Smaller cleanup as support of chroot environments and older systems. - Add support for name_to_handle_at() system call to get the real mount ID for each file. - Run even on older kernels missing mnt_id tag in fdinfo. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-2044=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2044=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2044=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2044=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2044=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2044=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2044=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2044=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2044=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2044=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE OpenStack Cloud 6 (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): psmisc-lang-22.21-6.3.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): psmisc-lang-22.21-6.3.1 - SUSE Container as a Service Platform ALL (x86_64): psmisc-22.21-6.3.1 psmisc-debuginfo-22.21-6.3.1 psmisc-debugsource-22.21-6.3.1 References: https://bugzilla.suse.com/908068 From sle-updates at lists.suse.com Thu Dec 14 07:20:18 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:20:18 +0100 (CET) Subject: SUSE-SU-2017:3299-1: important: Security update for the Linux Kernel (Live Patch 22 for SLE 12) Message-ID: <20171214142018.5354DFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 22 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3299-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_77 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2065=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_77-default-7-2.1 kgraft-patch-3_12_61-52_77-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:20:53 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:20:53 +0100 (CET) Subject: SUSE-SU-2017:3300-1: important: Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP2) Message-ID: <20171214142053.EB771FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3300-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.74-92_29 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2069=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_74-92_29-default-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 07:21:39 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:21:39 +0100 (CET) Subject: SUSE-SU-2017:3301-1: important: Security update for the Linux Kernel (Live Patch 25 for SLE 12) Message-ID: <20171214142139.05908FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 25 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3301-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_86 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2066=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_86-default-5-2.1 kgraft-patch-3_12_61-52_86-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:22:07 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:22:07 +0100 (CET) Subject: SUSE-SU-2017:3302-1: important: Security update for the Linux Kernel (Live Patch 21 for SLE 12) Message-ID: <20171214142207.18CEEFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 21 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3302-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_72 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2062=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_72-default-7-2.1 kgraft-patch-3_12_61-52_72-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:22:34 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:22:34 +0100 (CET) Subject: SUSE-SU-2017:3303-1: important: Security update for the Linux Kernel (Live Patch 26 for SLE 12) Message-ID: <20171214142234.A762CFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 26 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3303-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_89 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2070=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_89-default-5-2.1 kgraft-patch-3_12_61-52_89-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:23:05 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:23:05 +0100 (CET) Subject: SUSE-SU-2017:3304-1: important: Security update for the Linux Kernel (Live Patch 18 for SLE 12) Message-ID: <20171214142305.A80D3FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 18 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3304-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.60-52_63 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2058=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_63-default-11-2.1 kgraft-patch-3_12_60-52_63-xen-11-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:23:34 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:23:34 +0100 (CET) Subject: SUSE-SU-2017:3305-1: important: Security update for the Linux Kernel (Live Patch 27 for SLE 12) Message-ID: <20171214142334.ACC66FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 27 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3305-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_92 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2068=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_92-default-4-2.1 kgraft-patch-3_12_61-52_92-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:24:06 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:24:06 +0100 (CET) Subject: SUSE-SU-2017:3306-1: important: Security update for the Linux Kernel (Live Patch 3 for SLE 12 SP2) Message-ID: <20171214142406.79E6AFCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 3 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3306-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.21-90 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2048=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_21-90-default-11-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:24:53 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:24:53 +0100 (CET) Subject: SUSE-SU-2017:3307-1: important: Security update for the Linux Kernel (Live Patch 28 for SLE 12) Message-ID: <20171214142453.0A177FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 28 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3307-1 Rating: important References: #1064388 #1064392 #1069708 Cross-References: CVE-2017-15649 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for the Linux Kernel 3.12.61-52_101 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-15649: net/packet/af_packet.c allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free (bsc#1064392). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2061=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_101-default-2-2.1 kgraft-patch-3_12_61-52_101-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-15649.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1064388 https://bugzilla.suse.com/1064392 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:25:37 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:25:37 +0100 (CET) Subject: SUSE-SU-2017:3308-1: important: Security update for the Linux Kernel (Live Patch 19 for SLE 12) Message-ID: <20171214142537.4B180FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 19 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3308-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_66 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2059=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_66-default-10-2.1 kgraft-patch-3_12_61-52_66-xen-10-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:26:13 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:26:13 +0100 (CET) Subject: SUSE-SU-2017:3309-1: important: Security update for the Linux Kernel (Live Patch 23 for SLE 12) Message-ID: <20171214142613.066F2FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 23 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3309-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.61-52_80 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2064=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_80-default-6-2.1 kgraft-patch-3_12_61-52_80-xen-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 07:26:47 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 15:26:47 +0100 (CET) Subject: SUSE-SU-2017:3310-1: important: Security update for the Linux Kernel (Live Patch 7 for SLE 12 SP2) Message-ID: <20171214142647.690B3FCD2@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 7 for SLE 12 SP2) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3310-1 Rating: important References: #1053153 #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.59-92_17 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2051=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_59-92_17-default-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 13:08:51 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:08:51 +0100 (CET) Subject: SUSE-SU-2017:3311-1: moderate: Security update for slurm Message-ID: <20171214200851.AA491FC9D@maintenance.suse.de> SUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3311-1 Rating: moderate References: #1007053 #1031872 #1041706 #1065697 #1067580 Cross-References: CVE-2017-15566 Affected Products: SUSE Linux Enterprise Module for HPC 12 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update for slurm fixes the following issues: Slurm was updated to 17.02.9 to fix a security bug, bringing new features and bugfixes (fate#323998 bsc#1067580). Security issue fixed: * CVE-2017-15566: Fix security issue in Prolog and Epilog by always prepending SPANK_ to all user-set environment variables. (bsc#1065697) Changes in 17.02.9: * When resuming powered down nodes, mark DOWN nodes right after ResumeTimeout has been reached (previous logic would wait about one minute longer). * Fix sreport not showing full column name for TRES Count. * Fix slurmdb_reservations_get() giving wrong usage data when job's spanned reservation that was modified. * Fix sreport reservation utilization report showing bad data. * Show all TRES' on a reservation in sreport reservation utilization report by default. * Fix sacctmgr show reservation handling "end" parameter. * Work around issue with sysmacros.h and gcc7 / glibc 2.25. * Fix layouts code to only allow setting a boolean. * Fix sbatch --wait to keep waiting even if a message timeout occurs. * CRAY - If configured with NodeFeatures=knl_cray and there are non-KNL nodes which include no features the slurmctld will abort without this patch when attemping strtok_r(NULL). * Fix regression in 17.02.7 which would run the spank_task_privileged as part of the slurmstepd instead of it's child process. Changes in 17.02.8: * Add 'slurmdbd:' to the accounting plugin to notify message is from dbd instead of local. * mpi/mvapich - Buffer being only partially cleared. No failures observed. * Fix for job --switch option on dragonfly network. * In salloc with --uid option, drop supplementary groups before changing UID. * jobcomp/elasticsearch - strip any trailing slashes from JobCompLoc. * jobcomp/elasticsearch - fix memory leak when transferring generated buffer. * Prevent slurmstepd ABRT when parsing gres.conf CPUs. * Fix sbatch --signal to signal all MPI ranks in a step instead of just those on node 0. * Check multiple partition limits when scheduling a job that were previously only checked on submit. * Cray: Avoid running application/step Node Health Check on the external job step. * Optimization enhancements for partition based job preemption. * Address some build warnings from GCC 7.1, and one possible memory leak if /proc is inaccessible. * If creating/altering a core based reservation with scontrol/sview on a remote cluster correctly determine the select type. * Fix autoconf test for libcurl when clang is used. * Fix default location for cgroup_allowed_devices_file.conf to use correct default path. * Document NewName option to sacctmgr. * Reject a second PMI2_Init call within a single step to prevent slurmstepd from hanging. * Handle old 32bit values stored in the database for requested memory correctly in sacct. * Fix memory leaks in the task/cgroup plugin when constraining devices. * Make extremely verbose info messages debug2 messages in the task/cgroup plugin when constraining devices. * Fix issue that would deny the stepd access to /dev/null where GRES has a 'type' but no file defined. * Fix issue where the slurmstepd would fatal on job launch if you have no gres listed in your slurm.conf but some in gres.conf. * Fix validating time spec to correctly validate various time formats. * Make scontrol work correctly with job update timelimit [+|-]=. * Reduce the visibily of a number of warnings in _part_access_check. * Prevent segfault in sacctmgr if no association name is specified for an update command. * burst_buffer/cray plugin modified to work with changes in Cray UP05 software release. * Fix job reasons for jobs that are violating assoc MaxTRESPerNode limits. * Fix segfault when unpacking a 16.05 slurm_cred in a 17.02 daemon. * Fix setting TRES limits with case insensitive TRES names. * Add alias for xstrncmp() -- slurm_xstrncmp(). * Fix sorting of case insensitive strings when using xstrcasecmp(). * Gracefully handle race condition when reading /proc as process exits. * Avoid error on Cray duplicate setup of core specialization. * Skip over undefined (hidden in Slurm) nodes in pbsnodes. * Add empty hashes in perl api's slurm_load_node() for hidden nodes. * CRAY - Add rpath logic to work for the alpscomm libs. * Fixes for administrator extended TimeLimit (job reason & time limit reset). * Fix gres selection on systems running select/linear. * sview: Added window decorator for maximize,minimize,close buttons for all systems. * squeue: interpret negative length format specifiers as a request to delimit values with spaces. * Fix the torque pbsnodes wrapper script to parse a gres field with a type set correctly. This update also contains pdsh rebuilt against the new libslurm version. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for HPC 12: zypper in -t patch SUSE-SLE-Module-HPC-12-2017-2072=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for HPC 12 (aarch64 x86_64): libpmi0-17.02.9-6.10.1 libpmi0-debuginfo-17.02.9-6.10.1 libslurm29-16.05.8.1-6.1 libslurm29-debuginfo-16.05.8.1-6.1 libslurm31-17.02.9-6.10.1 libslurm31-debuginfo-17.02.9-6.10.1 pdsh-2.33-7.5.17 pdsh-debuginfo-2.33-7.5.17 pdsh-debugsource-2.33-7.5.17 perl-slurm-17.02.9-6.10.1 perl-slurm-debuginfo-17.02.9-6.10.1 slurm-17.02.9-6.10.1 slurm-auth-none-17.02.9-6.10.1 slurm-auth-none-debuginfo-17.02.9-6.10.1 slurm-debuginfo-17.02.9-6.10.1 slurm-debugsource-17.02.9-6.10.1 slurm-devel-17.02.9-6.10.1 slurm-doc-17.02.9-6.10.1 slurm-lua-17.02.9-6.10.1 slurm-lua-debuginfo-17.02.9-6.10.1 slurm-munge-17.02.9-6.10.1 slurm-munge-debuginfo-17.02.9-6.10.1 slurm-pam_slurm-17.02.9-6.10.1 slurm-pam_slurm-debuginfo-17.02.9-6.10.1 slurm-plugins-17.02.9-6.10.1 slurm-plugins-debuginfo-17.02.9-6.10.1 slurm-sched-wiki-17.02.9-6.10.1 slurm-slurmdb-direct-17.02.9-6.10.1 slurm-slurmdbd-17.02.9-6.10.1 slurm-slurmdbd-debuginfo-17.02.9-6.10.1 slurm-sql-17.02.9-6.10.1 slurm-sql-debuginfo-17.02.9-6.10.1 slurm-torque-17.02.9-6.10.1 slurm-torque-debuginfo-17.02.9-6.10.1 References: https://www.suse.com/security/cve/CVE-2017-15566.html https://bugzilla.suse.com/1007053 https://bugzilla.suse.com/1031872 https://bugzilla.suse.com/1041706 https://bugzilla.suse.com/1065697 https://bugzilla.suse.com/1067580 From sle-updates at lists.suse.com Thu Dec 14 13:09:46 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:09:46 +0100 (CET) Subject: SUSE-SU-2017:3312-1: important: Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP1) Message-ID: <20171214200946.551B5FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 16 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3312-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_45 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2083=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2083=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_45-default-7-2.1 kgraft-patch-3_12_74-60_64_45-xen-7-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_45-default-7-2.1 kgraft-patch-3_12_74-60_64_45-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:10:19 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:10:19 +0100 (CET) Subject: SUSE-SU-2017:3313-1: important: Security update for the Linux Kernel (Live Patch 18 for SLE 12 SP1) Message-ID: <20171214201019.A7184FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 18 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3313-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2078=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2078=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_51-default-5-2.1 kgraft-patch-3_12_74-60_64_51-xen-5-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_51-default-5-2.1 kgraft-patch-3_12_74-60_64_51-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:10:50 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:10:50 +0100 (CET) Subject: SUSE-SU-2017:3314-1: important: Security update for the Linux Kernel (Live Patch 3 for SLE 12 SP3) Message-ID: <20171214201050.E983DFCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 3 for SLE 12 SP3) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3314-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12-SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.82-6_9 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2017-2075=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12-SP3 (x86_64): kgraft-patch-4_4_82-6_9-default-3-2.1 kgraft-patch-4_4_82-6_9-default-debuginfo-3-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 13:11:46 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:11:46 +0100 (CET) Subject: SUSE-SU-2017:3315-1: important: Security update for the Linux Kernel (Live Patch 29 for SLE 12) Message-ID: <20171214201146.9DCBEFCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 29 for SLE 12) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3315-1 Rating: important References: #1064388 #1064392 Cross-References: CVE-2017-15649 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for the Linux Kernel 3.12.61-52_106 fixes several issues. The following security issue was fixed: - CVE-2017-15649: net/packet/af_packet.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346 (bsc#1064388) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2071=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_61-52_106-default-2-2.1 kgraft-patch-3_12_61-52_106-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-15649.html https://bugzilla.suse.com/1064388 https://bugzilla.suse.com/1064392 From sle-updates at lists.suse.com Thu Dec 14 13:12:22 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:12:22 +0100 (CET) Subject: SUSE-SU-2017:3316-1: important: Security update for the Linux Kernel (Live Patch 12 for SLE 12 SP1) Message-ID: <20171214201222.6A23DFCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 12 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3316-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.69-60_64_29 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2080=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2080=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_69-60_64_29-default-10-2.1 kgraft-patch-3_12_69-60_64_29-xen-10-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_69-60_64_29-default-10-2.1 kgraft-patch-3_12_69-60_64_29-xen-10-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:12:53 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:12:53 +0100 (CET) Subject: SUSE-SU-2017:3317-1: important: Security update for the Linux Kernel (Live Patch 4 for SLE 12 SP3) Message-ID: <20171214201253.53AACFCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 4 for SLE 12 SP3) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3317-1 Rating: important References: #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 4.4.90-6_12 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2017-2073=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12-SP3 (x86_64): kgraft-patch-4_4_92-6_18-default-2-2.1 kgraft-patch-4_4_92-6_18-default-debuginfo-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 13:13:23 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:13:23 +0100 (CET) Subject: SUSE-SU-2017:3318-1: important: Security update for the Linux Kernel (Live Patch 20 for SLE 12 SP1) Message-ID: <20171214201323.D5186FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 20 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3318-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2084=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2084=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_57-default-5-2.1 kgraft-patch-3_12_74-60_64_57-xen-5-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_57-default-5-2.1 kgraft-patch-3_12_74-60_64_57-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:13:55 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:13:55 +0100 (CET) Subject: SUSE-SU-2017:3319-1: important: Security update for the Linux Kernel (Live Patch 1 for SLE 12 SP3) Message-ID: <20171214201355.D6297FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 1 for SLE 12 SP3) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3319-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12-SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.82-6_3 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2017-2076=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12-SP3 (x86_64): kgraft-patch-4_4_82-6_3-default-4-2.1 kgraft-patch-4_4_82-6_3-default-debuginfo-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Thu Dec 14 13:14:41 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:14:41 +0100 (CET) Subject: SUSE-SU-2017:3320-1: important: Security update for the Linux Kernel (Live Patch 19 for SLE 12 SP1) Message-ID: <20171214201441.AAC60FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 19 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3320-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_54 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2077=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2077=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_54-default-5-2.1 kgraft-patch-3_12_74-60_64_54-xen-5-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_54-default-5-2.1 kgraft-patch-3_12_74-60_64_54-xen-5-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:15:16 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:15:16 +0100 (CET) Subject: SUSE-SU-2017:3321-1: important: Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP1) Message-ID: <20171214201516.9479CFCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3321-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.67-60_64_21 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2079=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2079=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_67-60_64_21-default-12-2.1 kgraft-patch-3_12_67-60_64_21-xen-12-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_67-60_64_21-default-12-2.1 kgraft-patch-3_12_67-60_64_21-xen-12-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:15:48 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:15:48 +0100 (CET) Subject: SUSE-SU-2017:3322-1: important: Security update for the Linux Kernel (Live Patch 21 for SLE 12 SP1) Message-ID: <20171214201548.A82C5FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 21 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3322-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_60 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2081=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2081=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_60-default-4-2.1 kgraft-patch-3_12_74-60_64_60-xen-4-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_60-default-4-2.1 kgraft-patch-3_12_74-60_64_60-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:16:19 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:16:19 +0100 (CET) Subject: SUSE-SU-2017:3323-1: important: Security update for the Linux Kernel (Live Patch 11 for SLE 12 SP1) Message-ID: <20171214201619.C038CFCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 11 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3323-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.67-60_64_24 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2085=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2085=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_67-60_64_24-default-11-2.1 kgraft-patch-3_12_67-60_64_24-xen-11-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_67-60_64_24-default-11-2.1 kgraft-patch-3_12_67-60_64_24-xen-11-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Thu Dec 14 13:16:53 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 14 Dec 2017 21:16:53 +0100 (CET) Subject: SUSE-SU-2017:3324-1: important: Security update for the Linux Kernel (Live Patch 2 for SLE 12 SP3) Message-ID: <20171214201653.C75D1FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 2 for SLE 12 SP3) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3324-1 Rating: important References: #1055567 #1062847 #1069708 #1070307 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Live Patching 12-SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for the Linux Kernel 4.4.82-6_6 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmd_mkdirty() in the touch_pmd() function allowed users to overwrite read-only huge pages (e.g. the zero huge page and sealed shmem files) (bsc#1070307). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). This non-security issue was fixed: - bsc#1062847: Enable proper shut down if NIC teaming is enabled Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2017-2074=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12-SP3 (x86_64): kgraft-patch-4_4_82-6_6-default-3-2.1 kgraft-patch-4_4_82-6_6-default-debuginfo-3-2.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1055567 https://bugzilla.suse.com/1062847 https://bugzilla.suse.com/1069708 https://bugzilla.suse.com/1070307 From sle-updates at lists.suse.com Fri Dec 15 04:09:05 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 15 Dec 2017 12:09:05 +0100 (CET) Subject: SUSE-SU-2017:3332-1: important: Security update for the Linux Kernel (Live Patch 14 for SLE 12 SP1) Message-ID: <20171215110905.C8955FC9D@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 14 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3332-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.69-60_64_35 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2086=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2086=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_69-60_64_35-default-8-2.1 kgraft-patch-3_12_69-60_64_35-xen-8-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_69-60_64_35-default-8-2.1 kgraft-patch-3_12_69-60_64_35-xen-8-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Fri Dec 15 10:09:50 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 15 Dec 2017 18:09:50 +0100 (CET) Subject: SUSE-RU-2017:3333-1: Recommended update for hwinfo Message-ID: <20171215170950.5A5D7FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for hwinfo ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3333-1 Rating: low References: #1041090 #1047218 #1051076 #1062562 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for hwinfo fixes the following issues: - Support SMBIOS 3.0 spec (bsc#1062562) - Ensure /var/lib/hardware/udi exists and with 755 permissions - Sort input files (bsc#1041090) - Allow to override current time (bsc#1047218) - Really set default timeout to 20s for Video BIOS emulation calls Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2088=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2088=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2088=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): hwinfo-debuginfo-21.50-2.3.5 hwinfo-debugsource-21.50-2.3.5 hwinfo-devel-21.50-2.3.5 hwinfo-devel-debuginfo-21.50-2.3.5 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): hwinfo-21.50-2.3.5 hwinfo-debuginfo-21.50-2.3.5 hwinfo-debugsource-21.50-2.3.5 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): hwinfo-21.50-2.3.5 hwinfo-debuginfo-21.50-2.3.5 hwinfo-debugsource-21.50-2.3.5 References: https://bugzilla.suse.com/1041090 https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1051076 https://bugzilla.suse.com/1062562 From sle-updates at lists.suse.com Fri Dec 15 13:08:29 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 15 Dec 2017 21:08:29 +0100 (CET) Subject: SUSE-SU-2017:3336-1: important: Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP1) Message-ID: <20171215200829.7FE9AFC9D@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 17 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3336-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_48 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2090=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2090=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_48-default-6-2.1 kgraft-patch-3_12_74-60_64_48-xen-6-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_48-default-6-2.1 kgraft-patch-3_12_74-60_64_48-xen-6-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Fri Dec 15 13:09:05 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 15 Dec 2017 21:09:05 +0100 (CET) Subject: SUSE-SU-2017:3337-1: important: Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP1) Message-ID: <20171215200905.08EE3FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 15 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3337-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.74-60_64_40 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2092=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2092=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_40-default-7-2.1 kgraft-patch-3_12_74-60_64_40-xen-7-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_40-default-7-2.1 kgraft-patch-3_12_74-60_64_40-xen-7-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Fri Dec 15 13:09:37 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 15 Dec 2017 21:09:37 +0100 (CET) Subject: SUSE-SU-2017:3338-1: important: Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP1) Message-ID: <20171215200937.2BA2BFCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3338-1 Rating: important References: #1069708 Cross-References: CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for the Linux Kernel 3.12.74-60_64_63 fixes one issue. The following security issue was fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2091=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2091=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_74-60_64_63-default-2-2.1 kgraft-patch-3_12_74-60_64_63-xen-2-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_74-60_64_63-default-2-2.1 kgraft-patch-3_12_74-60_64_63-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Fri Dec 15 13:10:03 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 15 Dec 2017 21:10:03 +0100 (CET) Subject: SUSE-RU-2017:3339-1: moderate: Recommended update for kubernetes-salt Message-ID: <20171215201003.A5913FCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for kubernetes-salt ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3339-1 Rating: moderate References: #1058079 #1067219 #1069175 #1069205 Affected Products: SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for kubernetes-salt fixes the following issues: - Kubernetes External FQDN is not validated as FQDN (bsc#1069205) - Auth dialog when downloading kubectl errors out (bsc#1069175) - kubernetes-salt uses hardcoded eth0 (bsc#1058079) - Master-Node FQDN ends up as Admin-Node loopback entry in /etc/hosts (bsc#1067219) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2089=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Container as a Service Platform ALL (noarch): kubernetes-salt-2.0.0+git_r469_ee16ef7-23.10.1 References: https://bugzilla.suse.com/1058079 https://bugzilla.suse.com/1067219 https://bugzilla.suse.com/1069175 https://bugzilla.suse.com/1069205 From sle-updates at lists.suse.com Fri Dec 15 13:10:59 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 15 Dec 2017 21:10:59 +0100 (CET) Subject: SUSE-SU-2017:3340-1: important: Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP1) Message-ID: <20171215201059.46799FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel (Live Patch 13 for SLE 12 SP1) ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3340-1 Rating: important References: #1053153 #1069708 Cross-References: CVE-2017-10661 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.69-60_64_32 fixes several issues. The following security issues were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bsc#1069708). - CVE-2017-10661: Race condition in fs/timerfd.c allowed local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing (bsc#1053153). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2093=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2093=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kgraft-patch-3_12_69-60_64_32-default-9-2.1 kgraft-patch-3_12_69-60_64_32-xen-9-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kgraft-patch-3_12_69-60_64_32-default-9-2.1 kgraft-patch-3_12_69-60_64_32-xen-9-2.1 References: https://www.suse.com/security/cve/CVE-2017-10661.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1053153 https://bugzilla.suse.com/1069708 From sle-updates at lists.suse.com Fri Dec 15 16:07:18 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Sat, 16 Dec 2017 00:07:18 +0100 (CET) Subject: SUSE-RU-2017:3341-1: moderate: Recommended update for openmpi Message-ID: <20171215230718.9F41FFCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for openmpi ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3341-1 Rating: moderate References: #1058750 #1058811 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openmpi provides the following fix: - Re-enable Infiniband support by removing the --enable-mpi-thread-multiple configure option. (bsc#1058750, bsc#1058811) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2094=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2094=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): openmpi-debuginfo-1.10.6-3.3.5 openmpi-debugsource-1.10.6-3.3.5 openmpi-devel-1.10.6-3.3.5 openmpi-devel-debuginfo-1.10.6-3.3.5 openmpi-devel-static-1.10.6-3.3.5 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): openmpi-1.10.6-3.3.5 openmpi-debuginfo-1.10.6-3.3.5 openmpi-debugsource-1.10.6-3.3.5 openmpi-libs-1.10.6-3.3.5 openmpi-libs-debuginfo-1.10.6-3.3.5 References: https://bugzilla.suse.com/1058750 https://bugzilla.suse.com/1058811 From sle-updates at lists.suse.com Fri Dec 15 16:07:55 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Sat, 16 Dec 2017 00:07:55 +0100 (CET) Subject: SUSE-RU-2017:3342-1: Recommended update for cifs-utils Message-ID: <20171215230755.0CC4DFCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for cifs-utils ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3342-1 Rating: low References: #1025471 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cifs-utils fixes the following issues: - Document SMB3+ and new seal option (fate#322075) - Get rid of init script on everything based off SLE12+ (bsc#1025471) - Use https urls Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2095=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2095=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2095=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2095=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2095=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2095=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2095=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): cifs-utils-debuginfo-6.5-9.3.2 cifs-utils-debugsource-6.5-9.3.2 cifs-utils-devel-6.5-9.3.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): cifs-utils-debuginfo-6.5-9.3.2 cifs-utils-debugsource-6.5-9.3.2 cifs-utils-devel-6.5-9.3.2 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): cifs-utils-6.5-9.3.2 cifs-utils-debuginfo-6.5-9.3.2 cifs-utils-debugsource-6.5-9.3.2 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): cifs-utils-6.5-9.3.2 cifs-utils-debuginfo-6.5-9.3.2 cifs-utils-debugsource-6.5-9.3.2 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): cifs-utils-6.5-9.3.2 cifs-utils-debuginfo-6.5-9.3.2 cifs-utils-debugsource-6.5-9.3.2 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): cifs-utils-6.5-9.3.2 cifs-utils-debuginfo-6.5-9.3.2 cifs-utils-debugsource-6.5-9.3.2 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): cifs-utils-6.5-9.3.2 cifs-utils-debuginfo-6.5-9.3.2 cifs-utils-debugsource-6.5-9.3.2 References: https://bugzilla.suse.com/1025471 From sle-updates at lists.suse.com Fri Dec 15 22:08:44 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Sat, 16 Dec 2017 06:08:44 +0100 (CET) Subject: SUSE-SU-2017:3343-1: important: Security update for openssl Message-ID: <20171216050844.4BF54FC9D@maintenance.suse.de> SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3343-1 Rating: important References: #1071905 #1071906 Cross-References: CVE-2017-3737 CVE-2017-3738 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 SUSE Container as a Service Platform ALL OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssl fixes the following issues: - OpenSSL Security Advisory [07 Dec 2017] * CVE-2017-3737: OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an \"error state\" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected. (bsc#1071905) * CVE-2017-3738: There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. (bsc#1071906) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2097=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2097=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2097=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2097=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2097=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2097=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2097=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2097=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2097=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libopenssl-devel-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libopenssl-devel-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libopenssl-devel-1.0.2j-60.20.2 libopenssl1_0_0-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2 libopenssl1_0_0-hmac-1.0.2j-60.20.2 openssl-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): openssl-doc-1.0.2j-60.20.2 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libopenssl-devel-1.0.2j-60.20.2 libopenssl1_0_0-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2 libopenssl1_0_0-hmac-1.0.2j-60.20.2 openssl-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libopenssl1_0_0-32bit-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-32bit-1.0.2j-60.20.2 libopenssl1_0_0-hmac-32bit-1.0.2j-60.20.2 - SUSE Linux Enterprise Server 12-SP3 (noarch): openssl-doc-1.0.2j-60.20.2 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libopenssl-devel-1.0.2j-60.20.2 libopenssl1_0_0-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2 libopenssl1_0_0-hmac-1.0.2j-60.20.2 openssl-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libopenssl1_0_0-32bit-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-32bit-1.0.2j-60.20.2 libopenssl1_0_0-hmac-32bit-1.0.2j-60.20.2 - SUSE Linux Enterprise Server 12-SP2 (noarch): openssl-doc-1.0.2j-60.20.2 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libopenssl-devel-1.0.2j-60.20.2 libopenssl1_0_0-1.0.2j-60.20.2 libopenssl1_0_0-32bit-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-32bit-1.0.2j-60.20.2 openssl-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libopenssl-devel-1.0.2j-60.20.2 libopenssl1_0_0-1.0.2j-60.20.2 libopenssl1_0_0-32bit-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-32bit-1.0.2j-60.20.2 openssl-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - SUSE Container as a Service Platform ALL (x86_64): libopenssl1_0_0-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2 openssl-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 - OpenStack Cloud Magnum Orchestration 7 (x86_64): libopenssl1_0_0-1.0.2j-60.20.2 libopenssl1_0_0-debuginfo-1.0.2j-60.20.2 openssl-1.0.2j-60.20.2 openssl-debuginfo-1.0.2j-60.20.2 openssl-debugsource-1.0.2j-60.20.2 References: https://www.suse.com/security/cve/CVE-2017-3737.html https://www.suse.com/security/cve/CVE-2017-3738.html https://bugzilla.suse.com/1071905 https://bugzilla.suse.com/1071906 From sle-updates at lists.suse.com Mon Dec 18 10:08:54 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Mon, 18 Dec 2017 18:08:54 +0100 (CET) Subject: SUSE-RU-2017:3360-1: moderate: Recommended update for transactional-update Message-ID: <20171218170854.33F3FFC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for transactional-update ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3360-1 Rating: moderate References: #1068933 #1071038 Affected Products: SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This updates the package transactional-update to version 1.23, which contains the following fixes: - Don't save unused snapshots if we may delete them again (bsc#1071038) - Fix re-registration in rollback case (bsc#1068933) - Fix problems with updating the grub2 bootloader (bsc#1068933) - Add support for migration of products with SCC/SMT - Re-add support to re-write bootloader Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2099=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Container as a Service Platform ALL (noarch): transactional-update-1.24-3.5.1 References: https://bugzilla.suse.com/1068933 https://bugzilla.suse.com/1071038 From sle-updates at lists.suse.com Mon Dec 18 13:08:25 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Mon, 18 Dec 2017 21:08:25 +0100 (CET) Subject: SUSE-RU-2017:3361-1: important: Recommended update for wicked Message-ID: <20171218200825.5FE84FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3361-1 Rating: important References: #1036619 #1043883 #1045522 #1050258 #1057007 #1059292 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 SUSE Container as a Service Platform ALL OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for wicked fixes the following issues: - A regression in wicked was causing the hostname not to be set correctly via DHCP in some cases. [bsc#1057007,bsc#1050258] - Configure the interface MTU correctly even in cases where the interface was up already. [bsc#1059292] - Don't abort the process that adds configures routes if one route fails. [bsc#1036619] - Handle DHCP4 user-class ids properly. [bsc#1045522] - ethtool: handle channels parameters. [bsc#1043883] Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2100=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2100=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2100=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2100=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2100=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2100=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2100=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libwicked-0-6-0.6.40-38.8.1 libwicked-0-6-debuginfo-0.6.40-38.8.1 wicked-0.6.40-38.8.1 wicked-debuginfo-0.6.40-38.8.1 wicked-debugsource-0.6.40-38.8.1 wicked-service-0.6.40-38.8.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libwicked-0-6-0.6.40-38.8.1 libwicked-0-6-debuginfo-0.6.40-38.8.1 wicked-0.6.40-38.8.1 wicked-debuginfo-0.6.40-38.8.1 wicked-debugsource-0.6.40-38.8.1 wicked-service-0.6.40-38.8.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libwicked-0-6-0.6.40-38.8.1 libwicked-0-6-debuginfo-0.6.40-38.8.1 wicked-0.6.40-38.8.1 wicked-debuginfo-0.6.40-38.8.1 wicked-debugsource-0.6.40-38.8.1 wicked-service-0.6.40-38.8.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libwicked-0-6-0.6.40-38.8.1 libwicked-0-6-debuginfo-0.6.40-38.8.1 wicked-0.6.40-38.8.1 wicked-debuginfo-0.6.40-38.8.1 wicked-debugsource-0.6.40-38.8.1 wicked-service-0.6.40-38.8.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libwicked-0-6-0.6.40-38.8.1 libwicked-0-6-debuginfo-0.6.40-38.8.1 wicked-0.6.40-38.8.1 wicked-debuginfo-0.6.40-38.8.1 wicked-debugsource-0.6.40-38.8.1 wicked-service-0.6.40-38.8.1 - SUSE Container as a Service Platform ALL (x86_64): libwicked-0-6-0.6.40-38.8.1 libwicked-0-6-debuginfo-0.6.40-38.8.1 wicked-0.6.40-38.8.1 wicked-debuginfo-0.6.40-38.8.1 wicked-debugsource-0.6.40-38.8.1 wicked-service-0.6.40-38.8.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): libwicked-0-6-0.6.40-38.8.1 libwicked-0-6-debuginfo-0.6.40-38.8.1 wicked-0.6.40-38.8.1 wicked-debuginfo-0.6.40-38.8.1 wicked-debugsource-0.6.40-38.8.1 wicked-service-0.6.40-38.8.1 References: https://bugzilla.suse.com/1036619 https://bugzilla.suse.com/1043883 https://bugzilla.suse.com/1045522 https://bugzilla.suse.com/1050258 https://bugzilla.suse.com/1057007 https://bugzilla.suse.com/1059292 From sle-updates at lists.suse.com Tue Dec 19 04:10:09 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 19 Dec 2017 12:10:09 +0100 (CET) Subject: SUSE-SU-2017:3369-1: important: Security update for java-1_6_0-ibm Message-ID: <20171219111009.40C55FCC4@maintenance.suse.de> SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3369-1 Rating: important References: #1070162 Cross-References: CVE-2016-9841 CVE-2017-10281 CVE-2017-10285 CVE-2017-10293 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_6_0-ibm fixes the following issues: Security issues fixed: - Security update to version 6.0.16.50 (bsc#1070162) * CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281 CVE-2017-10295 CVE-2017-10345 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-java-1_6_0-ibm-13378=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-java-1_6_0-ibm-13378=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-devel-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-fonts-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.50-85.5.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.50-85.5.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.50-85.5.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): java-1_6_0-ibm-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-alsa-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-devel-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-fonts-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.50-85.5.1 java-1_6_0-ibm-plugin-1.6.0_sr16.50-85.5.1 References: https://www.suse.com/security/cve/CVE-2016-9841.html https://www.suse.com/security/cve/CVE-2017-10281.html https://www.suse.com/security/cve/CVE-2017-10285.html https://www.suse.com/security/cve/CVE-2017-10293.html https://www.suse.com/security/cve/CVE-2017-10295.html https://www.suse.com/security/cve/CVE-2017-10345.html https://www.suse.com/security/cve/CVE-2017-10346.html https://www.suse.com/security/cve/CVE-2017-10347.html https://www.suse.com/security/cve/CVE-2017-10348.html https://www.suse.com/security/cve/CVE-2017-10349.html https://www.suse.com/security/cve/CVE-2017-10350.html https://www.suse.com/security/cve/CVE-2017-10355.html https://www.suse.com/security/cve/CVE-2017-10356.html https://www.suse.com/security/cve/CVE-2017-10357.html https://www.suse.com/security/cve/CVE-2017-10388.html https://bugzilla.suse.com/1070162 From sle-updates at lists.suse.com Tue Dec 19 04:10:41 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 19 Dec 2017 12:10:41 +0100 (CET) Subject: SUSE-SU-2017:3370-1: moderate: Security update for python-PyJWT Message-ID: <20171219111041.CAF1BFCA4@maintenance.suse.de> SUSE Security Update: Security update for python-PyJWT ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3370-1 Rating: moderate References: #1054106 Cross-References: CVE-2017-12880 Affected Products: SUSE OpenStack Cloud 7 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Container as a Service Platform ALL OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-PyJWT fixes the following issues: - CVE-2017-12880: fix symmetric/asymmetric confusion when handling PKCS1 public keys (bsc#1054106) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2102=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-2102=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2102=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2102=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (noarch): python-PyJWT-1.4.2-3.3.1 - SUSE Linux Enterprise Module for Public Cloud 12 (noarch): python-PyJWT-1.4.2-3.3.1 - SUSE Container as a Service Platform ALL (noarch): python-PyJWT-1.4.2-3.3.1 - OpenStack Cloud Magnum Orchestration 7 (noarch): python-PyJWT-1.4.2-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-12880.html https://bugzilla.suse.com/1054106 From sle-updates at lists.suse.com Tue Dec 19 10:08:13 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 19 Dec 2017 18:08:13 +0100 (CET) Subject: SUSE-RU-2017:3371-1: important: Recommended update for dracut Message-ID: <20171219170813.127A5FCC4@maintenance.suse.de> SUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3371-1 Rating: important References: #1072424 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dracut fixes the following issues: - Support AMD CPU families 0x16 and 0x17 (bsc#1072424) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2105=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): dracut-037-51.34.1 dracut-debuginfo-037-51.34.1 dracut-debugsource-037-51.34.1 dracut-fips-037-51.34.1 References: https://bugzilla.suse.com/1072424 From sle-updates at lists.suse.com Tue Dec 19 13:08:56 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 19 Dec 2017 21:08:56 +0100 (CET) Subject: SUSE-RU-2017:3374-1: important: Recommended update for wicked Message-ID: <20171219200856.E46E0FCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for wicked ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3374-1 Rating: important References: #1036619 #1043883 #1045522 #1050258 #1057007 #1059292 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for wicked fixes the following issues: - A regression in wicked was causing the hostname not to be set correctly via DHCP in some cases. [bsc#1057007,bsc#1050258] - Configure the interface MTU correctly even in cases where the interface was up already. [bsc#1059292] - Don't abort the process that adds configures routes if one route fails. [bsc#1036619] - Handle DHCP4 user-class ids properly. [bsc#1045522] - ethtool: handle channels parameters. [bsc#1043883] Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-2107=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2107=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2107=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): libwicked-0-6-0.6.40-28.9.1 libwicked-0-6-debuginfo-0.6.40-28.9.1 wicked-0.6.40-28.9.1 wicked-debuginfo-0.6.40-28.9.1 wicked-debugsource-0.6.40-28.9.1 wicked-service-0.6.40-28.9.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): libwicked-0-6-0.6.40-28.9.1 libwicked-0-6-debuginfo-0.6.40-28.9.1 wicked-0.6.40-28.9.1 wicked-debuginfo-0.6.40-28.9.1 wicked-debugsource-0.6.40-28.9.1 wicked-service-0.6.40-28.9.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): libwicked-0-6-0.6.40-28.9.1 libwicked-0-6-debuginfo-0.6.40-28.9.1 wicked-0.6.40-28.9.1 wicked-debuginfo-0.6.40-28.9.1 wicked-debugsource-0.6.40-28.9.1 wicked-service-0.6.40-28.9.1 References: https://bugzilla.suse.com/1036619 https://bugzilla.suse.com/1043883 https://bugzilla.suse.com/1045522 https://bugzilla.suse.com/1050258 https://bugzilla.suse.com/1057007 https://bugzilla.suse.com/1059292 From sle-updates at lists.suse.com Tue Dec 19 13:10:05 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Tue, 19 Dec 2017 21:10:05 +0100 (CET) Subject: SUSE-RU-2017:3375-1: important: Recommended update for dracut Message-ID: <20171219201005.9E8E8FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3375-1 Rating: important References: #1011554 #1072424 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dracut fixes the following issues: - Include crc32c Intel module when using btrfs (bsc#1011554) - Support AMD CPU families 0x16 and 0x17 (bsc#1072424) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-2106=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2106=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2106=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): dracut-037-99.16.1 dracut-debuginfo-037-99.16.1 dracut-debugsource-037-99.16.1 dracut-fips-037-99.16.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): dracut-037-99.16.1 dracut-debuginfo-037-99.16.1 dracut-debugsource-037-99.16.1 dracut-fips-037-99.16.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): dracut-037-99.16.1 dracut-debuginfo-037-99.16.1 dracut-debugsource-037-99.16.1 dracut-fips-037-99.16.1 References: https://bugzilla.suse.com/1011554 https://bugzilla.suse.com/1072424 From sle-updates at lists.suse.com Wed Dec 20 07:07:45 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 15:07:45 +0100 (CET) Subject: SUSE-RU-2017:3376-1: Recommended update for yast2-sap-ha Message-ID: <20171220140745.AFF51F7B6@maintenance.suse.de> SUSE Recommended Update: Recommended update for yast2-sap-ha ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3376-1 Rating: low References: #1029694 #1045482 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP3 SUSE Linux Enterprise Server for SAP 12-SP2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-sap-ha provides the following fixes: - Fix the detection of available watchdog modules in the wizard. (bsc#1029694) - Improve log in ncurses mode. - Change the layout of the overview screen. - Fix the operation mode and adapt the module to work with HANA 2.0. (bsc#1045482) - Store and recover settings for unfinished cluster configurations. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2017-2108=1 - SUSE Linux Enterprise Server for SAP 12-SP2: zypper in -t patch SUSE-SLE-SAP-12-SP2-2017-2108=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP3 (noarch): yast2-sap-ha-1.0.0-2.5.12 - SUSE Linux Enterprise Server for SAP 12-SP2 (noarch): yast2-sap-ha-1.0.0-2.5.12 References: https://bugzilla.suse.com/1029694 https://bugzilla.suse.com/1045482 From sle-updates at lists.suse.com Wed Dec 20 07:08:20 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 15:08:20 +0100 (CET) Subject: SUSE-RU-2017:3377-1: Recommended update for release-notes-sles-for-sap Message-ID: <20171220140820.7A237FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for release-notes-sles-for-sap ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3377-1 Rating: low References: #1062335 #1071107 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: The Release Notes of SUSE Linux Enterprise Server for SAP 12 SP3 have been updated to document: - ESPOS Updates Shipped Directly in Update Repositories (fate#324251, bsc#1062335) - Installation Wizard Support for SAP HANA MDC (fate#322281) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2017-2109=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12-SP3 (noarch): release-notes-sles-for-sap-12.3.20171204-3.3.1 References: https://bugzilla.suse.com/1062335 https://bugzilla.suse.com/1071107 From sle-updates at lists.suse.com Wed Dec 20 10:09:32 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:09:32 +0100 (CET) Subject: SUSE-SU-2017:3378-1: important: Security update for ImageMagick Message-ID: <20171220170932.679CDFC9D@maintenance.suse.de> SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3378-1 Rating: important References: #1048457 #1049796 #1050116 #1050139 #1050632 #1051441 #1051847 #1052450 #1052553 #1052689 #1052758 #1052764 #1054757 #1055214 #1056432 #1057719 #1057729 #1057730 #1058485 #1058637 #1059666 #1059778 #1060577 #1066003 #1067181 #1067184 Cross-References: CVE-2017-11188 CVE-2017-11478 CVE-2017-11527 CVE-2017-11535 CVE-2017-11640 CVE-2017-11752 CVE-2017-12140 CVE-2017-12435 CVE-2017-12587 CVE-2017-12644 CVE-2017-12662 CVE-2017-12669 CVE-2017-12983 CVE-2017-13134 CVE-2017-13769 CVE-2017-14172 CVE-2017-14173 CVE-2017-14175 CVE-2017-14341 CVE-2017-14342 CVE-2017-14531 CVE-2017-14607 CVE-2017-14733 CVE-2017-15930 CVE-2017-16545 CVE-2017-16546 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: * CVE-2017-14607: out of bounds read flaw related to ReadTIFFImagehas could possibly disclose potentially sensitive memory [bsc#1059778] * CVE-2017-11640: NULL pointer deref in WritePTIFImage() in coders/tiff.c [bsc#1050632] * CVE-2017-14342: a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1058485] * CVE-2017-14341: Infinite loop in the ReadWPGImage function [bsc#1058637] * CVE-2017-16546: problem in the function ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1067181] * CVE-2017-16545: The ReadWPGImage function in coders/wpg.c in validation problems could lead to denial of service [bsc#1067184] * CVE-2017-14175: Lack of End of File check could lead to denial of service [bsc#1057719] * CVE-2017-13769: denial of service issue in function WriteTHUMBNAILImage in coders/thumbnail.c [bsc#1056432] * CVE-2017-13134: a heap-based buffer over-read was found in thefunction SFWScan in coders/sfw.c, which allows attackers to cause adenial of service via a crafted file. [bsc#1055214] * CVE-2017-11478: ReadOneDJVUImage in coders/djvu.c in ImageMagick allows remote attackers to cause a DoS [bsc#1049796] * CVE-2017-15930: Null Pointer dereference while transfering JPEG scanlines could lead to denial of service [bsc#1066003] * CVE-2017-12983: Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c allows remote attackers to cause a denial of service [bsc#1054757] * CVE-2017-14531: memory exhaustion issue in ReadSUNImage incoders/sun.c. [bsc#1059666] * CVE-2017-12435: Memory exhaustion in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service [bsc#1052553] * CVE-2017-12587: User controlable large loop in the ReadPWPImage in coders\pwp.c could lead to denial of service [bsc#1052450] * CVE-2017-14173: unction ReadTXTImage is vulnerable to a integer overflow that could lead to denial of service [bsc#1057729] * CVE-2017-11188: ImageMagick: The ReadDPXImage function in codersdpx.c in ImageMagick 7.0.6-0 has a largeloop vulnerability that can cause CPU exhaustion via a crafted DPX file, relatedto lack of an EOF check. [bnc#1048457] * CVE-2017-11527: ImageMagick: ReadDPXImage in coders/dpx.c allows remote attackers to cause DoS [bnc#1050116] * CVE-2017-11535: GraphicsMagick, ImageMagick: Heap-based buffer over-read in WritePSImage() in coders/ps.c [bnc#1050139] * CVE-2017-11752: ImageMagick: ReadMAGICKImage in coders/magick.c allows to cause DoS [bnc#1051441] * CVE-2017-12140: ImageMagick: ReadDCMImage in codersdcm.c has a ninteger signedness error leading to excessive memory consumption [bnc#1051847] * CVE-2017-12669: ImageMagick: Memory leak in WriteCALSImage in coders/cals.c [bnc#1052689] * CVE-2017-12662: GraphicsMagick, ImageMagick: Memory leak in WritePDFImage in coders/pdf.c [bnc#1052758] * CVE-2017-12644: ImageMagick: Memory leak in ReadDCMImage in codersdcm.c [bnc#1052764] * CVE-2017-14172: ImageMagick: Lack of end of file check in ReadPSImage() could lead to a denial of service [bnc#1057730] * CVE-2017-14733: GraphicsMagick: Heap overflow on ReadRLEImage in coders/rle.c could lead to denial of service [bnc#1060577] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ImageMagick-13384=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ImageMagick-13384=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ImageMagick-13384=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-6.4.3.6-7.78.14.1 ImageMagick-devel-6.4.3.6-7.78.14.1 libMagick++-devel-6.4.3.6-7.78.14.1 libMagick++1-6.4.3.6-7.78.14.1 libMagickWand1-6.4.3.6-7.78.14.1 perl-PerlMagick-6.4.3.6-7.78.14.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64 s390x x86_64): libMagickWand1-32bit-6.4.3.6-7.78.14.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libMagickCore1-6.4.3.6-7.78.14.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libMagickCore1-32bit-6.4.3.6-7.78.14.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ImageMagick-debuginfo-6.4.3.6-7.78.14.1 ImageMagick-debugsource-6.4.3.6-7.78.14.1 References: https://www.suse.com/security/cve/CVE-2017-11188.html https://www.suse.com/security/cve/CVE-2017-11478.html https://www.suse.com/security/cve/CVE-2017-11527.html https://www.suse.com/security/cve/CVE-2017-11535.html https://www.suse.com/security/cve/CVE-2017-11640.html https://www.suse.com/security/cve/CVE-2017-11752.html https://www.suse.com/security/cve/CVE-2017-12140.html https://www.suse.com/security/cve/CVE-2017-12435.html https://www.suse.com/security/cve/CVE-2017-12587.html https://www.suse.com/security/cve/CVE-2017-12644.html https://www.suse.com/security/cve/CVE-2017-12662.html https://www.suse.com/security/cve/CVE-2017-12669.html https://www.suse.com/security/cve/CVE-2017-12983.html https://www.suse.com/security/cve/CVE-2017-13134.html https://www.suse.com/security/cve/CVE-2017-13769.html https://www.suse.com/security/cve/CVE-2017-14172.html https://www.suse.com/security/cve/CVE-2017-14173.html https://www.suse.com/security/cve/CVE-2017-14175.html https://www.suse.com/security/cve/CVE-2017-14341.html https://www.suse.com/security/cve/CVE-2017-14342.html https://www.suse.com/security/cve/CVE-2017-14531.html https://www.suse.com/security/cve/CVE-2017-14607.html https://www.suse.com/security/cve/CVE-2017-14733.html https://www.suse.com/security/cve/CVE-2017-15930.html https://www.suse.com/security/cve/CVE-2017-16545.html https://www.suse.com/security/cve/CVE-2017-16546.html https://bugzilla.suse.com/1048457 https://bugzilla.suse.com/1049796 https://bugzilla.suse.com/1050116 https://bugzilla.suse.com/1050139 https://bugzilla.suse.com/1050632 https://bugzilla.suse.com/1051441 https://bugzilla.suse.com/1051847 https://bugzilla.suse.com/1052450 https://bugzilla.suse.com/1052553 https://bugzilla.suse.com/1052689 https://bugzilla.suse.com/1052758 https://bugzilla.suse.com/1052764 https://bugzilla.suse.com/1054757 https://bugzilla.suse.com/1055214 https://bugzilla.suse.com/1056432 https://bugzilla.suse.com/1057719 https://bugzilla.suse.com/1057729 https://bugzilla.suse.com/1057730 https://bugzilla.suse.com/1058485 https://bugzilla.suse.com/1058637 https://bugzilla.suse.com/1059666 https://bugzilla.suse.com/1059778 https://bugzilla.suse.com/1060577 https://bugzilla.suse.com/1066003 https://bugzilla.suse.com/1067181 https://bugzilla.suse.com/1067184 From sle-updates at lists.suse.com Wed Dec 20 10:13:19 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:13:19 +0100 (CET) Subject: SUSE-RU-2017:3379-1: moderate: Recommended update for SUSE Manager Server 3.1 Message-ID: <20171220171319.1EE88FCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for SUSE Manager Server 3.1 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3379-1 Rating: moderate References: #1019097 #1021432 #1025201 #1032065 #1032122 #1035955 #1036254 #1040420 #1041993 #1044719 #1045141 #1046679 #1048295 #1048326 #1048355 #1050433 #1052079 #1052283 #1052691 #1052728 #1053038 #1054044 #1054424 #1054902 #1055292 #1055467 #1055524 #1056188 #1056358 #1056868 #1056994 #1057084 #1057599 #1058110 #1058128 #1058323 #1058862 #1059201 #1059319 #1059388 #1059466 #1059524 #1059568 #1059576 #1059801 #1060022 #1060182 #1060389 #1060691 #1061245 #1061548 #1061563 #1061574 #1061576 #1061596 #1062094 #1062366 #1062476 #1062936 #1062972 #1063185 #1063419 #1063588 #1063590 #1063759 #1063822 #1063891 #1063940 #1064393 #1065216 #1065676 #1065844 #1066404 #1066641 #1066663 #1066819 #1066923 #1067509 #1068057 #1069461 #1069576 #1069615 #1070161 #1070979 #1072350 #970630 #971785 #971916 #989991 Affected Products: SUSE Manager Server 3.1 ______________________________________________________________________________ An update that has 89 recommended fixes can now be installed. Description: This update fixes the following issues: !!!NOTE: For PostgreSQL, schema migrations could take a long time (hours), depending on the number of synced !!! !!!packages and number of rows which requires cleanup. Please refer to the release notes for more information.!!! cobbler: - Fix koan wait parameter initialization. - Fix setup.py to identify SUSE OS correctly. (bsc#1046679) nutch: - Log Hadoop into proper log directory. (bsc#1061574) osad: - Fixed TypeError for force flag in setup_config that could happen when jabberd restart was needed. (bsc#1064393) spacecmd: - Configchannel export binary flag to json. (bsc#1044719) spacewalk-backend: - Fix issues with syncing .deb repositories. (bsc#1050433) - Honor MAX_LOG_AGE for (renamed) cobbler/tasks logs file in spacewalk-debug. (bsc#1025201) - Add hostname to duplicate machine_id email. (bsc#1055292) - Fix link to manual and the described procedure. - Don't crash when token is set to 'fake'. (bsc#1060022) - When searching for not installed products exclude release packages which are provided by others. (bsc#1067509) - Search for product packages when installed packages are available. (bsc#1060182) - RhnServerNetwork refactoring. (bsc#1063419) spacewalk-branding: - Improve text for system types page. (bsc#1057084) - Disallow entering multiple identical mirror credentials. (bsc#971785) spacewalk-certs-tools: - Add comment to explain that FULLY_UPDATE_THIS_BOX gets ignored on salt minions. (bsc#1036254) - Do not use registration keys from last autoinstallation. (bsc#1057599) spacewalk-java: - Implemented assignment of configuration channels to Salt systems via Salt states. - Added file structure under Salt root for configuration management. - Enabled configuration management UI for Salt systems. - Remove SUSE Manager specific configuration from Salt ssh minion when deleting system from SUSE Manager. (bsc#1048326) - Support Open Enterprise Server 2018. (bsc#1060182) - Enable autofocus for login field. - Do not remove virtual instances for registered systems. (bsc#1063759) - Process right configfile on 'scheduleFileComparisons' API calls. (bsc#1066663) - Fix reported UUIDs for guests instances within a virtual host. (bsc#1063759) - Generate Order Items for OEM subscriptions. (bsc#1045141) - Fix alignment of systemtype counts text. (bsc#1057084) - Enable 'Power Management' features on Salt minions. - Fix editing of vhm configuration parameters. (bsc#1063185) - Skip the server if no channel can be guessed. (bsc#1040420) - Added a method to check if OS on machine supports containerization or not. (bsc#1052728) - 'Cancel Autoinstallation' link has been changed to look like button to make it more visible. (bsc#1035955) - Make systems in system group list selectable by the group admins. (bsc#1021432) - Hide non-relevant typed systems in SystemCurrency. (bsc#1019097) - Start registration for accepted minions only on the minion start event, not automatically on any event. (bsc#1054044) - Exclude salt systems from the list of target systems for traditional configuration stack installation. - Keep the the GPG Check value if validation fails. (bsc#1061548) - Extract Proxy version from installed product. (bsc#1055467) - Provide another create method(with additional parameter Gpgcheck) to create software channel through XML RPC. (bsc#1060691) - Improve duplicate hostname and transaction handling in minion registration. - Added 'Machine Id' information as part of details in System namespace for XMLRPC API. (bsc#1054902) - Modified the displayed message after updation of activation key. (bsc#1060389) - Display GUI message after successfully deleting custom key. (bsc#1048295) - Fix links on schedule pages. (bsc#1059201) - Harmonize presentation of patch information. (bsc#1032065) - Display a feedback message when user deletes configuration channel. (bsc#1048355) - Fix duplicate machine id in event history on minion restart. (bsc#1059388) - Show link in message when rescheduling actions. (bsc#1032122) - Prevent ISE when distribution does not exist. (bsc#1059524) - Do not store registration-keys during autoinstallation. (bsc#1057599) - Enable package profile comparisons on minions. - Disallow entering multiple identical mirror credentials. (bsc#971785) - Ensure correct ordering of patches. (bsc#1059801) - Fix cloning Kickstart Profiles with Custom Options. (bsc#1061576) - Checkin the foreign host if a s390 minion finished a job. (bsc#971916) - Increase max length of hardware address to 32 byte. (bsc#989991) - Set the creator user for minions correctly in case it is known. (bsc#1058862) - Fix minor UI issues on overview page. (bsc#1063590) - Hide invisible first level menu items. (bsc#1063822) - Fail gracefully when GPG files are requested. (bsc#1065676) - Fix unscheduling actions for traditional systems. (bsc#1065216) - Add logging messages for SP migration. (bsc#1066819, bsc#1066404) - Improve messaging for "Compare Packages". (bsc#1065844) - When searching for not installed products exclude release packages which are provided by others. (bsc#1067509) - RhnServerNetwork refactoring. (bsc#1063419) - Add Adelaide timezone to selectable timezones. (bsc#1063891) spacewalk-reports: - Add machine_id and minion_id to system-profiles and inventory report. (bsc#1054902) - RhnServerNetwork refactoring. (bsc#1063419) spacewalk-search: - RhnServerNetwork refactoring. (bsc#1063419) spacewalk-web: - Disallow entering multiple identical mirror credentials. (bsc#971785) - Fix runtime data display in Images page. (bsc#1062972) - Add delete button to image-overview page. (bsc#1061245) - Update wording for image profiles in image build page. (bsc#1058323) - Rename 'Refresh Data' button in VHM details page. - Update browser URL correctly after deleting a VHM from the details page. (bsc#1061596) - Show 'Nodes' list only for Kubernetes VHMs. (bsc#1061563) - Remove import button from image over page. (bsc#1058128) - Use the same datetime format as the rest of the product. (bsc#1054424) supportutils-plugin-susemanager: - Use correct function validate_rpm for supportconfig. (bsc#1062094) susemanager: - Support Open Enterprise Server 2018. (bsc#1060182) - Fixed bootstrap repository path for SLES4SAP version 12 and 12.1. (bsc#1062936) - Ensure postgres db template uses unicode. (bsc#1062476) - Fix error message for database upgrade failure. - Check for sufficient diskspace in /var/lib/pgsql. susemanager-docs_en: - API Documentation Update. (bsc#1069576, 1069461, bsc#1062366) - SUSE Manager documentation is missing single-page html format. (bsc#1056994) - Incorrect database location. (bsc#1059576) - Service Pack Migration documentation points to 404 webpage. (bsc#1059466) - Tech specs of https://www.suse.com/products/suse-manager/ does not show supported client systems. (bsc#1056868) - Best Practices July 6 2017 -- Chapter 8 missing graphics. (bsc#1056188) - Outdated screenshots for the proxy. (bsc#1055524) - Lack of documentation: Using a custom SSL Certificate. (bsc#1052691) - Wrong pattern name in instruction. (bsc#1066641) - Wrong Image in Image Building section. (bsc#1070979) susemanager-schema: - Add Adelaide timezone to selectable timezones. (bsc#1063891) - Added new relationships for Salt config management. - Added new config channel type(state) and file type(sls). - Enable 'Power Management' features on Salt minions. - Enablement of the package profile feature for minions. - Re-create unique index on minion_id. (bsc#1059568, bsc#1056358) - Increase max length of hardware address to 32 byte. (bsc#989991) - Fix unique index for evr and capability and remove duplicates during migration. (bsc#1058110) - RhnServerNetwork refactoring. (bsc#1063419) - Registration of REHL4 clients fails due to incomplete. - Fix copyright. - Change suseServer ostarget to a foreign key to suseOSTarget(id). - Add RES GPG Key to DB. - Add SUSE and Novell GPG Keys to DB. susemanager-sls: - Fix Salt version-detection for patches. (bsc#1072350) - Fix cleanup state error when deleting ssh-push minion. (bsc#1070161) - Added state templates for deploying/comparing config channels for Salt. - Fix failing certs state for Tumbleweed. (bsc#970630) - Fix deprecated SLS files to avoid deprecation warnings during highstate. (bsc#1041993) - Support xccdf 1.2 namespace in openscap result file. (bsc#1059319) - Ensure correct ordering of patches. (bsc#1059801) - Fix create empty top.sls with no-op. (bsc#1053038) - Enabling certificate deployment for Leap 42.3 clients which is needed for bootstrapping. susemanager-sync-data: - Add SUSE Manager Server 3.0 and 3.1 channels for mirroring. - Support SLE-RT 12 SP3. (bsc#1063940) - Add SLE12 LTSS as extension to SLES for SAP 12. (bsc#1069615) - Support Open Enterprise Server 2018. (bsc#1060182) - Support SUSE Manager for Retail 3.1. (bsc#1052079) - Fix description for HA channel. (bsc#1063588) - Add support for CAASP. (bsc#1052283) - Add IBM DLPAR channels to SLES for SAP SPx ppc64le. (bsc#1068057) - Remove Certification Module 12 from SP2 and SP3. (bsc#1066819) virtual-host-gatherer: - Skip safely VMs which have no config attribute on VMware. (bsc#1066923) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Server 3.1: zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2017-2113=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Server 3.1 (ppc64le s390x x86_64): spacewalk-branding-2.7.2.10-2.9.2 susemanager-3.1.11-2.9.2 susemanager-tools-3.1.11-2.9.2 - SUSE Manager Server 3.1 (noarch): cobbler-2.6.6-5.6.2 nutch-1.0-0.9.3.2 osa-common-5.11.80.4-2.6.2 osa-dispatcher-5.11.80.4-2.6.2 spacecmd-2.7.8.8-2.9.2 spacewalk-backend-2.7.73.10-2.9.2 spacewalk-backend-app-2.7.73.10-2.9.2 spacewalk-backend-applet-2.7.73.10-2.9.2 spacewalk-backend-config-files-2.7.73.10-2.9.2 spacewalk-backend-config-files-common-2.7.73.10-2.9.2 spacewalk-backend-config-files-tool-2.7.73.10-2.9.2 spacewalk-backend-iss-2.7.73.10-2.9.2 spacewalk-backend-iss-export-2.7.73.10-2.9.2 spacewalk-backend-libs-2.7.73.10-2.9.2 spacewalk-backend-package-push-server-2.7.73.10-2.9.2 spacewalk-backend-server-2.7.73.10-2.9.2 spacewalk-backend-sql-2.7.73.10-2.9.2 spacewalk-backend-sql-oracle-2.7.73.10-2.9.2 spacewalk-backend-sql-postgresql-2.7.73.10-2.9.2 spacewalk-backend-tools-2.7.73.10-2.9.2 spacewalk-backend-xml-export-libs-2.7.73.10-2.9.2 spacewalk-backend-xmlrpc-2.7.73.10-2.9.2 spacewalk-base-2.7.1.13-2.9.2 spacewalk-base-minimal-2.7.1.13-2.9.2 spacewalk-base-minimal-config-2.7.1.13-2.9.2 spacewalk-certs-tools-2.7.0.8-2.6.2 spacewalk-html-2.7.1.13-2.9.2 spacewalk-java-2.7.46.8-2.9.2 spacewalk-java-config-2.7.46.8-2.9.2 spacewalk-java-lib-2.7.46.8-2.9.2 spacewalk-java-oracle-2.7.46.8-2.9.2 spacewalk-java-postgresql-2.7.46.8-2.9.2 spacewalk-reports-2.7.5.3-2.3.2 spacewalk-search-2.7.3.3-2.6.8 spacewalk-taskomatic-2.7.46.8-2.9.2 supportutils-plugin-susemanager-3.1.2-2.3.2 susemanager-advanced-topics_en-pdf-3.1-10.11.2 susemanager-best-practices_en-pdf-3.1-10.11.2 susemanager-docs_en-3.1-10.11.2 susemanager-getting-started_en-pdf-3.1-10.11.2 susemanager-jsp_en-3.1-10.11.2 susemanager-reference_en-pdf-3.1-10.11.2 susemanager-schema-3.1.13-2.11.2 susemanager-sls-3.1.13-2.11.1 susemanager-sync-data-3.1.9-2.11.1 virtual-host-gatherer-1.0.15-2.6.2 virtual-host-gatherer-Kubernetes-1.0.15-2.6.2 virtual-host-gatherer-VMware-1.0.15-2.6.2 References: https://bugzilla.suse.com/1019097 https://bugzilla.suse.com/1021432 https://bugzilla.suse.com/1025201 https://bugzilla.suse.com/1032065 https://bugzilla.suse.com/1032122 https://bugzilla.suse.com/1035955 https://bugzilla.suse.com/1036254 https://bugzilla.suse.com/1040420 https://bugzilla.suse.com/1041993 https://bugzilla.suse.com/1044719 https://bugzilla.suse.com/1045141 https://bugzilla.suse.com/1046679 https://bugzilla.suse.com/1048295 https://bugzilla.suse.com/1048326 https://bugzilla.suse.com/1048355 https://bugzilla.suse.com/1050433 https://bugzilla.suse.com/1052079 https://bugzilla.suse.com/1052283 https://bugzilla.suse.com/1052691 https://bugzilla.suse.com/1052728 https://bugzilla.suse.com/1053038 https://bugzilla.suse.com/1054044 https://bugzilla.suse.com/1054424 https://bugzilla.suse.com/1054902 https://bugzilla.suse.com/1055292 https://bugzilla.suse.com/1055467 https://bugzilla.suse.com/1055524 https://bugzilla.suse.com/1056188 https://bugzilla.suse.com/1056358 https://bugzilla.suse.com/1056868 https://bugzilla.suse.com/1056994 https://bugzilla.suse.com/1057084 https://bugzilla.suse.com/1057599 https://bugzilla.suse.com/1058110 https://bugzilla.suse.com/1058128 https://bugzilla.suse.com/1058323 https://bugzilla.suse.com/1058862 https://bugzilla.suse.com/1059201 https://bugzilla.suse.com/1059319 https://bugzilla.suse.com/1059388 https://bugzilla.suse.com/1059466 https://bugzilla.suse.com/1059524 https://bugzilla.suse.com/1059568 https://bugzilla.suse.com/1059576 https://bugzilla.suse.com/1059801 https://bugzilla.suse.com/1060022 https://bugzilla.suse.com/1060182 https://bugzilla.suse.com/1060389 https://bugzilla.suse.com/1060691 https://bugzilla.suse.com/1061245 https://bugzilla.suse.com/1061548 https://bugzilla.suse.com/1061563 https://bugzilla.suse.com/1061574 https://bugzilla.suse.com/1061576 https://bugzilla.suse.com/1061596 https://bugzilla.suse.com/1062094 https://bugzilla.suse.com/1062366 https://bugzilla.suse.com/1062476 https://bugzilla.suse.com/1062936 https://bugzilla.suse.com/1062972 https://bugzilla.suse.com/1063185 https://bugzilla.suse.com/1063419 https://bugzilla.suse.com/1063588 https://bugzilla.suse.com/1063590 https://bugzilla.suse.com/1063759 https://bugzilla.suse.com/1063822 https://bugzilla.suse.com/1063891 https://bugzilla.suse.com/1063940 https://bugzilla.suse.com/1064393 https://bugzilla.suse.com/1065216 https://bugzilla.suse.com/1065676 https://bugzilla.suse.com/1065844 https://bugzilla.suse.com/1066404 https://bugzilla.suse.com/1066641 https://bugzilla.suse.com/1066663 https://bugzilla.suse.com/1066819 https://bugzilla.suse.com/1066923 https://bugzilla.suse.com/1067509 https://bugzilla.suse.com/1068057 https://bugzilla.suse.com/1069461 https://bugzilla.suse.com/1069576 https://bugzilla.suse.com/1069615 https://bugzilla.suse.com/1070161 https://bugzilla.suse.com/1070979 https://bugzilla.suse.com/1072350 https://bugzilla.suse.com/970630 https://bugzilla.suse.com/971785 https://bugzilla.suse.com/971916 https://bugzilla.suse.com/989991 From sle-updates at lists.suse.com Wed Dec 20 10:25:26 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:25:26 +0100 (CET) Subject: SUSE-SU-2017:3380-1: moderate: Security update for Salt Message-ID: <20171220172526.9DABAFC9D@maintenance.suse.de> SUSE Security Update: Security update for Salt ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3380-1 Rating: moderate References: #1041993 #1042749 #1050003 #1059291 #1059758 #1060230 #1062462 #1062464 #985112 Cross-References: CVE-2017-14695 CVE-2017-14696 Affected Products: SUSE Manager Tools 12 SUSE Manager Server 3.1 SUSE Manager Server 3.0 SUSE Manager Proxy 3.1 SUSE Manager Proxy 3.0 SUSE Linux Enterprise Point of Sale 12-SP2 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Enterprise Storage 5 SUSE Enterprise Storage 4 SUSE Enterprise Storage 3 SUSE Container as a Service Platform ALL OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for salt fixes one security issue and bugs. The following security issues have been fixed: - CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. (bsc#1062462) - CVE-2017-14696: It was possible to force a remote Denial of Service with a specially crafted authentication request. (bsc#1062464) Additionally, the following non-security issues have been fixed: - Removed deprecation warning for beacon configuration using dictionaries. (bsc#1041993) - Fixed beacons failure when pillar-based suppressing config-based. (bsc#1060230) - Fixed minion resource exhaustion when many functions are being executed in parallel. (bsc#1059758) - Remove 'TasksTask' attribute from salt-master.service in older versions of systemd. (bsc#985112) - Fix for delete_deployment in Kubernetes module. (bsc#1059291) - Catching error when PIDfile cannot be deleted. (bsc#1050003) - Use $HOME to get the user home directory instead using '~' char. (bsc#1042749) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Tools 12: zypper in -t patch SUSE-SLE-Manager-Tools-12-2017-2111=1 - SUSE Manager Server 3.1: zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2017-2111=1 - SUSE Manager Server 3.0: zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2017-2111=1 - SUSE Manager Proxy 3.1: zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2017-2111=1 - SUSE Manager Proxy 3.0: zypper in -t patch SUSE-SUSE-Manager-Proxy-3.0-2017-2111=1 - SUSE Linux Enterprise Point of Sale 12-SP2: zypper in -t patch SUSE-SLE-POS-12-SP2-2017-2111=1 - SUSE Linux Enterprise Module for Advanced Systems Management 12: zypper in -t patch SUSE-SLE-Module-Adv-Systems-Management-12-2017-2111=1 - SUSE Enterprise Storage 5: zypper in -t patch SUSE-Storage-5-2017-2111=1 - SUSE Enterprise Storage 4: zypper in -t patch SUSE-Storage-4-2017-2111=1 - SUSE Enterprise Storage 3: zypper in -t patch SUSE-Storage-3-2017-2111=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2111=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2111=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Tools 12 (aarch64 ppc64le s390x x86_64): salt-2016.11.4-46.10.1 salt-doc-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 - SUSE Manager Server 3.1 (ppc64le s390x x86_64): salt-2016.11.4-46.10.1 salt-api-2016.11.4-46.10.1 salt-cloud-2016.11.4-46.10.1 salt-doc-2016.11.4-46.10.1 salt-master-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 salt-proxy-2016.11.4-46.10.1 salt-ssh-2016.11.4-46.10.1 salt-syndic-2016.11.4-46.10.1 - SUSE Manager Server 3.1 (noarch): salt-bash-completion-2016.11.4-46.10.1 salt-zsh-completion-2016.11.4-46.10.1 - SUSE Manager Server 3.0 (s390x x86_64): salt-2016.11.4-46.10.1 salt-api-2016.11.4-46.10.1 salt-doc-2016.11.4-46.10.1 salt-master-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 salt-proxy-2016.11.4-46.10.1 salt-ssh-2016.11.4-46.10.1 salt-syndic-2016.11.4-46.10.1 - SUSE Manager Server 3.0 (noarch): salt-bash-completion-2016.11.4-46.10.1 salt-zsh-completion-2016.11.4-46.10.1 - SUSE Manager Proxy 3.1 (ppc64le x86_64): salt-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 - SUSE Manager Proxy 3.0 (noarch): salt-bash-completion-2016.11.4-46.10.1 salt-zsh-completion-2016.11.4-46.10.1 - SUSE Manager Proxy 3.0 (x86_64): salt-2016.11.4-46.10.1 salt-api-2016.11.4-46.10.1 salt-doc-2016.11.4-46.10.1 salt-master-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 salt-proxy-2016.11.4-46.10.1 salt-ssh-2016.11.4-46.10.1 salt-syndic-2016.11.4-46.10.1 - SUSE Linux Enterprise Point of Sale 12-SP2 (x86_64): salt-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 - SUSE Linux Enterprise Module for Advanced Systems Management 12 (ppc64le s390x x86_64): salt-2016.11.4-46.10.1 salt-api-2016.11.4-46.10.1 salt-cloud-2016.11.4-46.10.1 salt-doc-2016.11.4-46.10.1 salt-master-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 salt-proxy-2016.11.4-46.10.1 salt-ssh-2016.11.4-46.10.1 salt-syndic-2016.11.4-46.10.1 - SUSE Linux Enterprise Module for Advanced Systems Management 12 (noarch): salt-bash-completion-2016.11.4-46.10.1 salt-zsh-completion-2016.11.4-46.10.1 - SUSE Enterprise Storage 5 (aarch64 x86_64): salt-2016.11.4-46.10.1 salt-api-2016.11.4-46.10.1 salt-master-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 - SUSE Enterprise Storage 4 (aarch64 x86_64): salt-2016.11.4-46.10.1 salt-master-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 - SUSE Enterprise Storage 3 (aarch64 x86_64): salt-2016.11.4-46.10.1 salt-master-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 - SUSE Container as a Service Platform ALL (x86_64): salt-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): salt-2016.11.4-46.10.1 salt-minion-2016.11.4-46.10.1 References: https://www.suse.com/security/cve/CVE-2017-14695.html https://www.suse.com/security/cve/CVE-2017-14696.html https://bugzilla.suse.com/1041993 https://bugzilla.suse.com/1042749 https://bugzilla.suse.com/1050003 https://bugzilla.suse.com/1059291 https://bugzilla.suse.com/1059758 https://bugzilla.suse.com/1060230 https://bugzilla.suse.com/1062462 https://bugzilla.suse.com/1062464 https://bugzilla.suse.com/985112 From sle-updates at lists.suse.com Wed Dec 20 10:27:04 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:27:04 +0100 (CET) Subject: SUSE-SU-2017:3381-1: moderate: Security update for Salt Message-ID: <20171220172704.BEE22FC9D@maintenance.suse.de> SUSE Security Update: Security update for Salt ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3381-1 Rating: moderate References: #1041993 #1042749 #1050003 #1059291 #1059758 #1060230 #1062462 #1062464 #985112 Cross-References: CVE-2017-14695 CVE-2017-14696 Affected Products: SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for salt fixes one security issue and bugs. The following security issues have been fixed: - CVE-2017-14695: A directory traversal vulnerability in minion id validation allowed remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. (bsc#1062462) - CVE-2017-14696: It was possible to force a remote Denial of Service with a specially crafted authentication request. (bsc#1062464) Additionally, the following non-security issues have been fixed: - Removed deprecation warning for beacon configuration using dictionaries. (bsc#1041993) - Fixed beacons failure when pillar-based suppressing config-based. (bsc#1060230) - Fixed minion resource exhaustion when many functions are being executed in parallel. (bsc#1059758) - Remove 'TasksTask' attribute from salt-master.service in older versions of systemd. (bsc#985112) - Fix for delete_deployment in Kubernetes module. (bsc#1059291) - Catching error when PIDfile cannot be deleted. (bsc#1050003) - Use $HOME to get the user home directory instead using '~' char. (bsc#1042749) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS: zypper in -t patch slesctsp4-salt-13382=1 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS: zypper in -t patch slesctsp3-salt-13382=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): salt-2016.11.4-43.10.2 salt-doc-2016.11.4-43.10.2 salt-minion-2016.11.4-43.10.2 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): salt-2016.11.4-43.10.2 salt-doc-2016.11.4-43.10.2 salt-minion-2016.11.4-43.10.2 References: https://www.suse.com/security/cve/CVE-2017-14695.html https://www.suse.com/security/cve/CVE-2017-14696.html https://bugzilla.suse.com/1041993 https://bugzilla.suse.com/1042749 https://bugzilla.suse.com/1050003 https://bugzilla.suse.com/1059291 https://bugzilla.suse.com/1059758 https://bugzilla.suse.com/1060230 https://bugzilla.suse.com/1062462 https://bugzilla.suse.com/1062464 https://bugzilla.suse.com/985112 From sle-updates at lists.suse.com Wed Dec 20 10:28:35 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:28:35 +0100 (CET) Subject: SUSE-RU-2017:3382-1: moderate: Recommended update for cobbler Message-ID: <20171220172835.8FA2DFC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for cobbler ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3382-1 Rating: moderate References: #1046679 Affected Products: SUSE Manager Tools 12 SUSE Manager Server 3.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cobbler fixes the following issues: - Fix koan wait parameter initialization. - Fix setup.py to identify SUSE OS correctly. (bsc#1046679) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Tools 12: zypper in -t patch SUSE-SLE-Manager-Tools-12-2017-2118=1 - SUSE Manager Server 3.0: zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2017-2118=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Tools 12 (noarch): koan-2.6.6-49.6.1 - SUSE Manager Server 3.0 (noarch): cobbler-2.6.6-49.6.1 References: https://bugzilla.suse.com/1046679 From sle-updates at lists.suse.com Wed Dec 20 10:29:02 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:29:02 +0100 (CET) Subject: SUSE-RU-2017:3383-1: Recommended update for the SUSE Manager Server and Proxy 3.1 release notes Message-ID: <20171220172902.BFB47FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for the SUSE Manager Server and Proxy 3.1 release notes ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3383-1 Rating: low References: #1052079 #1052283 #1054902 #1060182 #1062366 #1068057 #1069461 #1069576 Affected Products: SUSE Manager Server 3.1 SUSE Manager Proxy 3.1 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: SUSE Manager 3.1 Release Notes have been updated to document: - New features: + Check for duplicate minion_ids. + Minion configuration channels. + Minion power management. + Documentation improvements. + Database cleanup migration. - New products supported + Open Enterprise Server (OES) 2018. + SUSE Manager for Retail 3.1. + SUSE CaaS Platform - channels only, no update management. + IBM DLPAR channels for SAP SPx ppc64le. - SUSE Manager Server bugs fixed by latest updates: + bsc#970630, bsc#971785, bsc#971916, bsc#989991, bsc#1009118, bsc#1019097, bsc#1021432, bsc#1025201, bsc#1032065, bsc#1032122, bsc#1035955, bsc#1036254, bsc#1040420, bsc#1041993, bsc#1042975, bsc#1044719, bsc#1045141, bsc#1045981, bsc#1048295, bsc#1048326, bsc#1048355, bsc#1049425, bsc#1050433, bsc#1052079, bsc#1052283, bsc#1052691, bsc#1052728, bsc#1053038, bsc#1054044, bsc#1054424, bsc#1054902, bsc#1055292, bsc#1055467, bsc#1055524, bsc#1056188, bsc#1056868, bsc#1056994, bsc#1057084, bsc#1057599, bsc#1058110, bsc#1058128, bsc#1058323, bsc#1058862, bsc#1059201, bsc#1059319, bsc#1059388, bsc#1059466, bsc#1059524, bsc#1059576, bsc#1059801, bsc#1060022, bsc#1060182, bsc#1060389, bsc#1060691, bsc#1061245, bsc#1061548, bsc#1061563, bsc#1061574, bsc#1061576, bsc#1061596, bsc#1062094, bsc#1062366, bsc#1062476, bsc#1062936, bsc#1062972, bsc#1063185, bsc#1063419, bsc#1063588, bsc#1063590, bsc#1063759, bsc#1063805, bsc#1063822, bsc#1063891, bsc#1064393, bsc#1065216, bsc#1065676, bsc#1065844, bsc#1066641, bsc#1066663, bsc#1066819, bsc#1066923, bsc#1067509, bsc#1068057, bsc#1069461, bsc#1069576, bsc#1070161 - SUSE Manager Proxy bugs fixed by latest updates: + bsc#971785, bsc#1025201, bsc#1036254, bsc#1050433, bsc#1054424, bsc#1055292, bsc#1057542, bsc#1057599, bsc#1058128, bsc#1058323, bsc#1059998, bsc#1060022, bsc#1060182, bsc#1061245, bsc#1061563, bsc#1061596, bsc#1062972, bsc#1063419, bsc#1063805, bsc#1064393, bsc#1067509 - SUSE Manager Client Tools bugs fixed by latest updates: + bsc#1025201, bsc#1044719, bsc#1050433, bsc#1055292, bsc#1059319, bsc#1060022, bsc#1060182, bsc#1063419, bsc#1063805, bsc#1064393, bsc#1067509 - Salt bugs fixed by latest updates: + bsc#985112, bsc#1041993, bsc#1042749, bsc#1050003, bsc#1053955, bsc#1059291, bsc#1059758, bsc#1060230, bsc#1062462 Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Server 3.1: zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2017-2110=1 - SUSE Manager Proxy 3.1: zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2017-2110=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Server 3.1 (ppc64le s390x x86_64): release-notes-susemanager-3.1.3-5.15.1 - SUSE Manager Proxy 3.1 (ppc64le x86_64): release-notes-susemanager-proxy-3.1.3-0.15.9.2 References: https://bugzilla.suse.com/1052079 https://bugzilla.suse.com/1052283 https://bugzilla.suse.com/1054902 https://bugzilla.suse.com/1060182 https://bugzilla.suse.com/1062366 https://bugzilla.suse.com/1068057 https://bugzilla.suse.com/1069461 https://bugzilla.suse.com/1069576 From sle-updates at lists.suse.com Wed Dec 20 10:30:20 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:30:20 +0100 (CET) Subject: SUSE-RU-2017:3384-1: moderate: Recommended update for SUSE Manager Client Tools for SLE 11 Message-ID: <20171220173020.B4821FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for SUSE Manager Client Tools for SLE 11 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3384-1 Rating: moderate References: #1025201 #1050433 #1055292 #1059319 #1060022 #1060182 #1063419 #1063805 #1064393 #1067509 Affected Products: SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update fixes the following issues with the SUSE Manager Client Tools for SLE 11: osad: - Fixed TypeError for force flag in setup_config that could happen when jabberd restart was needed. (bsc#1064393) spacewalk-backend: - Fix issues with syncing .deb repositories. (bsc#1050433) - Honor MAX_LOG_AGE for (renamed) cobbler/tasks logs file in spacewalk-debug. (bsc#1025201) - Add hostname to duplicate machine_id email. (bsc#1055292) - Don't crash when token is set to 'fake'. (bsc#1060022) - When searching for not installed products exclude release packages which are provided by others. (bsc#1067509) - Search for product packages when installed packages are available. (bsc#1060182) - RhnServerNetwork refactoring. (bsc#1063419) spacewalk-oscap: - Support xccdf 1.2 namespace in openscap result file. (bsc#1059319) supportutils-plugin-salt: - Collect local grains on Salt systems. - Added saltlogfiles to plugin list, so that salt logs are also included. (bsc#1063805) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS: zypper in -t patch slesctsp4-clienttools-201711-13379=1 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS: zypper in -t patch slesctsp3-clienttools-201711-13379=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): spacecmd-2.7.8.8-18.11.2 spacewalk-backend-libs-2.7.73.10-28.10.2 - SUSE Linux Enterprise Server 11-SP4-CLIENT-TOOLS (noarch): osa-common-5.11.80.4-9.6.2 osad-5.11.80.4-9.6.2 spacewalk-oscap-2.7.0.4-6.3.2 supportutils-plugin-salt-1.1.3-6.8.2 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (i586 ia64 ppc64 s390x x86_64): spacecmd-2.7.8.8-18.11.2 spacewalk-backend-libs-2.7.73.10-28.10.2 - SUSE Linux Enterprise Server 11-SP3-CLIENT-TOOLS (noarch): osa-common-5.11.80.4-9.6.2 osad-5.11.80.4-9.6.2 spacewalk-oscap-2.7.0.4-6.3.2 supportutils-plugin-salt-1.1.3-6.8.2 References: https://bugzilla.suse.com/1025201 https://bugzilla.suse.com/1050433 https://bugzilla.suse.com/1055292 https://bugzilla.suse.com/1059319 https://bugzilla.suse.com/1060022 https://bugzilla.suse.com/1060182 https://bugzilla.suse.com/1063419 https://bugzilla.suse.com/1063805 https://bugzilla.suse.com/1064393 https://bugzilla.suse.com/1067509 From sle-updates at lists.suse.com Wed Dec 20 10:31:58 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:31:58 +0100 (CET) Subject: SUSE-RU-2017:3385-1: moderate: Recommended update for SUSE Manager Proxy 3.1 Message-ID: <20171220173158.2F6B6FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for SUSE Manager Proxy 3.1 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3385-1 Rating: moderate References: #1025201 #1036254 #1050433 #1054424 #1055292 #1057542 #1057599 #1058128 #1058323 #1059998 #1060022 #1060182 #1061245 #1061563 #1061596 #1062972 #1063419 #1064393 #1067509 #971785 Affected Products: SUSE Manager Proxy 3.1 ______________________________________________________________________________ An update that has 20 recommended fixes can now be installed. Description: This update fixes the following issues: osad: - Fixed TypeError for force flag in setup_config that could happen when jabberd restart was needed. (bsc#1064393) spacewalk-backend: - Fix issues with syncing .deb repositories. (bsc#1050433) - Honor MAX_LOG_AGE for (renamed) cobbler/tasks logs file in spacewalk-debug. (bsc#1025201) - Add hostname to duplicate machine_id email. (bsc#1055292) - Fix link to manual and the described procedure. - Don't crash when token is set to 'fake'. (bsc#1060022) - When searching for not installed products exclude release packages which are provided by others. (bsc#1067509) - Search for product packages when installed packages are available. (bsc#1060182) - RhnServerNetwork refactoring. (bsc#1063419) spacewalk-certs-tools: - Add comment to explain that FULLY_UPDATE_THIS_BOX gets ignored on salt minions. (bsc#1036254) - Do not use registration keys from last autoinstallation. (bsc#1057599) spacewalk-proxy: - Try to resolve the proxy hostname even if the HTTP 'Host' header is an ip address. (bsc#1057542) spacewalk-proxy-installer: - More exact question for custom certificate and key. (bsc#1059998) spacewalk-web: - Disallow entering multiple identical mirror credentials. (bsc#971785) - Fix runtime data display in Images page. (bsc#1062972) - Add delete button to img-overview page. (bsc#1061245) - Update wording for image profiles in image build page. (bsc#1058323) - Rename 'Refresh Data' button in VHM details page. - Update browser URL correctly after deleting a VHM from the details page. (bsc#1061596) - Show 'Nodes' list only for Kubernetes VHMs. (bsc#1061563) - Remove import button from image over page. (bsc#1058128) - Use the same datetime format as the rest of the product. (bsc#1054424) zypp-plugin-spacewalk: - Python3 compatibility. - Build python2/python3 subpackages. - Build as noarch for SLES12 and higher. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Proxy 3.1: zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2017-2113=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Proxy 3.1 (noarch): osa-common-5.11.80.4-2.6.2 osad-5.11.80.4-2.6.2 spacewalk-backend-2.7.73.10-2.9.2 spacewalk-backend-libs-2.7.73.10-2.9.2 spacewalk-base-minimal-2.7.1.13-2.9.2 spacewalk-base-minimal-config-2.7.1.13-2.9.2 spacewalk-certs-tools-2.7.0.8-2.6.2 spacewalk-proxy-broker-2.7.1.5-2.6.2 spacewalk-proxy-common-2.7.1.5-2.6.2 spacewalk-proxy-installer-2.7.2.4-2.3.2 spacewalk-proxy-management-2.7.1.5-2.6.2 spacewalk-proxy-package-manager-2.7.1.5-2.6.2 spacewalk-proxy-redirect-2.7.1.5-2.6.2 spacewalk-proxy-salt-2.7.1.5-2.6.2 zypp-plugin-spacewalk-1.0.0-2.6.2 References: https://bugzilla.suse.com/1025201 https://bugzilla.suse.com/1036254 https://bugzilla.suse.com/1050433 https://bugzilla.suse.com/1054424 https://bugzilla.suse.com/1055292 https://bugzilla.suse.com/1057542 https://bugzilla.suse.com/1057599 https://bugzilla.suse.com/1058128 https://bugzilla.suse.com/1058323 https://bugzilla.suse.com/1059998 https://bugzilla.suse.com/1060022 https://bugzilla.suse.com/1060182 https://bugzilla.suse.com/1061245 https://bugzilla.suse.com/1061563 https://bugzilla.suse.com/1061596 https://bugzilla.suse.com/1062972 https://bugzilla.suse.com/1063419 https://bugzilla.suse.com/1064393 https://bugzilla.suse.com/1067509 https://bugzilla.suse.com/971785 From sle-updates at lists.suse.com Wed Dec 20 10:34:41 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:34:41 +0100 (CET) Subject: SUSE-RU-2017:3386-1: moderate: Recommended update for SUSE Manager Client Tools for SLE 12 Message-ID: <20171220173441.7D57FFC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for SUSE Manager Client Tools for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3386-1 Rating: moderate References: #1025201 #1050433 #1055292 #1059319 #1060022 #1060182 #1063419 #1064393 #1067509 Affected Products: SUSE Manager Tools 12 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. Description: This update fixes the following issues with the SUSE Manager Client Tools for SLE 12: osad: - Fixed TypeError for force flag in setup_config that could happen when jabberd restart was needed. (bsc#1064393) spacewalk-backend: - Fix issues with syncing .deb repositories. (bsc#1050433) - Honor MAX_LOG_AGE for (renamed) cobbler/tasks logs file in spacewalk-debug. (bsc#1025201) - Add hostname to duplicate machine_id email. (bsc#1055292) - Fix link to manual and the described procedure. - Don't crash when token is set to 'fake'. (bsc#1060022) - When searching for not installed products exclude release packages which are provided by others. (bsc#1067509) - Search for product packages when installed packages are available. (bsc#1060182) - RhnServerNetwork refactoring. (bsc#1063419) spacewalk-oscap: - Support xccdf 1.2 namespace in openscap result file (bsc#1059319) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Tools 12: zypper in -t patch SUSE-SLE-Manager-Tools-12-2017-2112=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Tools 12 (noarch): osa-common-5.11.80.4-31.6.1 osad-5.11.80.4-31.6.1 spacecmd-2.7.8.8-38.9.1 spacewalk-backend-libs-2.7.73.10-55.9.1 spacewalk-oscap-2.7.0.4-19.3.1 References: https://bugzilla.suse.com/1025201 https://bugzilla.suse.com/1050433 https://bugzilla.suse.com/1055292 https://bugzilla.suse.com/1059319 https://bugzilla.suse.com/1060022 https://bugzilla.suse.com/1060182 https://bugzilla.suse.com/1063419 https://bugzilla.suse.com/1064393 https://bugzilla.suse.com/1067509 From sle-updates at lists.suse.com Wed Dec 20 10:36:07 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:36:07 +0100 (CET) Subject: SUSE-RU-2017:3387-1: moderate: Recommended update for supportutils-plugin-salt Message-ID: <20171220173607.88155FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for supportutils-plugin-salt ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3387-1 Rating: moderate References: #1063805 Affected Products: SUSE Manager Tools 12 SUSE Manager Server 3.1 SUSE Manager Server 3.0 SUSE Manager Proxy 3.1 SUSE Manager Proxy 3.0 SUSE Enterprise Storage 5 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with supportutils-plugin-salt: - Collect local grains on Salt systems. - Added saltlogfiles to plugin list, so that salt logs are also included. (bsc#1063805) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Tools 12: zypper in -t patch SUSE-SLE-Manager-Tools-12-2017-2117=1 - SUSE Manager Server 3.1: zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2017-2117=1 - SUSE Manager Server 3.0: zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2017-2117=1 - SUSE Manager Proxy 3.1: zypper in -t patch SUSE-SUSE-Manager-Proxy-3.1-2017-2117=1 - SUSE Manager Proxy 3.0: zypper in -t patch SUSE-SUSE-Manager-Proxy-3.0-2017-2117=1 - SUSE Enterprise Storage 5: zypper in -t patch SUSE-Storage-5-2017-2117=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Tools 12 (noarch): supportutils-plugin-salt-1.1.3-6.6.1 - SUSE Manager Server 3.1 (noarch): supportutils-plugin-salt-1.1.3-6.6.1 - SUSE Manager Server 3.0 (noarch): supportutils-plugin-salt-1.1.3-6.6.1 - SUSE Manager Proxy 3.1 (noarch): supportutils-plugin-salt-1.1.3-6.6.1 - SUSE Manager Proxy 3.0 (noarch): supportutils-plugin-salt-1.1.3-6.6.1 - SUSE Enterprise Storage 5 (noarch): supportutils-plugin-salt-1.1.3-6.6.1 References: https://bugzilla.suse.com/1063805 From sle-updates at lists.suse.com Wed Dec 20 10:36:36 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 18:36:36 +0100 (CET) Subject: SUSE-SU-2017:3388-1: important: Security update for ImageMagick Message-ID: <20171220173636.BABECFC9D@maintenance.suse.de> SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3388-1 Rating: important References: #1048457 #1049796 #1050083 #1050116 #1050139 #1050632 #1051441 #1051847 #1052450 #1052553 #1052689 #1052744 #1052758 #1052764 #1054757 #1055214 #1056432 #1057157 #1057719 #1057729 #1057730 #1058485 #1058637 #1059666 #1059778 #1060176 #1060577 #1061254 #1062750 #1066003 #1067181 #1067184 #1067409 Cross-References: CVE-2017-11188 CVE-2017-11478 CVE-2017-11523 CVE-2017-11527 CVE-2017-11535 CVE-2017-11640 CVE-2017-11752 CVE-2017-12140 CVE-2017-12435 CVE-2017-12587 CVE-2017-12644 CVE-2017-12662 CVE-2017-12669 CVE-2017-12983 CVE-2017-13134 CVE-2017-13769 CVE-2017-14138 CVE-2017-14172 CVE-2017-14173 CVE-2017-14175 CVE-2017-14341 CVE-2017-14342 CVE-2017-14531 CVE-2017-14607 CVE-2017-14682 CVE-2017-14733 CVE-2017-14989 CVE-2017-15217 CVE-2017-15930 CVE-2017-16545 CVE-2017-16546 CVE-2017-16669 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves 32 vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: * CVE-2017-14989: use-after-free in RenderFreetype in MagickCore/annotate.c could lead to denial of service [bsc#1061254] * CVE-2017-14682: GetNextToken in MagickCore/token.c heap buffer overflow could lead to denial of service [bsc#1060176] * Memory leak in WriteINLINEImage in coders/inline.c could lead to denial of service [bsc#1052744] * CVE-2017-14607: out of bounds read flaw related to ReadTIFFImagehas could possibly disclose potentially sensitive memory [bsc#1059778] * CVE-2017-11640: NULL pointer deref in WritePTIFImage() in coders/tiff.c [bsc#1050632] * CVE-2017-14342: a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1058485] * CVE-2017-14341: Infinite loop in the ReadWPGImage function [bsc#1058637] * CVE-2017-16546: problem in the function ReadWPGImage in coders/wpg.c could lead to denial of service [bsc#1067181] * CVE-2017-16545: The ReadWPGImage function in coders/wpg.c in validation problems could lead to denial of service [bsc#1067184] * CVE-2017-16669: problem in coders/wpg.c could allow remote attackers to cause a denial of service via crafted file [bsc#1067409] * CVE-2017-14175: Lack of End of File check could lead to denial of service [bsc#1057719] * CVE-2017-14138: memory leak vulnerability in ReadWEBPImage in coders/webp.c could lead to denial of service [bsc#1057157] * CVE-2017-13769: denial of service issue in function WriteTHUMBNAILImage in coders/thumbnail.c [bsc#1056432] * CVE-2017-13134: a heap-based buffer over-read was found in thefunction SFWScan in coders/sfw.c, which allows attackers to cause adenial of service via a crafted file. [bsc#1055214] * CVE-2017-15217: memory leak in ReadSGIImage in coders/sgi.c [bsc#1062750] * CVE-2017-11478: ReadOneDJVUImage in coders/djvu.c in ImageMagick allows remote attackers to cause a DoS [bsc#1049796] * CVE-2017-15930: Null Pointer dereference while transfering JPEG scanlines could lead to denial of service [bsc#1066003] * CVE-2017-12983: Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c inImageMagick 7.0.6-8 allows remote attackers to cause a denial of service [bsc#1054757] * CVE-2017-14531: memory exhaustion issue in ReadSUNImage incoders/sun.c. [bsc#1059666] * CVE-2017-12435: Memory exhaustion in ReadSUNImage in coders/sun.c, which allows attackers to cause denial of service [bsc#1052553] * CVE-2017-12587: User controlable large loop in the ReadPWPImage in coders\pwp.c could lead to denial of service [bsc#1052450] * CVE-2017-11523: ReadTXTImage in coders/txt.c allows remote attackers to cause a denial of service [bsc#1050083] * CVE-2017-14173: unction ReadTXTImage is vulnerable to a integer overflow that could lead to denial of service [bsc#1057729] * CVE-2017-11188: ImageMagick: The ReadDPXImage function in codersdpx.c in ImageMagick 7.0.6-0 has a largeloop vulnerability that can cause CPU exhaustion via a crafted DPX file, relatedto lack of an EOF check. [bnc#1048457] * CVE-2017-11527: ImageMagick: ReadDPXImage in coders/dpx.c allows remote attackers to cause DoS [bnc#1050116] * CVE-2017-11535: GraphicsMagick, ImageMagick: Heap-based buffer over-read in WritePSImage() in coders/ps.c [bnc#1050139] * CVE-2017-11752: ImageMagick: ReadMAGICKImage in coders/magick.c allows to cause DoS [bnc#1051441] * CVE-2017-12140: ImageMagick: ReadDCMImage in codersdcm.c has a ninteger signedness error leading to excessive memory consumption [bnc#1051847] * CVE-2017-12669: ImageMagick: Memory leak in WriteCALSImage in coders/cals.c [bnc#1052689] * CVE-2017-12662: GraphicsMagick, ImageMagick: Memory leak in WritePDFImage in coders/pdf.c [bnc#1052758] * CVE-2017-12644: ImageMagick: Memory leak in ReadDCMImage in codersdcm.c [bnc#1052764] * CVE-2017-14172: ImageMagick: Lack of end of file check in ReadPSImage() could lead to a denial of service [bnc#1057730] * CVE-2017-14733: GraphicsMagick: Heap overflow on ReadRLEImage in coders/rle.c could lead to denial of service [bnc#1060577] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2123=1 - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-2123=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2123=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2123=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2123=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2123=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2123=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2123=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2123=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): ImageMagick-6.8.8.1-71.17.1 ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 libMagick++-6_Q16-3-6.8.8.1-71.17.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1 - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): ImageMagick-6.8.8.1-71.17.1 ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 libMagick++-6_Q16-3-6.8.8.1-71.17.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): ImageMagick-6.8.8.1-71.17.1 ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 ImageMagick-devel-6.8.8.1-71.17.1 libMagick++-6_Q16-3-6.8.8.1-71.17.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1 libMagick++-devel-6.8.8.1-71.17.1 perl-PerlMagick-6.8.8.1-71.17.1 perl-PerlMagick-debuginfo-6.8.8.1-71.17.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): ImageMagick-6.8.8.1-71.17.1 ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 ImageMagick-devel-6.8.8.1-71.17.1 libMagick++-6_Q16-3-6.8.8.1-71.17.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1 libMagick++-devel-6.8.8.1-71.17.1 perl-PerlMagick-6.8.8.1-71.17.1 perl-PerlMagick-debuginfo-6.8.8.1-71.17.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): ImageMagick-6.8.8.1-71.17.1 ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 libMagick++-6_Q16-3-6.8.8.1-71.17.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): ImageMagick-6.8.8.1-71.17.1 ImageMagick-debuginfo-6.8.8.1-71.17.1 ImageMagick-debugsource-6.8.8.1-71.17.1 libMagick++-6_Q16-3-6.8.8.1-71.17.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.17.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-6.8.8.1-71.17.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.17.1 References: https://www.suse.com/security/cve/CVE-2017-11188.html https://www.suse.com/security/cve/CVE-2017-11478.html https://www.suse.com/security/cve/CVE-2017-11523.html https://www.suse.com/security/cve/CVE-2017-11527.html https://www.suse.com/security/cve/CVE-2017-11535.html https://www.suse.com/security/cve/CVE-2017-11640.html https://www.suse.com/security/cve/CVE-2017-11752.html https://www.suse.com/security/cve/CVE-2017-12140.html https://www.suse.com/security/cve/CVE-2017-12435.html https://www.suse.com/security/cve/CVE-2017-12587.html https://www.suse.com/security/cve/CVE-2017-12644.html https://www.suse.com/security/cve/CVE-2017-12662.html https://www.suse.com/security/cve/CVE-2017-12669.html https://www.suse.com/security/cve/CVE-2017-12983.html https://www.suse.com/security/cve/CVE-2017-13134.html https://www.suse.com/security/cve/CVE-2017-13769.html https://www.suse.com/security/cve/CVE-2017-14138.html https://www.suse.com/security/cve/CVE-2017-14172.html https://www.suse.com/security/cve/CVE-2017-14173.html https://www.suse.com/security/cve/CVE-2017-14175.html https://www.suse.com/security/cve/CVE-2017-14341.html https://www.suse.com/security/cve/CVE-2017-14342.html https://www.suse.com/security/cve/CVE-2017-14531.html https://www.suse.com/security/cve/CVE-2017-14607.html https://www.suse.com/security/cve/CVE-2017-14682.html https://www.suse.com/security/cve/CVE-2017-14733.html https://www.suse.com/security/cve/CVE-2017-14989.html https://www.suse.com/security/cve/CVE-2017-15217.html https://www.suse.com/security/cve/CVE-2017-15930.html https://www.suse.com/security/cve/CVE-2017-16545.html https://www.suse.com/security/cve/CVE-2017-16546.html https://www.suse.com/security/cve/CVE-2017-16669.html https://bugzilla.suse.com/1048457 https://bugzilla.suse.com/1049796 https://bugzilla.suse.com/1050083 https://bugzilla.suse.com/1050116 https://bugzilla.suse.com/1050139 https://bugzilla.suse.com/1050632 https://bugzilla.suse.com/1051441 https://bugzilla.suse.com/1051847 https://bugzilla.suse.com/1052450 https://bugzilla.suse.com/1052553 https://bugzilla.suse.com/1052689 https://bugzilla.suse.com/1052744 https://bugzilla.suse.com/1052758 https://bugzilla.suse.com/1052764 https://bugzilla.suse.com/1054757 https://bugzilla.suse.com/1055214 https://bugzilla.suse.com/1056432 https://bugzilla.suse.com/1057157 https://bugzilla.suse.com/1057719 https://bugzilla.suse.com/1057729 https://bugzilla.suse.com/1057730 https://bugzilla.suse.com/1058485 https://bugzilla.suse.com/1058637 https://bugzilla.suse.com/1059666 https://bugzilla.suse.com/1059778 https://bugzilla.suse.com/1060176 https://bugzilla.suse.com/1060577 https://bugzilla.suse.com/1061254 https://bugzilla.suse.com/1062750 https://bugzilla.suse.com/1066003 https://bugzilla.suse.com/1067181 https://bugzilla.suse.com/1067184 https://bugzilla.suse.com/1067409 From sle-updates at lists.suse.com Wed Dec 20 13:08:11 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 21:08:11 +0100 (CET) Subject: SUSE-SU-2017:3389-1: moderate: Security update for xstream Message-ID: <20171220200811.C783EF7B6@maintenance.suse.de> SUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3389-1 Rating: moderate References: #1070731 Cross-References: CVE-2017-7957 Affected Products: SUSE Manager Server 3.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xstream fixes the following issues: - CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Server 3.0: zypper in -t patch SUSE-SUSE-Manager-Server-3.0-2017-2124=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Server 3.0 (noarch): xstream-1.4.9-4.3.1 References: https://www.suse.com/security/cve/CVE-2017-7957.html https://bugzilla.suse.com/1070731 From sle-updates at lists.suse.com Wed Dec 20 13:08:37 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Wed, 20 Dec 2017 21:08:37 +0100 (CET) Subject: SUSE-SU-2017:3390-1: moderate: Security update for xstream Message-ID: <20171220200837.B287BFC9D@maintenance.suse.de> SUSE Security Update: Security update for xstream ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3390-1 Rating: moderate References: #1070731 Cross-References: CVE-2017-7957 Affected Products: SUSE Manager Server 3.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xstream fixes the following issues: - CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Server 3.1: zypper in -t patch SUSE-SUSE-Manager-Server-3.1-2017-2125=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Server 3.1 (noarch): xstream-1.4.9-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-7957.html https://bugzilla.suse.com/1070731 From sle-updates at lists.suse.com Thu Dec 21 04:09:26 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 12:09:26 +0100 (CET) Subject: SUSE-SU-2017:3391-1: moderate: Security update for postgresql96 Message-ID: <20171221110926.EC00AF7B6@maintenance.suse.de> SUSE Security Update: Security update for postgresql96 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3391-1 Rating: moderate References: #1067841 #1067844 Cross-References: CVE-2017-15098 CVE-2017-15099 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for postgresql96 fixes the following issues: Security issues fixed: - CVE-2017-15098: Fix crash due to rowtype mismatch in json{b}_populate_recordset() (bsc#1067844). - CVE-2017-15099: Ensure that INSERT ... ON CONFLICT DO UPDATE checks table permissions and RLS policies in all cases (bsc#1067841). Bug fixes: - Update to version 9.6.6: * https://www.postgresql.org/docs/9.6/static/release-9-6-6.html * https://www.postgresql.org/docs/9.6/static/release-9-6-5.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2127=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2127=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2127=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2127=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2127=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2127=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2127=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): postgresql96-devel-9.6.6-3.10.1 postgresql96-devel-debuginfo-9.6.6-3.10.1 postgresql96-libs-debugsource-9.6.6-3.10.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): postgresql96-devel-9.6.6-3.10.1 postgresql96-devel-debuginfo-9.6.6-3.10.1 postgresql96-libs-debugsource-9.6.6-3.10.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libecpg6-9.6.6-3.10.1 libecpg6-debuginfo-9.6.6-3.10.1 libpq5-9.6.6-3.10.1 libpq5-debuginfo-9.6.6-3.10.1 postgresql96-9.6.6-3.10.1 postgresql96-contrib-9.6.6-3.10.1 postgresql96-contrib-debuginfo-9.6.6-3.10.1 postgresql96-debuginfo-9.6.6-3.10.1 postgresql96-debugsource-9.6.6-3.10.1 postgresql96-libs-debugsource-9.6.6-3.10.1 postgresql96-server-9.6.6-3.10.1 postgresql96-server-debuginfo-9.6.6-3.10.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): postgresql96-docs-9.6.6-3.10.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libecpg6-9.6.6-3.10.1 libecpg6-debuginfo-9.6.6-3.10.1 libpq5-9.6.6-3.10.1 libpq5-debuginfo-9.6.6-3.10.1 postgresql96-9.6.6-3.10.1 postgresql96-contrib-9.6.6-3.10.1 postgresql96-contrib-debuginfo-9.6.6-3.10.1 postgresql96-debuginfo-9.6.6-3.10.1 postgresql96-debugsource-9.6.6-3.10.1 postgresql96-libs-debugsource-9.6.6-3.10.1 postgresql96-server-9.6.6-3.10.1 postgresql96-server-debuginfo-9.6.6-3.10.1 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libpq5-32bit-9.6.6-3.10.1 libpq5-debuginfo-32bit-9.6.6-3.10.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): postgresql96-docs-9.6.6-3.10.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libecpg6-9.6.6-3.10.1 libecpg6-debuginfo-9.6.6-3.10.1 libpq5-9.6.6-3.10.1 libpq5-debuginfo-9.6.6-3.10.1 postgresql96-9.6.6-3.10.1 postgresql96-contrib-9.6.6-3.10.1 postgresql96-contrib-debuginfo-9.6.6-3.10.1 postgresql96-debuginfo-9.6.6-3.10.1 postgresql96-debugsource-9.6.6-3.10.1 postgresql96-libs-debugsource-9.6.6-3.10.1 postgresql96-server-9.6.6-3.10.1 postgresql96-server-debuginfo-9.6.6-3.10.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): libpq5-32bit-9.6.6-3.10.1 libpq5-debuginfo-32bit-9.6.6-3.10.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): postgresql96-docs-9.6.6-3.10.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libecpg6-9.6.6-3.10.1 libecpg6-debuginfo-9.6.6-3.10.1 libpq5-32bit-9.6.6-3.10.1 libpq5-9.6.6-3.10.1 libpq5-debuginfo-32bit-9.6.6-3.10.1 libpq5-debuginfo-9.6.6-3.10.1 postgresql96-9.6.6-3.10.1 postgresql96-debuginfo-9.6.6-3.10.1 postgresql96-debugsource-9.6.6-3.10.1 postgresql96-libs-debugsource-9.6.6-3.10.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libecpg6-9.6.6-3.10.1 libecpg6-debuginfo-9.6.6-3.10.1 libpq5-32bit-9.6.6-3.10.1 libpq5-9.6.6-3.10.1 libpq5-debuginfo-32bit-9.6.6-3.10.1 libpq5-debuginfo-9.6.6-3.10.1 postgresql96-9.6.6-3.10.1 postgresql96-debuginfo-9.6.6-3.10.1 postgresql96-debugsource-9.6.6-3.10.1 postgresql96-libs-debugsource-9.6.6-3.10.1 References: https://www.suse.com/security/cve/CVE-2017-15098.html https://www.suse.com/security/cve/CVE-2017-15099.html https://bugzilla.suse.com/1067841 https://bugzilla.suse.com/1067844 From sle-updates at lists.suse.com Thu Dec 21 04:10:03 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 12:10:03 +0100 (CET) Subject: SUSE-SU-2017:3392-1: moderate: Security update for libraw Message-ID: <20171221111003.73ED4FC9D@maintenance.suse.de> SUSE Security Update: Security update for libraw ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3392-1 Rating: moderate References: #1060321 #1063798 #1072385 Cross-References: CVE-2017-13735 CVE-2017-14608 CVE-2017-16909 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libraw fixes the following issues: Security issues fixed: - CVE-2017-13735: A floating point exception in kodak_radc_load_raw could be used by attackers to crash a libraw using application (bsc#1060321) - CVE-2017-14608: An out-of-bounds read in the kodak_65000_load_raw function could be used for crashing or information leak from the libraw library (bsc#1063798) - CVE-2017-16909: Fix heap-buffer overflow in the LibRaw::panasonic_load_raw() function (bsc#1072385). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2126=1 - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-2126=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2126=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2126=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2126=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2126=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): libraw-debugsource-0.15.4-16.1 libraw9-0.15.4-16.1 libraw9-debuginfo-0.15.4-16.1 - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): libraw-debugsource-0.15.4-16.1 libraw9-0.15.4-16.1 libraw9-debuginfo-0.15.4-16.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libraw-debugsource-0.15.4-16.1 libraw-devel-0.15.4-16.1 libraw-devel-static-0.15.4-16.1 libraw9-0.15.4-16.1 libraw9-debuginfo-0.15.4-16.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libraw-debugsource-0.15.4-16.1 libraw-devel-0.15.4-16.1 libraw-devel-static-0.15.4-16.1 libraw9-0.15.4-16.1 libraw9-debuginfo-0.15.4-16.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): libraw-debugsource-0.15.4-16.1 libraw9-0.15.4-16.1 libraw9-debuginfo-0.15.4-16.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libraw-debugsource-0.15.4-16.1 libraw9-0.15.4-16.1 libraw9-debuginfo-0.15.4-16.1 References: https://www.suse.com/security/cve/CVE-2017-13735.html https://www.suse.com/security/cve/CVE-2017-14608.html https://www.suse.com/security/cve/CVE-2017-16909.html https://bugzilla.suse.com/1060321 https://bugzilla.suse.com/1063798 https://bugzilla.suse.com/1072385 From sle-updates at lists.suse.com Thu Dec 21 10:08:58 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 18:08:58 +0100 (CET) Subject: SUSE-RU-2017:3397-1: Recommended update for virt-manager, libosinfo Message-ID: <20171221170858.6E793FCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for virt-manager, libosinfo ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3397-1 Rating: low References: #1027942 #1042709 #1054986 #1055787 #1056028 #1057733 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for virt-manager and libosinfo fixes the following issues: - Add support for openSUSE Leap 15 and SLE 15 product family. (bsc#1054986) - Fix OES 2018 installs as Xen guest. (bsc#1056028) - Fix hang on first reboot when installing PV guests from ISO images. (bsc#1055787) - Fix libosinfo database entry for SUSE CaaS Platform. (bsc#1057733) - Fix creation of VMs with SLES for SAP 12-SP1 over network install. (bsc#1042709) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2128=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2128=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2128=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2128=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libosinfo-debuginfo-0.3.0-15.6.5 libosinfo-debugsource-0.3.0-15.6.5 libosinfo-devel-0.3.0-15.6.5 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libosinfo-0.3.0-15.6.5 libosinfo-1_0-0-0.3.0-15.6.5 libosinfo-1_0-0-debuginfo-0.3.0-15.6.5 libosinfo-debuginfo-0.3.0-15.6.5 libosinfo-debugsource-0.3.0-15.6.5 typelib-1_0-Libosinfo-1_0-0.3.0-15.6.5 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): libosinfo-lang-0.3.0-15.6.5 virt-install-1.4.0-21.6.3 virt-manager-1.4.0-21.6.3 virt-manager-common-1.4.0-21.6.3 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libosinfo-0.3.0-15.6.5 libosinfo-1_0-0-0.3.0-15.6.5 libosinfo-1_0-0-debuginfo-0.3.0-15.6.5 libosinfo-debuginfo-0.3.0-15.6.5 libosinfo-debugsource-0.3.0-15.6.5 typelib-1_0-Libosinfo-1_0-0.3.0-15.6.5 - SUSE Linux Enterprise Server 12-SP2 (noarch): libosinfo-lang-0.3.0-15.6.5 virt-install-1.4.0-21.6.3 virt-manager-1.4.0-21.6.3 virt-manager-common-1.4.0-21.6.3 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libosinfo-0.3.0-15.6.5 libosinfo-1_0-0-0.3.0-15.6.5 libosinfo-1_0-0-debuginfo-0.3.0-15.6.5 libosinfo-debuginfo-0.3.0-15.6.5 libosinfo-debugsource-0.3.0-15.6.5 typelib-1_0-Libosinfo-1_0-0.3.0-15.6.5 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): libosinfo-lang-0.3.0-15.6.5 virt-install-1.4.0-21.6.3 virt-manager-1.4.0-21.6.3 virt-manager-common-1.4.0-21.6.3 References: https://bugzilla.suse.com/1027942 https://bugzilla.suse.com/1042709 https://bugzilla.suse.com/1054986 https://bugzilla.suse.com/1055787 https://bugzilla.suse.com/1056028 https://bugzilla.suse.com/1057733 From sle-updates at lists.suse.com Thu Dec 21 10:10:21 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 18:10:21 +0100 (CET) Subject: SUSE-SU-2017:3398-1: important: Security update for the Linux Kernel Message-ID: <20171221171021.03A84FC9D@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3398-1 Rating: important References: #1010201 #1012382 #1012523 #1015336 #1015337 #1015340 #1015342 #1015343 #1019675 #1020412 #1020645 #1022595 #1022607 #1024346 #1024373 #1024376 #1024412 #1031717 #1032150 #1036489 #1036800 #1037404 #1037838 #1038299 #1039542 #1040073 #1041873 #1042268 #1042957 #1042977 #1042978 #1043017 #1045404 #1046054 #1046107 #1047901 #1047989 #1048317 #1048327 #1048356 #1050060 #1050231 #1051406 #1051635 #1051987 #1052384 #1053309 #1053919 #1055272 #1056003 #1056365 #1056427 #1056587 #1056596 #1056652 #1056979 #1057079 #1057199 #1057820 #1058413 #1059639 #1060333 #1061756 #1062496 #1062835 #1062941 #1063026 #1063349 #1063516 #1064206 #1064320 #1064591 #1064597 #1064606 #1064701 #1064926 #1065101 #1065180 #1065600 #1065639 #1065692 #1065717 #1065866 #1065959 #1066045 #1066175 #1066192 #1066213 #1066223 #1066285 #1066382 #1066470 #1066471 #1066472 #1066573 #1066606 #1066629 #1066660 #1066696 #1066767 #1066812 #1066974 #1067105 #1067132 #1067225 #1067494 #1067734 #1067735 #1067888 #1067906 #1068671 #1068978 #1068980 #1068982 #1069152 #1069250 #1069270 #1069277 #1069484 #1069583 #1069721 #1069793 #1069879 #1069916 #1069942 #1069996 #1070001 #1070006 #1070145 #1070169 #1070404 #1070535 #1070767 #1070771 #1070805 #1070825 #1070964 #1071693 #1071694 #1071695 #1071833 #1072589 #744692 #789311 #964944 #966170 #966172 #969470 #979928 #989261 #996376 Cross-References: CVE-2017-1000410 CVE-2017-11600 CVE-2017-12193 CVE-2017-15115 CVE-2017-16528 CVE-2017-16536 CVE-2017-16537 CVE-2017-16645 CVE-2017-16646 CVE-2017-16994 CVE-2017-17448 CVE-2017-17449 CVE-2017-17450 CVE-2017-7482 CVE-2017-8824 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Live Patching 12-SP3 SUSE Linux Enterprise High Availability 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that solves 15 vulnerabilities and has 136 fixes is now available. Description: The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.103 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000410: The Linux kernel was affected by an information lea that lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. (bnc#1070535). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132). - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105). - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996). - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693). - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). The following non-security bugs were fixed: - acpi / APD: Add clock frequency for ThunderX2 I2C controller (bsc#1067225). - Add references (bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299) The scsi_devinfo patches are relevant for all bugs related to HITACHI OPEN-V: - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717). - adv7604: Initialize drive strength to default when using DT (bnc#1012382). - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382). - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382). - alsa: hda: Abort capability probe at invalid register read (bsc#1048356). - alsa: hda: Add Raven PCI ID (bnc#1012382). - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE (bnc#1012382). - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717). - alsa: hda - fix headset mic problem for Dell machines with alc236 (bnc#1012382). - alsa: hda - No loopback on ALC299 codec (git-fixes). - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon (bsc#1031717). - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382). - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382). - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717). - alsa: hda: Remove superfluous '-' added by printk conversion (bnc#1012382). - alsa: hda: Workaround for KBL codec power control (bsc#1048356,bsc#1047989,bsc#1055272,bsc#1058413). - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382). - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717). - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717). - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382). - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382). - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382). - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382). - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382). - alsa: timer: Remove kernel warning at compat ioctl error paths (bsc#1031717). - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital (bnc#1012382). - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717). - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717). - alsa: usb-audio: Fix potential out-of-bound access at parsing SU (bsc#1031717). - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382). - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717). - alsa: vx: Do not try to update capture stream before running (bnc#1012382). - alsa: vx: Fix possible transfer overflow (bnc#1012382). - Apply generic ppc build fixes to vanilla (bsc#1070805) - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382). - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382). - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382). - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382). - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382). - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382). - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382). - arm: dts: Fix am335x and dm814x scm syscon to probe children (bnc#1012382). - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382). - arm: dts: Fix omap3 off mode pull defines (bnc#1012382). - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382). - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382). - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6 (bnc#1012382). - arm: pxa: Do not rely on public mmc header to include leds.h (bnc#1012382). - asm/sections: add helpers to check for section data (bsc#1063026). - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382). - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717). - asoc: davinci-mcasp: Fix an error handling path in 'davinci_mcasp_probe()' (bsc#1031717). - asoc: rsnd: do not double free kctrl (bnc#1012382). - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe failure (bsc#1031717). - asoc: wm_adsp: Do not overrun firmware file buffer when reading region data (bnc#1012382). - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382). - ata: fixes kernel crash while tracing ata_eh_link_autopsy event (bnc#1012382). - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382). - ata: SATA_MV should depend on HAS_DMA (bnc#1012382). - ath10k: convert warning about non-existent OTP board id to debug message (git-fixes). - ath10k: fix a warning during channel switch with multiple vaps (bsc#1031717). - ath10k: fix board data fetch error message (bsc#1031717). - ath10k: fix diag_read to collect data for larger memory (bsc#1031717). - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382). - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() (bnc#1012382). - ath10k: free cached fw bin contents when get board id fails (bsc#1031717). - ath10k: ignore configuring the incorrect board_id (bnc#1012382). - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382). - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717). - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717). - autofs: do not fail mount for transient error (bsc#1065180). - backlight: adp5520: Fix error handling in adp5520_bl_probe() (bnc#1012382). - backlight: lcd: Fix race condition during register (bnc#1012382). - bcache: check ca->alloc_thread initialized before wake up it (bnc#1012382). - bio-integrity: bio_integrity_advance must update integrity seed (bsc#1046054). - bio-integrity: bio_trim should truncate integrity vector accordingly (bsc#1046054). - bio-integrity: Do not allocate integrity context for bio w/o data (bsc#1046054). - bio-integrity: fix interface for bio_integrity_trim (bsc#1046054). - bio: partially revert 'fix interface for bio_integrity_trim' (bsc#1046054). - blacklist.conf: Add ath10k, mmc and rtl8192u commits (bsc#1031717) - blacklist.conf: Add drm/i915 blacklist (bsc#1031717) - blacklist.conf: added misc commits (bsc#1031717) - blacklist.conf: Add misc entries (bsc#1031717) - blacklist.conf: Add non-applicable commit ID (bsc#1066812) - blacklist.conf: Add non-applicable commits (bsc#1066812) - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919) - blacklist.conf: Blacklist two commits (bbb3be170ac2 and ccf1e0045eea). - blacklist.conf: Update blacklist (bsc#1031717) - blacklist.conf: Update iwlwifi blacklist (bsc#1031717) - blacklist.conf: yet another serial entry (bsc#1031717) - block: Fix a race between blk_cleanup_queue() and timeout handling (FATE#319965, bsc#964944). - block: Make q_usage_counter also track legacy requests (bsc#1057820). - bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382). - bnxt_en: Do not use rtnl lock to protect link change logic in workqueue (bsc#1020412 FATE#321671). - bnxt_en: Fix a variable scoping in bnxt_hwrm_do_send_msg() (bsc#1053309). - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response (bsc#1020412 FATE#321671). - bnxt_en: Fix possible corruption in DCB parameters from firmware (bsc#1020412 FATE#321671). - bnxt_en: Fix VF PCIe link speed and width logic (bsc#1020412 FATE#321671). - bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown (bsc#1053309). - bnxt_re: Make room for mapping beyond 32 entries (bsc#1056596). - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382). - bpf: one perf event close won't free bpf program attached by another perf event (bnc#1012382). - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382). - brcmfmac: add length check in brcmf_cfg80211_escan_handler() (bnc#1012382). - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382). - brcmsmac: make some local variables 'static const' to reduce stack size (bnc#1012382). - bt8xx: fix memory leak (bnc#1012382). - btrfs: return the actual error value from from btrfs_uuid_tree_iterate (bnc#1012382). - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382). - can: c_can: do not indicate triple sampling support for D_CAN (bnc#1012382). - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382). - can: gs_usb: fix busy loop if no more TX context is available (bnc#1012382). - can: kvaser_usb: Correct return value in printout (bnc#1012382). - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382). - can: sun4i: fix loopback mode (bnc#1012382). - can: sun4i: handle overrun in RX FIFO (bnc#1012382). - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices (bnc#1012382). - ceph: clean up unsafe d_parent accesses in build_dentry_path (FATE#322288 bnc#1012382). - ceph: disable cached readdir after dropping positive dentry (bsc#1069277). - ceph: -EINVAL on decoding failure in ceph_mdsc_handle_fsmap() (bsc#1069277). - ceph: present consistent fsid, regardless of arch endianness (bsc#1069277). - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639). - cgroup, net_cls: iterate the fds of only the tasks which are being migrated (bnc#1064926). - cifs: check MaxPathNameComponentLength != 0 before using it (bnc#1012382). - cifs: fix circular locking dependency (bsc#1064701). - cifs: Reconnect expired SMB sessions (bnc#1012382). - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382). - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382). - clockevents/drivers/cs5535: Improve resilience to spurious interrupts (bnc#1012382). - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060). - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382). - cpufreq: CPPC: add acpi_PROCESSOR dependency (bnc#1012382). - crypto: dh - Do not permit 'key' or 'g' size longer than 'p' (bsc#1048317). - crypto: dh - Do not permit 'p' to be 0 (bsc#1048317). - crypto: dh - Fix double free of ctx->p (bsc#1048317). - crypto: dh - fix memleak in setkey (bsc#1048317). - crypto: rsa - fix buffer overread when stripping leading zeroes (bsc#1048317). - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382). - crypto: vmx - disable preemption to enable vsx in aes_ctr.c (bnc#1012382). - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382). - crypto: xts - Add ECB dependency (bnc#1012382). - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382). - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1048327). - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223). - cxl: Fix leaking pid refs in some error paths (bsc#1066223). - cxl: Force context lock during EEH flow (bsc#1066223). - cxl: Prevent adapter reset if an active context exists (bsc#1066223). - cxl: Route eeh events to all drivers in cxl_pci_error_detected() (bsc#1066223). - direct-io: Prevent NULL pointer access in submit_page_section (bnc#1012382). - Disable IPMI fix patches due to regression (bsc#1071833) - Disable patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcounting-in-bio_map_us e.patch (bsc#1070767) - dmaengine: dmatest: warn user when dma test times out (bnc#1012382). - dmaengine: edma: Align the memcpy acnt array size with the transfer (bnc#1012382). - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382). - dm bufio: fix integer overflow when limiting maximum cache size (bnc#1012382). - dm: fix race between dm_get_from_kobject() and __dm_destroy() (bnc#1012382). - dm mpath: remove annoying message of 'blk_get_request() returned -11' (bsc#1066812). - dm raid: fix NULL pointer dereference for raid1 without bitmap (bsc#1042957, FATE#321488). - dm rq: Avoid that request processing stalls sporadically (bsc#1042978). - drivers: base: cacheinfo: fix x86 with CONFIG_OF enabled (bsc#1070001). - drivers: dma-mapping: Do not leave an invalid area->pages pointer in dma_common_contiguous_remap() (Git-fixes, bsc#1065692). - drivers/fbdev/efifb: Allow BAR to be moved instead of claiming it (bsc#1051987). - drivers: of: Fix of_pci.h header guard (bsc#1065959). - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382). - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717). - drm: Apply range restriction after color adjustment when allocation (bnc#1012382). - drm/armada: Fix compile fail (bnc#1012382). - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382). - drm: gma500: fix logic error (bsc#1031717). - drm/i915/bxt: set min brightness from VBT (bsc#1031717). - drm/i915: Do not try indexed reads to alternate slave addresses (bsc#1031717). - drm/i915: fix backlight invert for non-zero minimum brightness (bsc#1031717). - drm/i915: Prevent zero length "index" write (bsc#1031717). - drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get() (bsc#1031717). - drm/msm: fix an integer overflow test (bnc#1012382). - drm/msm: Fix potential buffer overflow issue (bnc#1012382). - drm/nouveau/bsp/g92: disable by default (bnc#1012382). - drm/nouveau/gr: fallback to legacy paths during firmware lookup (bsc#1031717). - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382). - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717). - drm/panel: simple: Add missing panel_simple_unprepare() calls (bsc#1031717). - drm/radeon: Avoid double gpu reset by adding a timeout on IB ring tests (bsc#1066175). - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache (bnc#1012382). - drm/vc4: Fix leak of HDMI EDID (bsc#1031717). - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382). - Drop obsolete patch (bsc#1067734) - e1000e: Avoid receiver overrun interrupt bursts (bsc#969470 FATE#319819). - e1000e: Fix error path in link detection (bnc#1012382). - e1000e: Fix return value test (bnc#1012382). - e1000e: Separate signaling for link check/link up (bnc#1012382). - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382). - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1070404). - epoll: avoid calling ep_call_nested() from ep_poll_safewake() (bsc#1056427). - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427). - ext4: cleanup goto next group (bsc#1066285). - ext4: do not use stripe_width if it is not set (bnc#1012382). - ext4: fix fault handling when mounted with -o dax,ro (bsc#1069484). - ext4: fix interaction between i_size, fallocate, and delalloc after a crash (bnc#1012382). - ext4: fix stripe-unaligned allocations (bnc#1012382). - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets (bnc#1012382). - ext4: prevent data corruption with inline data + DAX (bsc#1064591). - ext4: prevent data corruption with journaling + DAX (bsc#1064591). - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285). - extcon: palmas: Check the parent instance to prevent the NULL (bnc#1012382). - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382). - f2fs crypto: add missing locking for keyring_key access (bnc#1012382). - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382). - f2fs: do not wait for writeback in write_begin (bnc#1012382). - fealnx: Fix building error on MIPS (bnc#1012382). - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382). - Fix tracing sample code warning (bnc#1012382). - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382). - Fixup patches.fixes/block-Make-q_usage_counter-also-track-legacy-request.patch. ( bsc#1062496) - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1070404). - fs-cache: fix dereference of NULL user_key_payload (bnc#1012382). - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382). - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382). - fscrypto: require write access to mount to set encryption policy (bnc#1012382). - fuse: fix READDIRPLUS skipping an entry (bnc#1012382). - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap (bnc#1012382). - hid: elo: clear BTN_LEFT mapping (bsc#1065866). - hid: usbhid: fix out-of-bounds bug (bnc#1012382). - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717). - hwmon: (xgene) Fix up error handling path mixup in 'xgene_hwmon_probe()' (bsc#). - i2c: at91: ensure state is restored after suspending (bnc#1012382). - i2c: bcm2835: Add support for dynamic clock (bsc#1066660). - i2c: bcm2835: Add support for Repeated Start Condition (bsc#1066660). - i2c: bcm2835: Avoid possible NULL ptr dereference (bsc#1066660). - i2c: bcm2835: Can't support I2C_M_IGNORE_NAK (bsc#1066660). - i2c: bcm2835: Do not complain on -EPROBE_DEFER from getting our clock (bsc#1066660). - i2c: bcm2835: Fix hang for writing messages larger than 16 bytes (bsc#1066660). - i2c: bcm2835: Protect against unexpected TXW/RXR interrupts (bsc#1066660). - i2c: bcm2835: Support i2c-dev ioctl I2C_TIMEOUT (bsc#1066660). - i2c: bcm2835: Use dev_dbg logging on transfer errors (bsc#1066660). - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717). - i2c: imx: Use correct function to write to register (bsc#1031717). - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382). - i2c: riic: correctly finish transfers (bnc#1012382). - i2c: riic: fix restart condition (git-fixes). - i2c: xlp9xx: Enable HWMON class probing for xlp9xx (bsc#1067225). - i2c: xlp9xx: Get clock frequency with clk API (bsc#1067225). - i2c: xlp9xx: Handle I2C_M_RECV_LEN in msg->flags (bsc#1067225). - i40e: Fix incorrect use of tx_itr_setting when checking for Rx ITR setup (bsc#1024346 FATE#321239 bsc#1024373 FATE#321247). - i40e: fix the calculation of VFs mac addresses (bsc#1024346 FATE#321239 bsc#1024373 FATE#321247). - i40e: only redistribute MSI-X vectors when needed (bsc#1024346 FATE#321239 bsc#1024373 FATE#321247). - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - i40iw: Remove UDA QP from QoS list if creation fails (bsc#1024376 FATE#321249). - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350). - ib/core: Fix unable to change lifespan entry for hw_counters (FATE#321231 FATE#321473). - ib/core: Namespace is mandatory input for address resolution (bsc#1022595 FATE#322350). - ib/hfi1: Add MODULE_FIRMWARE statements (bsc#1036800). - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350). - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp (bsc#1022595 FATE#322350). - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350). - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion initialization (bsc#1022595 FATE#322350). - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - ibmvnic: Add netdev_dbg output for debugging (fate#323285). - ibmvnic: Add vnic client data to login buffer (bsc#1069942). - ibmvnic: Convert vnic server reported statistics to cpu endian (fate#323285). - ibmvnic: Enable scatter-gather support (bsc#1066382). - ibmvnic: Enable TSO support (bsc#1066382). - ibmvnic: Feature implementation of Vital Product Data (VPD) for the ibmvnic driver (bsc#1069942). - ibmvnic: Fix calculation of number of TX header descriptors (bsc#1066382). - ibmvnic: fix dma_mapping_error call (bsc#1069942). - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382). - ibmvnic: Implement .get_channels (fate#323285). - ibmvnic: Implement .get_ringparam (fate#323285). - ibmvnic: Implement per-queue statistics reporting (fate#323285). - ibmvnic: Let users change net device features (bsc#1066382). - ibmvnic: Update reset infrastructure to support tunable parameters (bsc#1066382). - ib/rxe: check for allocation failure on elem (FATE#322149). - ib/rxe: do not crash, if allocation of crc algorithm failed (bsc#1051635). - ib/rxe: put the pool on allocation failure (FATE#322149). - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595 FATE#322350). - ib/srpt: Do not accept invalid initiator port names (bnc#1012382). - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350). - ib/uverbs: Fix NULL pointer dereference during device removal (bsc#1022595 FATE#322350). - igb: close/suspend race in netif_device_detach (bnc#1012382). - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382). - igb: reset the PHY before reading the PHY ID (bnc#1012382). - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - iio: adc: xilinx: Fix error handling (bnc#1012382). - iio: dummy: events: Add missing break (bsc#1031717). - iio: light: fix improper return value (bnc#1012382). - iio: trigger: free trigger resource correctly (bnc#1012382). - ima: do not update security.ima if appraisal status is not INTEGRITY_PASS (bnc#1012382). - input: ar1021_i2c - fix too long name in driver's device table (bsc#1031717). - input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree (bsc#1031717). - input: elan_i2c - add ELAN060C to the acpi table (bnc#1012382). - input: elan_i2c - add ELAN0611 to the acpi table (bnc#1012382). - input: gtco - fix potential out-of-bound access (bnc#1012382). - input: mpr121 - handle multiple bits change of status register (bnc#1012382). - input: mpr121 - set missing event capability (bnc#1012382). - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen (bsc#1031717). - input: twl4030-pwrbutton - use correct device for irq request (bsc#1031717). - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717). - input: uinput - avoid crash when sending FF request to device going away (bsc#1031717). - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382). - iommu/vt-d: Do not register bus-notifier under dmar_global_lock (bsc#1069793). - ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err (bnc#1012382). - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header (bnc#1012382). - ipip: only increase err_count for some certain type icmp in ipip_err (bnc#1012382). - ipmi: fix unsigned long underflow (bnc#1012382). - ipmi: Pick up slave address from SMBIOS on an acpi device (bsc#1070006). - ipmi: Prefer acpi system interfaces over SMBIOS ones (bsc#1070006). - ipmi_si: Clean up printks (bsc#1070006). - ipmi_si: fix memory leak on new_smi (bsc#1070006). - ipsec: do not ignore crypto err in ah4 input (bnc#1012382). - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382). - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER (bnc#1012382). - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365). - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382). - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717). - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382). - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382). - isofs: fix timestamps beyond 2027 (bnc#1012382). - iwlwifi: mvm: fix the coex firmware API (bsc#1031717). - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW down (bsc#1031717). - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to fw (bsc#1031717). - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382). - iwlwifi: split the regulatory rules when the bandwidth flags require it (bsc#1031717). - ixgbe: add mask for 64 RSS queues (bnc#1012382). - ixgbe: do not disable FEC from the driver (bnc#1012382). - ixgbe: fix AER error handling (bnc#1012382). - ixgbe: Fix skb list corruption on Power systems (bnc#1012382). - ixgbe: handle close/suspend race with netif_device_detach/present (bnc#1012382). - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382). - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - kABI: protect struct l2tp_tunnel (kabi). - kABI: protect struct regulator_dev (kabi). - kABI: protect structs rt_rq+root_domain (kabi). - kABI: protect typedef rds_rdma_cookie_t (kabi). - kabi/severities: Ignore drivers/nvme/target (bsc#1063349) - kabi/severities: Ignore kABI changes for qla2xxx (bsc#1043017) - kernel-docs: unpack the source instead of using kernel-source (bsc#1057199). - kernel/sysctl_binary.c: check name array length in deprecated_sysctl_warning() (FATE#323821). - kernel/sysctl.c: remove duplicate UINT_MAX check on do_proc_douintvec_conv() (bsc#1066470). - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516). - keys: do not let add_key() update an uninstantiated key (bnc#1012382). - keys: do not revoke uninstantiated key in request_key_auth_new() (bsc#1031717). - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382). - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717). - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717). - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717). - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2] (bnc#1012382). - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382). - keys: Fix race between updating and finding a negative key (bnc#1012382). - keys: return full count in keyring_read() if buffer is too small (bnc#1012382). - keys: trusted: fix writing past end of buffer in trusted_read() (bnc#1012382). - keys: trusted: sanitize all key material (bnc#1012382). - kvm: nVMX: fix guest CR4 loading when emulating L2 to L1 exit (bnc#1012382). - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state (bnc#1012382). - kvm: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter (bnc#1012382). - kvm: SVM: obey guest PAT (bnc#1012382). - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382). - l2tp: check ps->sock before running pppol2tp_session_ioctl() (bnc#1012382). - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382). - libceph: do not WARN() if user tries to add invalid key (bsc#1069277). - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382). - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717). - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382). - libnvdimm, namespace: fix label initialization to use valid seq numbers (bnc#1012382). - libnvdimm, namespace: make 'resource' attribute only readable by root (bnc#1012382). - libnvdimm, pfn: make 'resource' attribute only readable by root (FATE#319858). - lib/ratelimit.c: use deferred printk() version (bsc#979928). - locking/lockdep: Add nest_lock integrity test (bnc#1012382). - lpfc: tie in to new dev_loss_tmo interface in nvme transport (bsc#1041873). - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717). - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472). - mac80211: do not send SMPS action frame in AP mode when not needed (bsc#1031717). - mac80211: Fix addition of mesh configuration element (git-fixes). - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717). - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717). - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382). - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382). - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717). - mac80211: Remove invalid flag operations in mesh TSF synchronization (bnc#1012382). - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717). - mac80211: Remove unused 'i' variable (bsc#1031717). - mac80211: Remove unused 'len' variable (bsc#1031717). - mac80211: Remove unused 'rates_idx' variable (bsc#1031717). - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717). - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717). - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382). - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717). - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717). - mac80211: use constant time comparison with keys (bsc#1066471). - md/linear: shutup lockdep warnning (FATE#321488 bnc#1012382 bsc#1042977). - media: au0828: fix RC_CORE dependency (bsc#1031717). - media: Do not do DMA on stack for firmware upload in the AS102 driver (bnc#1012382). - media: em28xx: calculate left volume level correctly (bsc#1031717). - media: mceusb: fix memory leaks in error path (bsc#1031717). - media: rc: check for integer overflow (bnc#1012382). - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382). - mei: return error on notification request to a disconnected client (bnc#1012382). - memremap: add scheduling point to devm_memremap_pages (bnc#1057079). - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382). - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped (bnc#1012382). - misc: panel: properly restore atomic counter on error path (bnc#1012382). - mmc: block: return error on failed mmc_blk_get() (bsc#1031717). - mmc: core: add driver strength selection when selecting hs400es (bsc#1069721). - mmc: core: Fix access to HS400-ES devices (bsc#1031717). - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717). - mmc: dw_mmc: Fix the DTO timeout calculation (bsc#1069721). - mm: check the return value of lookup_page_ext for all call sites (bnc#1068982). - mmc: host: omap_hsmmc: avoid possible overflow of timeout value (bsc#1031717). - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() (bsc#1031717). - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717). - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382). - mmc: sd: limit SD card power limit according to cards capabilities (bsc#1031717). - mm: distinguish CMA and MOVABLE isolation in has_unmovable_pages (bnc#1051406). - mm: drop migrate type checks from has_unmovable_pages (bnc#1051406). - mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for all call sites" (bnc#1012382). - mm/madvise.c: fix freeing of locked page with MADV_FREE (bnc#1069152). - mm/madvise.c: fix madvise() infinite loop under special circumstances (bnc#1070964). - mm, memory_hotplug: add scheduling point to __add_pages (bnc#1057079). - mm, memory_hotplug: do not fail offlining too early (bnc#1051406). - mm, memory_hotplug: remove timeout from __offline_memory (bnc#1051406). - mm, page_alloc: add scheduling point to memmap_init_zone (bnc#1057079). - mm/page_alloc.c: broken deferred calculation (bnc#1068980). - mm, page_alloc: fix potential false positive in __zone_watermark_ok (Git-fixes, bsc#1068978). - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982). - mm/page_owner: avoid null pointer dereference (bnc#1068982). - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382). - mm, sparse: do not swamp log with huge vmemmap allocation failures (bnc#1047901). - net: 3com: typhoon: typhoon_init_one: fix incorrect return values (bnc#1012382). - net: 3com: typhoon: typhoon_init_one: make return values more specific (bnc#1012382). - net/9p: Switch to wait_event_killable() (bnc#1012382). - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382). - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382). - net: cdc_ncm: GetNtbFormat endian fix (git-fixes). - net: dsa: select NET_SWITCHDEV (bnc#1012382). - net: emac: Fix napi poll list corruption (bnc#1012382). - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed (bnc#1012382). - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value (bnc#1012382). - netfilter: nf_tables: fix oob access (bnc#1012382). - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family (bnc#1012382). - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382). - net: ibm: ibmvnic: constify vio_device_id (fate#323285). - net: ixgbe: Use new IXGBE_FLAG2_ROOT_RELAXED_ORDERING flag (bsc#1056652). - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs (FATE#321685 FATE#321686 FATE#321687 bnc#1012382 bsc#1015336 bsc#1015337 bsc#1015340). - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (FATE#321685 FATE#321686 FATE#321687 bnc#1012382 bsc#1015336 bsc#1015337 bsc#1015340). - net/mlx5: Delay events till mlx5 interface's add complete for pci resume (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net/mlx5: Fix health work queue spin lock to IRQ safe (bsc#1015342). - net/mlx5: Loop over temp list to release delay events (bsc#1015342 FATE#321688 bsc#1015343 FATE#321689). - net: mvneta: fix handling of the Tx descriptor counter (fate#319899). - net: mvpp2: release reference to txq_cpu[] entry after unmapping (bnc#1012382 bsc#1032150). - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382). - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382). - net: Set sk_prot_creator when cloning sockets to the right proto (bnc#1012382). - net/smc: dev_put for netdev after usage of ib_query_gid() (bsc#1066812). - net: thunderx: Fix TCP/UDP checksum offload for IPv4 pkts (bsc#1069583). - net: thunderx: Fix TCP/UDP checksum offload for IPv6 pkts (bsc#1069583). - net/unix: do not show information about sockets from other namespaces (bnc#1012382). - netvsc: use refcount_t for keeping track of sub channels (bsc#1062835). - nfc: fix device-allocation error return (bnc#1012382). - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382). - nfsd: deal with revoked delegations appropriately (bnc#1012382). - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261). - nfs: Fix typo in nomigration mount option (bnc#1012382). - nfs: Fix ugly referral attributes (bnc#1012382). - nilfs2: fix race condition that causes file system corruption (bnc#1012382). - nl80211: Define policy for packet pattern attributes (bnc#1012382). - nvme: add duplicate_connect option (bsc#1067734). - nvme: add helper to compare options to controller (bsc#1067734). - nvme: add transport SGL definitions (bsc#1057820). - nvme: allow controller RESETTING to RECONNECTING transition (bsc#1037838). - nvme-fabrics: Allow 0 as KATO value (bsc#1067734). - nvme-fabrics: kABI fix for duplicate_connect option (bsc#1067734). - nvme-fc: add a dev_loss_tmo field to the remoteport (bsc#1037838). - nvme-fc: add dev_loss_tmo timeout and remoteport resume support (bsc#1037838). - nvme-fc: add support for duplicate_connect option (bsc#1067734). - nvme-fc: add uevent for auto-connect (bsc#1037838). - nvme-fc: change ctlr state assignments during reset/reconnect (bsc#1037838). - nvme-fc: check connectivity before initiating reconnects (bsc#1037838). - nvme-fc: correct io termination handling (bsc#1067734). - nvme-fc: correct io timeout behavior (bsc#1067734). - nvme-fc: create fc class and transport device (bsc#1037838). - nvme-fc: decouple ns references from lldd references (bsc#1067734). - nvme-fc: fix iowait hang (bsc#1052384). - nvme-fc: fix localport resume using stale values (bsc#1067734). - nvme-fcloop: fix port deletes and callbacks (bsc#1037838). - nvme-fc: move remote port get/put/free location (bsc#1037838). - nvme-fc: on lldd/transport io error, terminate association (bsc#1042268). - nvme-fc: Reattach to localports on re-registration (bsc#1052384). - nvme-fc: remove NVME_FC_MAX_SEGMENTS (bsc#1067734). - nvme-fc: remove unused "queue_size" field (bsc#1042268). - nvme-fc: retry initial controller connections 3 times (bsc#1067734). - nvme-fc: use transport-specific sgl format (bsc#1057820). - nvme: Fix memory order on async queue deletion (bnc#1012382). - nvme: fix the definition of the doorbell buffer config support bit (bsc#1066812). - nvme-rdma: add support for duplicate_connect option (bsc#1067734). - nvme/rdma: Kick admin queue when a connection is going down (bsc#1059639). - nvmet-fc: correct ref counting error when deferred rcv used (bsc#1067734). - nvmet-fc: fix failing max io queue connections (bsc#1067734). - nvmet-fc: on port remove call put outside lock (bsc#1067734). - nvmet-fc: simplify sg list handling (bsc#1052384). - nvmet: Fix fatal_err_work deadlock (bsc#1063349). - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (bnc#1012382). - ocfs2: should wait dio before inode lock in ocfs2_setattr() (bnc#1012382). - packet: avoid panic in packet_getsockopt() (bnc#1012382). - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382). - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382). - parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels (bnc#1012382). - parisc: Fix validity check of pointer size argument in new CAS implementation (bnc#1012382). - pci: Apply Cavium ThunderX ACS quirk to more Root Ports (bsc#1069250). - pci: Apply _HPX settings only to relevant devices (bnc#1012382). - pci: Enable Relaxed Ordering for Hisilicon Hip07 chip (bsc#1056652). - pci: Mark Cavium CN8xxx to avoid bus reset (bsc#1069250). - pci: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF (bsc#1069250). - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts (bnc#1012382). - perf tools: Fix build failure on perl script context (bnc#1012382). - perf tools: Only increase index if perf_evsel__new_idx() succeeds (bnc#1012382). - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes d2878d642a4ed). - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382). - pkcs#7: fix unitialized boolean 'want' (bnc#1012382). - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set (bnc#1012382). - platform/x86: acer-wmi: setup accelerometer when acpi device was found (bsc#1031717). - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382). - platform/x86: hp-wmi: Fix detection for dock and tablet mode (bnc#1012382). - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state (bnc#1012382). - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382). - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill() (bsc#1031717). - pm / OPP: Add missing of_node_put(np) (bnc#1012382). - power: bq27xxx_battery: Fix bq27541 AveragePower register address (bsc#1031717). - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717). - powerCap: Fix an error code in powercap_register_zone() (bsc#1031717). - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717). - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code (bsc#1066223). - powerpc/64s/hash: Allow MAP_FIXED allocations to cross 128TB boundary (bsc#1070169). - powerpc/64s/hash: Fix 128TB-512TB virtual address boundary case allocation (bsc#1070169). - powerpc/64s/hash: Fix 512T hint detection to use >= 128T (bsc#1070169). - powerpc/64s/hash: Fix fork() with 512TB process address space (bsc#1070169). - powerpc/64s/slice: Use addr limit when computing slice mask (bsc#1070169). - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223). - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4 (bnc#1012382). - powerpc: Correct instruction code for xxlor instruction (bsc#1066223). - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC (bsc#1066223). - powerpc/hotplug: Improve responsiveness of hotplug change (FATE#322022, bsc#1067906). - powerpc/mm: Fix check of multiple 16G pages from device tree (bsc#1066223). - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223). - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config (bsc#1010201, bsc#1066223). - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223). - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223). - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max() (bsc#1066223). - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223). - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223). - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context (bsc#1066223). - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888). - powerpc/signal: Properly handle return value from uprobe_deny_signal() (bsc#1066223). - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223). - powerpc/vphn: Fix numa update end-loop bug (FATE#322022, bsc#1067906). - powerpc/vphn: Improve recognition of PRRN/VPHN (FATE#322022, bsc#1067906). - powerpc/vphn: Update CPU topology when VPHN enabled (FATE#322022, bsc#1067906). - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520 ("bsc#1069270"). - power: supply: isp1704: Fix unchecked return value of devm_kzalloc (bsc#1031717). - power: supply: lp8788: prevent out of bounds array access (bsc#1031717). - power_supply: tps65217-charger: Fix NULL deref during property export (bsc#1031717). - ppp: fix race in ppp device destruction (bnc#1012382). - printk/console: Always disable boot consoles that use init memory before it is freed (bsc#1063026). - printk/console: Enhance the check for consoles using init memory (bsc#1063026). - printk: include instead of (bsc#1063026). - printk: Make sure to wake up printk kthread from irq work for pending output (bnc#744692, bnc#789311). - printk: only unregister boot consoles when necessary (bsc#1063026). - qla2xxx: Fix cable swap (bsc#1043017). - qla2xxx: Fix notify ack without timeout handling (bsc#1043017). - qla2xxx: Fix re-login for Nport Handle in use (bsc#1043017). - qla2xxx: fix stale memory access (bsc#1043017). - qla2xxx: Login state machine stuck at GPDB (bsc#1043017). - qla2xxx: Recheck session state after RSCN (bsc#1043017). - qla2xxx: relogin is being triggered too fast (bsc#1043017). - qla2xxx: Retry switch command on timed out (bsc#1043017). - qla2xxx: Serialize gpnid (bsc#1043017). - quota: Check for register_shrinker() failure (bsc#1070404). - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717). - rbd: set discard_alignment to zero (bsc#1064320). - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382). - rcu: Allow for page faults in NMI handlers (bnc#1012382). - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350). - rds: rdma: return appropriate error on rdma map failures (bnc#1012382). - Refresh patches with upstream commit ID (bsc#1067734) - regulator: core: Limit propagation of parent voltage count and list (bsc#1070145). - regulator: fan53555: fix I2C device ids (bnc#1012382). - Revert "crypto: xts - Add ECB dependency" (bnc#1012382). - Revert "drm: bridge: add DT bindings for TI ths8135" (bnc#1012382). - Revert "phy: increase size of MII_BUS_ID_SIZE and bus_id" (kabi). - Revert "sctp: do not peel off an assoc from one netns to another one" (bnc#1012382). - Revert "tty: goldfish: Fix a parameter of a call to free_irq" (bnc#1012382). - Revert "uapi: fix linux/rds.h userspace compilation errors" (bnc#1012382). - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to kernel-binary-base (bsc#1060333). - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products (bsc#1067494) - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size (bsc#1056979). - rpm/package-descriptions: - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717). - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks (bsc#1031717). - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL (bsc#1031717). - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717). - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare (bsc#1031717). - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382). - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382). - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382). - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717). - s390/dasd: check for device error pointer within state change interrupts (bnc#1012382). - s390/disassembler: add missing end marker for e7 table (bnc#1012382). - s390/disassembler: correct disassembly lines alignment (bsc#1070825). - s390/disassembler: increase show_code buffer size (bnc#1070825, LTC#161577). - s390/disassembler: increase show_code buffer size (LTC#161577 bnc#1012382 bnc#1070825). - s390: fix transactional execution control register handling (bnc#1012382). - s390/kbuild: enable modversions for symbols exported from asm (bnc#1012382). - s390/mm: fix write access check in gup_huge_pmd() (bnc#1066974, LTC#160551). - s390/qeth: allow hsuid configuration in DOWN state (bnc#1070825, LTC#161871). - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382). - s390/qeth: use ip_lock for hsuid configuration (bnc#1070825, LTC#161871). - s390/runtime instrumention: fix possible memory corruption (bnc#1012382). - sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task() (bnc#1012382). - sched: Make resched_cpu() unconditional (bnc#1012382). - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382). - scsi: aacraid: Check for PCI state of device in a generic way (bsc#1022607, FATE#321673). - scsi: aacraid: Fix controller initialization failure (FATE#320140). - scsi: bfa: fix access to bfad_im_port_s (bsc#1065101). - scsi: check for device state in __scsi_remove_target() (bsc#1072589). - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941). - scsi: fcoe: move fcoe_interface_remove() out of fcoe_interface_cleanup() (bsc#1039542). - scsi: fcoe: open-code fcoe_destroy_work() for NETDEV_UNREGISTER (bsc#1039542). - scsi: fcoe: separate out fcoe_vport_remove() (bsc#1039542). - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213). - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213). - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003). - scsi: lpfc: Add Buffer to Buffer credit recovery support (bsc#1052384). - scsi: lpfc: Add changes to assist in NVMET debugging (bsc#1041873). - scsi: lpfc: Add nvme initiator devloss support (bsc#1041873). - scsi: lpfc: Adjust default value of lpfc_nvmet_mrq (bsc#1067735). - scsi: lpfc: Break up IO ctx list into a separate get and put list (bsc#1045404). - scsi: lpfc: change version to 11.4.0.4 (bsc#1067735). - scsi: lpfc: convert info messages to standard messages (bsc#1052384). - scsi: lpfc: Correct driver deregistrations with host nvme transport (bsc#1067735). - scsi: lpfc: Correct issues with FAWWN and FDISCs (bsc#1052384). - scsi: lpfc: correct nvme sg segment count check (bsc#1067735). - scsi: lpfc: correct port registrations with nvme_fc (bsc#1067735). - scsi: lpfc: Correct return error codes to align with nvme_fc transport (bsc#1052384). - scsi: lpfc: Disable NPIV support if NVME is enabled (bsc#1067735). - scsi: lpfc: Driver fails to detect direct attach storage array (bsc#1067735). - scsi: lpfc: Expand WQE capability of every NVME hardware queue (bsc#1067735). - scsi: lpfc: Extend RDP support (bsc#1067735). - scsi: lpfc: Fix a precedence bug in lpfc_nvme_io_cmd_wqe_cmpl() (bsc#1056587). - scsi: lpfc: Fix bad sgl reposting after 2nd adapter reset (bsc#1052384). - scsi: lpfc: fix build issue if NVME_FC_TARGET is not defined (bsc#1040073). - scsi: lpfc: Fix counters so outstandng NVME IO count is accurate (bsc#1041873). - scsi: lpfc: Fix crash after bad bar setup on driver attachment (bsc#1067735). - scsi: lpfc: Fix crash during driver unload with running nvme traffic (bsc#1067735). - scsi: lpfc: Fix crash in lpfc_nvme_fcp_io_submit during LIP (bsc#1067735). - scsi: lpfc: Fix crash in lpfc nvmet when fc port is reset (bsc#1052384). - scsi: lpfc: Fix crash receiving ELS while detaching driver (bsc#1067735). - scsi: lpfc: Fix display for debugfs queInfo (bsc#1067735). - scsi: lpfc: Fix driver handling of nvme resources during unload (bsc#1067735). - scsi: lpfc: Fix duplicate NVME rport entries and namespaces (bsc#1052384). - scsi: lpfc: Fix FCP hba_wqidx assignment (bsc#1067735). - scsi: lpfc: Fix handling of FCP and NVME FC4 types in Pt2Pt topology (bsc#1052384). - scsi: lpfc: Fix hard lock up NMI in els timeout handling (bsc#1067735). - scsi: lpfc: fix "integer constant too large" error on 32bit archs (bsc#1052384). - scsi: lpfc: Fix loop mode target discovery (bsc#1052384). - scsi: lpfc: Fix lpfc nvme host rejecting IO with Not Ready message (bsc#1067735). - scsi: lpfc: Fix Lun Priority level shown as NA (bsc#1041873). - scsi: lpfc: Fix ndlp ref count for pt2pt mode issue RSCN (bsc#1067735). - scsi: lpfc: Fix NVME LS abort_xri (bsc#1067735). - scsi: lpfc: Fix nvme port role handling in sysfs and debugfs handlers (bsc#1041873). - scsi: lpfc: Fix NVME PRLI handling during RSCN (bsc#1052384). - scsi: lpfc: Fix nvme target failure after 2nd adapter reset (bsc#1052384). - scsi: lpfc: Fix nvmet node ref count handling (bsc#1041873). - scsi: lpfc: Fix oops if nvmet_fc_register_targetport fails (bsc#1067735). - scsi: lpfc: Fix oops of nvme host during driver unload (bsc#1067735). - scsi: lpfc: Fix oops when NVME Target is discovered in a nonNVME environment. - scsi: lpfc: fix pci hot plug crash in list_add call (bsc#1067735). - scsi: lpfc: fix pci hot plug crash in timer management routines (bsc#1067735). - scsi: lpfc: Fix plogi collision that causes illegal state transition (bsc#1052384). - scsi: lpfc: Fix Port going offline after multiple resets (bsc#1041873). - scsi: lpfc: Fix PRLI retry handling when target rejects it (bsc#1041873). - scsi: lpfc: Fix rediscovery on switch blade pull (bsc#1052384). - scsi: lpfc: Fix relative offset error on large nvmet target ios (bsc#1052384). - scsi: lpfc: Fix return value of board_mode store routine in case of online failure (bsc#1041873). - scsi: lpfc: Fix secure firmware updates (bsc#1067735). - scsi: lpfc: Fix System panic after loading the driver (bsc#1041873). - scsi: lpfc: Fix transition nvme-i rport handling to nport only (bsc#1041873). - scsi: lpfc: Fix vports not logging into target (bsc#1041873). - scsi: lpfc: Fix warning messages when NVME_TARGET_FC not defined (bsc#1067735). - scsi: lpfc: FLOGI failures are reported when connected to a private loop (bsc#1067735). - scsi: lpfc: Handle XRI_ABORTED_CQE in soft IRQ (bsc#1067735). - scsi: lpfc: Limit amount of work processed in IRQ (bsc#1052384). - scsi: lpfc: Linux LPFC driver does not process all RSCNs (bsc#1067735). - scsi: lpfc: lpfc version bump 11.4.0.3 (bsc#1052384). - scsi: lpfc: Make ktime sampling more accurate (bsc#1067735). - scsi: lpfc: Move CQ processing to a soft IRQ (bsc#1067735). - scsi: lpfc: Null pointer dereference when log_verbose is set to 0xffffffff (bsc#1041873). - scsi: lpfc: PLOGI failures during NPIV testing (bsc#1067735). - scsi: lpfc: Raise maximum NVME sg list size for 256 elements (bsc#1067735). - scsi: lpfc: Reduce log spew on controller reconnects (bsc#1067735). - scsi: lpfc: remove console log clutter (bsc#1052384). - scsi: lpfc: Revise NVME module parameter descriptions for better clarity (bsc#1067735). - scsi: lpfc: Set missing abort context (bsc#1067735). - scsi: lpfc: small sg cnt cleanup (bsc#1067735). - scsi: lpfc: spin_lock_irq() is not nestable (bsc#1045404). - scsi: lpfc: update driver version to 11.4.0.5 (bsc#1067735). - scsi: lpfc: update to revision to 11.4.0.0 (bsc#1041873). - scsi: megaraid_sas: mismatch of allocated MFI frame size and length exposed in MFI MPT pass through command (bsc#1066767). - scsi: qla2xxx: Cleanup debug message IDs (bsc#1043017). - scsi: qla2xxx: Correction to vha->vref_count timeout (bsc#1066812). - scsi: qla2xxx: Fix name server relogin (bsc#1043017). - scsi: qla2xxx: Fix path recovery (bsc#1043017). - scsi: qla2xxx: Initialize Work element before requesting IRQs (bsc#1019675,FATE#321701). - scsi: qla2xxx: Replace usage of spin_lock with spin_lock_irqsave (bsc#1043017). - scsi: qla2xxx: Retain loop test for fwdump length exceeding buffer length (bsc#1043017). - scsi: qla2xxx: Turn on FW option for exchange check (bsc#1043017). - scsi: qla2xxx: Use BIT_6 to acquire FAWWPN from switch (bsc#1066812). - scsi: qla2xxx: Use fabric name for Get Port Speed command (bsc#1066812). - scsi: qla2xxx: Use flag PFLG_DISCONNECTED (bsc#1043017). - scsi: reset wait for IO completion (bsc#996376). - scsi: scsi_devinfo: fixup string compare (bsc#1062941). updated patches.fixes/scsi_devinfo-fixup-string-compare.patch to the version merged upstream. - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941). - scsi: scsi_dh_emc: return success in clariion_std_inquiry() (bnc#1012382). - scsi: sd_zbc: Fix sd_zbc_read_zoned_characteristics() (bsc#1066812). - scsi: sg: close race condition in sg_remove_sfp_usercontext() (bsc#1064206). - scsi: sg: do not return bogus Sg_requests (bsc#1064206). - scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206). - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382). - scsi: ufs: add capability to keep auto bkops always enabled (bnc#1012382). - scsi: ufs-qcom: Fix module autoload (bnc#1012382). - scsi: zfcp: fix erp_action use-before-initialize in REC action trace (bnc#1012382). - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect (bnc#1012382). - sctp: do not peel off an assoc from one netns to another one (bnc#1012382). - sctp: do not peel off an assoc from one netns to another one (bnc#1012382). - sctp: potential read out of bounds in sctp_ulpevent_type_enabled() (bnc#1012382). - sctp: reset owner sk for data chunks on out queues when migrating a sock (bnc#1012382). - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382). - selftests: firmware: add empty string and async tests (bnc#1012382). - selftests: firmware: send expected errors to /dev/null (bnc#1012382). - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() (bsc#1031717). - serial: 8250_uniphier: fix serial port index in private data (bsc#1031717). - serial: Fix serial console on SNI RM400 machines (bsc#1031717). - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382). - serial: Remove unused port type (bsc#1066045). - serial: sh-sci: Fix register offsets for the IRDA serial port (bnc#1012382). - slub: do not merge cache if slub_debug contains a never-merge flag (bnc#1012382). - smb3: Validate negotiate request must always be signed (bsc#1064597). - smb: fix leak of validate negotiate info response buffer (bsc#1064597). - smb: fix validate negotiate info uninitialised memory use (bsc#1064597). - sparc64: Migrate hvcons irq to panicked cpu (bnc#1012382). - spi: SPI_FSL_DSPI should depend on HAS_DMA (bnc#1012382). - spi: uapi: spidev: add missing ioctl header (bnc#1012382). - staging: iio: cdc: fix improper return value (bnc#1012382). - staging: lustre: hsm: stack overrun in hai_dump_data_field (bnc#1012382). - staging: lustre: llite: do not invoke direct_IO for the EOF case (bnc#1012382). - staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382). - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382). - staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382). - staging: rtl8712: fixed little endian problem (bnc#1012382). - staging: rtl8712u: Fix endian settings for structs describing network packets (bnc#1012382). - sunrpc: Fix tracepoint storage issues with svc_recv and svc_rqst_status (bnc#1012382). - supported.conf: - supported.conf: add test_syctl to new kselftests-kmp package FATE#323821 As per FATE#323821 we will require new FATE requests per each new selftest driver. We do not want to support these module on production runs but we do want to support them for QA / testing uses. The compromise is to package them into its own package, this will be the kselftests-kmp package. Selftests can also be used as proof of concept vehicle for issues by customers or ourselves. Vanilla kernels do not get test_sysctl given that driver was using built-in defaults, this also means we cannot run sefltests on config/s390x/zfcpdump which does not enable modules. Likeweise, since we had to *change* the kernel for test_syctl, it it also means we can't test test_syctl with vanilla kernels. It should be possible with other selftests drivers if they are present in vanilla kernels though. - supported.conf: Support spidev (bsc#1066696) - sysctl: add unsigned int range support (FATE#323821) - target: fix ALUA state file path truncation (bsc#1064606). - target: Fix node_acl demo-mode + uncached dynamic shutdown regression (bnc#1012382). - target: fix PR state file path truncation (bsc#1064606). - target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382). - target/iscsi: Fix unsolicited data seq_end_offset calculation (bnc#1012382 bsc#1036489). - target/rbd: handle zero length UNMAP requests early (bsc#1064320). - target/rbd: use target_configure_unmap_from_queue() helper (bsc#1064320). - tcp/dccp: fix ireq->opt races (bnc#1012382). - tcp/dccp: fix lockdep splat in inet_csk_route_req() (bnc#1012382). - tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382). - tcp: do not mangle skb->cb[] in tcp_make_synack() (bnc#1012382). - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382). - test: firmware_class: report errors properly on failure (bnc#1012382). - test_sysctl: add dedicated proc sysctl test driver (FATE#323821) - test_sysctl: add generic script to expand on tests (FATE#323821) - test_sysctl: add simple proc_dointvec() case (FATE#323821). - test_sysctl: add simple proc_douintvec() case (bsc#323821). - test_sysctl: fix sysctl.sh by making it executable (FATE#323821). - test_sysctl: test against int proc_dointvec() array support (FATE#323821). - test_sysctl: test against PAGE_SIZE for int (FATE#323821) - timer: Prevent timer value 0 for MWAITX (bsc#1065717). - tipc: fix link attribute propagation bug (bnc#1012382). - tipc: use only positive error codes in messages (bnc#1012382). - tools: firmware: check for distro fallback udev cancel rule (bnc#1012382). - tpm: constify transmit data pointers (bsc#1020645, git-fixes). - tpm: kabi: do not bother with added const (bsc#1020645, git-fixes). - tpm_tis_spi: Use DMA-safe memory for SPI transfers (bsc#1020645, git-fixes). - tracing/samples: Fix creation and deletion of simple_thread_fn creation (bnc#1012382). - tun: allow positive return values on dev_get_valid_name() call (bnc#1012382). - tun: bail out from tun_get_user() if the skb is empty (bnc#1012382). - tun: call dev_get_valid_name() before register_netdevice() (bnc#1012382). - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382). - uapi: fix linux/mroute6.h userspace compilation errors (bnc#1012382). - uapi: fix linux/rds.h userspace compilation error (bnc#1012382). - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382). - uapi: fix linux/rds.h userspace compilation errors (bnc#1012382). - udpv6: Fix the checksum computation when HW checksum does not apply (bnc#1012382). - Update config files to enable spidev on arm64. (bsc#1066696) - Update preliminary FC-NVMe patches to mainline status (bsc#1067734) - usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382). - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382). - usb: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (bnc#1012382). - usb: devio: Revert "USB: devio: Do not corrupt user memory" (bnc#1012382). - usb: dummy-hcd: Fix deadlock caused by disconnect detection (bnc#1012382). - usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options (bnc#1012382). - usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382). - usb: hub: Allow reset retry for USB2 devices on connect bounce (bnc#1012382). - usb: musb: Check for host-mode using is_host_active() on reset interrupt (bnc#1012382). - usb: musb: sunxi: Explicitly release USB PHY on exit (bnc#1012382). - usb: quirks: add quirk for WORLDE MINI MIDI keyboard (bnc#1012382). - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet (bnc#1012382). - usb: serial: console: fix use-after-free after failed setup (bnc#1012382). - usb: serial: cp210x: add support for ELV TFD500 (bnc#1012382). - usb: serial: ftdi_sio: add id for Cypress WICED dev board (bnc#1012382). - usb: serial: garmin_gps: fix I/O after failed probe and remove (bnc#1012382). - usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382). - usb: serial: metro-usb: add MS7820 device id (bnc#1012382). - usb: serial: option: add support for TP-Link LTE module (bnc#1012382). - usb: serial: qcserial: add Dell DW5818, DW5819 (bnc#1012382). - usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update (bnc#1012382). - usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382). - usb: usbtest: fix NULL pointer dereference (bnc#1012382). - usb: xhci: Handle error condition in xhci_stop_device() (bnc#1012382). - vfs: expedite unmount (bsc#1024412). - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382). - video: udlfb: Fix read EDID timeout (bsc#1031717). - vlan: fix a use-after-free in vlan_device_event() (bnc#1012382). - vsock: use new wait API for vsock_stream_sendmsg() (bnc#1012382). - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit (bnc#1012382). - watchdog: kempld: fix gcc-4.3 build (bnc#1012382). - workqueue: Fix NULL pointer dereference (bnc#1012382). - workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382). - x86/acpi/cstate: Allow ACPI C1 FFH MWAIT use on AMD systems (bsc#1069879). - x86/alternatives: Fix alt_max_short macro to really be a max() (bnc#1012382). - x86/decoder: Add new TEST instruction pattern (bnc#1012382). - x86/MCE/AMD: Always give panic severity for UC errors in kernel context (git-fixes bf80bbd7dcf5). - x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032). - x86/microcode/intel: Disable late loading on model 79 (bnc#1012382). - x86/mm: fix use-after-free of vma during userfaultfd fault (Git-fixes, bsc#1069916). - x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context (bnc#1012382). - x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382). - xen: do not print error message in case of missing Xenstore entry (bnc#1012382). - xen/events: events_fifo: Do not use {get,put}_cpu() in xen_evtchn_fifo_init() (bnc#1065600). - xen: fix booting ballooned down hvm guest (bnc#1065600). - xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() (bnc#1012382). - xen/manage: correct return value check on xenbus_scanf() (bnc#1012382). - xen-netback: fix error handling output (bnc#1065600). - xen: x86: mark xen_find_pt_base as __init (bnc#1065600). - xen: xenbus driver must not accept invalid transaction ids (bnc#1012382). - zd1211rw: fix NULL-deref at probe (bsc#1031717). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2129=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2129=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2129=1 - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2017-2129=1 - SUSE Linux Enterprise High Availability 12-SP3: zypper in -t patch SUSE-SLE-HA-12-SP3-2017-2129=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2129=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2129=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): kernel-default-debuginfo-4.4.103-6.33.1 kernel-default-debugsource-4.4.103-6.33.1 kernel-default-extra-4.4.103-6.33.1 kernel-default-extra-debuginfo-4.4.103-6.33.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): kernel-obs-build-4.4.103-6.33.1 kernel-obs-build-debugsource-4.4.103-6.33.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): kernel-docs-4.4.103-6.33.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): kernel-default-4.4.103-6.33.1 kernel-default-base-4.4.103-6.33.1 kernel-default-base-debuginfo-4.4.103-6.33.1 kernel-default-debuginfo-4.4.103-6.33.1 kernel-default-debugsource-4.4.103-6.33.1 kernel-default-devel-4.4.103-6.33.1 kernel-syms-4.4.103-6.33.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): kernel-devel-4.4.103-6.33.1 kernel-macros-4.4.103-6.33.1 kernel-source-4.4.103-6.33.1 - SUSE Linux Enterprise Server 12-SP3 (s390x): kernel-default-man-4.4.103-6.33.1 - SUSE Linux Enterprise Live Patching 12-SP3 (ppc64le x86_64): kgraft-patch-4_4_103-6_33-default-1-4.3.1 kgraft-patch-4_4_103-6_33-default-debuginfo-1-4.3.1 - SUSE Linux Enterprise High Availability 12-SP3 (ppc64le s390x x86_64): cluster-md-kmp-default-4.4.103-6.33.1 cluster-md-kmp-default-debuginfo-4.4.103-6.33.1 dlm-kmp-default-4.4.103-6.33.1 dlm-kmp-default-debuginfo-4.4.103-6.33.1 gfs2-kmp-default-4.4.103-6.33.1 gfs2-kmp-default-debuginfo-4.4.103-6.33.1 kernel-default-debuginfo-4.4.103-6.33.1 kernel-default-debugsource-4.4.103-6.33.1 ocfs2-kmp-default-4.4.103-6.33.1 ocfs2-kmp-default-debuginfo-4.4.103-6.33.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): kernel-default-4.4.103-6.33.1 kernel-default-debuginfo-4.4.103-6.33.1 kernel-default-debugsource-4.4.103-6.33.1 kernel-default-devel-4.4.103-6.33.1 kernel-default-extra-4.4.103-6.33.1 kernel-default-extra-debuginfo-4.4.103-6.33.1 kernel-syms-4.4.103-6.33.1 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): kernel-devel-4.4.103-6.33.1 kernel-macros-4.4.103-6.33.1 kernel-source-4.4.103-6.33.1 - SUSE Container as a Service Platform ALL (x86_64): kernel-default-4.4.103-6.33.1 kernel-default-debuginfo-4.4.103-6.33.1 kernel-default-debugsource-4.4.103-6.33.1 References: https://www.suse.com/security/cve/CVE-2017-1000410.html https://www.suse.com/security/cve/CVE-2017-11600.html https://www.suse.com/security/cve/CVE-2017-12193.html https://www.suse.com/security/cve/CVE-2017-15115.html https://www.suse.com/security/cve/CVE-2017-16528.html https://www.suse.com/security/cve/CVE-2017-16536.html https://www.suse.com/security/cve/CVE-2017-16537.html https://www.suse.com/security/cve/CVE-2017-16645.html https://www.suse.com/security/cve/CVE-2017-16646.html https://www.suse.com/security/cve/CVE-2017-16994.html https://www.suse.com/security/cve/CVE-2017-17448.html https://www.suse.com/security/cve/CVE-2017-17449.html https://www.suse.com/security/cve/CVE-2017-17450.html https://www.suse.com/security/cve/CVE-2017-7482.html https://www.suse.com/security/cve/CVE-2017-8824.html https://bugzilla.suse.com/1010201 https://bugzilla.suse.com/1012382 https://bugzilla.suse.com/1012523 https://bugzilla.suse.com/1015336 https://bugzilla.suse.com/1015337 https://bugzilla.suse.com/1015340 https://bugzilla.suse.com/1015342 https://bugzilla.suse.com/1015343 https://bugzilla.suse.com/1019675 https://bugzilla.suse.com/1020412 https://bugzilla.suse.com/1020645 https://bugzilla.suse.com/1022595 https://bugzilla.suse.com/1022607 https://bugzilla.suse.com/1024346 https://bugzilla.suse.com/1024373 https://bugzilla.suse.com/1024376 https://bugzilla.suse.com/1024412 https://bugzilla.suse.com/1031717 https://bugzilla.suse.com/1032150 https://bugzilla.suse.com/1036489 https://bugzilla.suse.com/1036800 https://bugzilla.suse.com/1037404 https://bugzilla.suse.com/1037838 https://bugzilla.suse.com/1038299 https://bugzilla.suse.com/1039542 https://bugzilla.suse.com/1040073 https://bugzilla.suse.com/1041873 https://bugzilla.suse.com/1042268 https://bugzilla.suse.com/1042957 https://bugzilla.suse.com/1042977 https://bugzilla.suse.com/1042978 https://bugzilla.suse.com/1043017 https://bugzilla.suse.com/1045404 https://bugzilla.suse.com/1046054 https://bugzilla.suse.com/1046107 https://bugzilla.suse.com/1047901 https://bugzilla.suse.com/1047989 https://bugzilla.suse.com/1048317 https://bugzilla.suse.com/1048327 https://bugzilla.suse.com/1048356 https://bugzilla.suse.com/1050060 https://bugzilla.suse.com/1050231 https://bugzilla.suse.com/1051406 https://bugzilla.suse.com/1051635 https://bugzilla.suse.com/1051987 https://bugzilla.suse.com/1052384 https://bugzilla.suse.com/1053309 https://bugzilla.suse.com/1053919 https://bugzilla.suse.com/1055272 https://bugzilla.suse.com/1056003 https://bugzilla.suse.com/1056365 https://bugzilla.suse.com/1056427 https://bugzilla.suse.com/1056587 https://bugzilla.suse.com/1056596 https://bugzilla.suse.com/1056652 https://bugzilla.suse.com/1056979 https://bugzilla.suse.com/1057079 https://bugzilla.suse.com/1057199 https://bugzilla.suse.com/1057820 https://bugzilla.suse.com/1058413 https://bugzilla.suse.com/1059639 https://bugzilla.suse.com/1060333 https://bugzilla.suse.com/1061756 https://bugzilla.suse.com/1062496 https://bugzilla.suse.com/1062835 https://bugzilla.suse.com/1062941 https://bugzilla.suse.com/1063026 https://bugzilla.suse.com/1063349 https://bugzilla.suse.com/1063516 https://bugzilla.suse.com/1064206 https://bugzilla.suse.com/1064320 https://bugzilla.suse.com/1064591 https://bugzilla.suse.com/1064597 https://bugzilla.suse.com/1064606 https://bugzilla.suse.com/1064701 https://bugzilla.suse.com/1064926 https://bugzilla.suse.com/1065101 https://bugzilla.suse.com/1065180 https://bugzilla.suse.com/1065600 https://bugzilla.suse.com/1065639 https://bugzilla.suse.com/1065692 https://bugzilla.suse.com/1065717 https://bugzilla.suse.com/1065866 https://bugzilla.suse.com/1065959 https://bugzilla.suse.com/1066045 https://bugzilla.suse.com/1066175 https://bugzilla.suse.com/1066192 https://bugzilla.suse.com/1066213 https://bugzilla.suse.com/1066223 https://bugzilla.suse.com/1066285 https://bugzilla.suse.com/1066382 https://bugzilla.suse.com/1066470 https://bugzilla.suse.com/1066471 https://bugzilla.suse.com/1066472 https://bugzilla.suse.com/1066573 https://bugzilla.suse.com/1066606 https://bugzilla.suse.com/1066629 https://bugzilla.suse.com/1066660 https://bugzilla.suse.com/1066696 https://bugzilla.suse.com/1066767 https://bugzilla.suse.com/1066812 https://bugzilla.suse.com/1066974 https://bugzilla.suse.com/1067105 https://bugzilla.suse.com/1067132 https://bugzilla.suse.com/1067225 https://bugzilla.suse.com/1067494 https://bugzilla.suse.com/1067734 https://bugzilla.suse.com/1067735 https://bugzilla.suse.com/1067888 https://bugzilla.suse.com/1067906 https://bugzilla.suse.com/1068671 https://bugzilla.suse.com/1068978 https://bugzilla.suse.com/1068980 https://bugzilla.suse.com/1068982 https://bugzilla.suse.com/1069152 https://bugzilla.suse.com/1069250 https://bugzilla.suse.com/1069270 https://bugzilla.suse.com/1069277 https://bugzilla.suse.com/1069484 https://bugzilla.suse.com/1069583 https://bugzilla.suse.com/1069721 https://bugzilla.suse.com/1069793 https://bugzilla.suse.com/1069879 https://bugzilla.suse.com/1069916 https://bugzilla.suse.com/1069942 https://bugzilla.suse.com/1069996 https://bugzilla.suse.com/1070001 https://bugzilla.suse.com/1070006 https://bugzilla.suse.com/1070145 https://bugzilla.suse.com/1070169 https://bugzilla.suse.com/1070404 https://bugzilla.suse.com/1070535 https://bugzilla.suse.com/1070767 https://bugzilla.suse.com/1070771 https://bugzilla.suse.com/1070805 https://bugzilla.suse.com/1070825 https://bugzilla.suse.com/1070964 https://bugzilla.suse.com/1071693 https://bugzilla.suse.com/1071694 https://bugzilla.suse.com/1071695 https://bugzilla.suse.com/1071833 https://bugzilla.suse.com/1072589 https://bugzilla.suse.com/744692 https://bugzilla.suse.com/789311 https://bugzilla.suse.com/964944 https://bugzilla.suse.com/966170 https://bugzilla.suse.com/966172 https://bugzilla.suse.com/969470 https://bugzilla.suse.com/979928 https://bugzilla.suse.com/989261 https://bugzilla.suse.com/996376 From sle-updates at lists.suse.com Thu Dec 21 13:08:39 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:08:39 +0100 (CET) Subject: SUSE-RU-2017:3399-1: Recommended update for the SUSE OpenStack Cloud release-notes Message-ID: <20171221200839.DAAF6F7B6@maintenance.suse.de> SUSE Recommended Update: Recommended update for the SUSE OpenStack Cloud release-notes ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3399-1 Rating: low References: #1072420 Affected Products: SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for release-notes-suse-openstack-cloud fixes the following issues: - Update "upgrade" section. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2131=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (noarch): release-notes-suse-openstack-cloud-7.20171120-3.9.1 References: https://bugzilla.suse.com/1072420 From sle-updates at lists.suse.com Thu Dec 21 13:09:09 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:09:09 +0100 (CET) Subject: SUSE-RU-2017:3400-1: moderate: Recommended update for galera-3 and rubygem-mysql2 Message-ID: <20171221200909.5FCBCFC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for galera-3 and rubygem-mysql2 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3400-1 Rating: moderate References: #1067881 Affected Products: SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for galera-3 and rubygem-mysql2 fixes the following issues: galera-3: - Reporting last committed write set fixed to respect commit ordering. - GComm socket level error handling improved to avoid backend thread exit in case of unexpected input from ASIO IO service. - Race condition fixed in GComm message sending codepath. - Fix for EVS protocol stall due to exhausted send window setting. This bug could stall cluster messaging until the next keepalive was sent by some node, causing intermittent pauses in write set replication. rubygem-mysql2: - Fixed build-issue with libmariadb. - Fixed enable_cleartext_plugin mode. - Prepared statements should handle booleans properly. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2135=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64): galera-3-wsrep-provider-25.3.22-5.1 galera-3-wsrep-provider-debuginfo-25.3.22-5.1 ruby2.1-rubygem-mysql2-0.4.10-5.1 ruby2.1-rubygem-mysql2-debuginfo-0.4.10-5.1 References: https://bugzilla.suse.com/1067881 From sle-updates at lists.suse.com Thu Dec 21 13:09:34 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:09:34 +0100 (CET) Subject: SUSE-RU-2017:3401-1: moderate: Recommended update for rabbitmq-server Message-ID: <20171221200934.8AB28FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for rabbitmq-server ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3401-1 Rating: moderate References: #1072420 Affected Products: SUSE OpenStack Cloud 7 SUSE Enterprise Storage 4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rabbitmq-server fixes the following issues: - Made rabbitmq-server-ha OCF resource more solid. - Fixed issues where rabbitmq failed to start in clustered mode. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2130=1 - SUSE Enterprise Storage 4: zypper in -t patch SUSE-Storage-4-2017-2130=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64): rabbitmq-server-3.4.4-3.7.1 rabbitmq-server-plugins-3.4.4-3.7.1 - SUSE Enterprise Storage 4 (aarch64 x86_64): rabbitmq-server-3.4.4-3.7.1 References: https://bugzilla.suse.com/1072420 From sle-updates at lists.suse.com Thu Dec 21 13:10:00 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:10:00 +0100 (CET) Subject: SUSE-RU-2017:3402-1: moderate: Recommended update for the OpenStack Python dependencies Message-ID: <20171221201000.6D43CFC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for the OpenStack Python dependencies ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3402-1 Rating: moderate References: #1072420 Affected Products: SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for the OpenStack Python dependencies fixes the following issues: python-heatclient: - Handle empty sections in environment files. - Build event stack_name from links. - Don't resolve outputs when polling events. python-oslo.messaging: - rabbit: Restore synchronous ack/requeue. - rabbit: Make ack/requeue thread-safe. - tests: Fix MultiStrOpt value. - rabbit: Log correct topic on cast/call. - Fix an reconnection error when rabbitmq node goes down. python-neutronclient: - Added --enable-snat option for router-gateway-set. - Disable VPNaaS functional tests in the neutronclient gate. - Use stable/newton for upper-constraints.txt and tox_install.sh. - Handle keystoneauth exceptions in retry logic. - Convert gate_hook to devstack-tools. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2133=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (noarch): python-heatclient-1.5.2-3.3.1 python-heatclient-doc-1.5.2-3.3.1 python-neutronclient-6.0.1-3.3.1 python-oslo.messaging-5.10.2-3.3.1 References: https://bugzilla.suse.com/1072420 From sle-updates at lists.suse.com Thu Dec 21 13:10:27 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:10:27 +0100 (CET) Subject: SUSE-RU-2017:3403-1: moderate: Recommended update for qemu Message-ID: <20171221201027.28C18FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for qemu ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3403-1 Rating: moderate References: #1048902 #1069178 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for qemu provides the following fix: - A previously released update introduced a regression making qemu use too much memory for Xen usage. (bsc#1069178) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2138=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2138=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2138=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): qemu-2.6.2-41.28.1 qemu-arm-2.6.2-41.28.1 qemu-arm-debuginfo-2.6.2-41.28.1 qemu-block-curl-2.6.2-41.28.1 qemu-block-curl-debuginfo-2.6.2-41.28.1 qemu-block-rbd-2.6.2-41.28.1 qemu-block-rbd-debuginfo-2.6.2-41.28.1 qemu-block-ssh-2.6.2-41.28.1 qemu-block-ssh-debuginfo-2.6.2-41.28.1 qemu-debugsource-2.6.2-41.28.1 qemu-guest-agent-2.6.2-41.28.1 qemu-guest-agent-debuginfo-2.6.2-41.28.1 qemu-lang-2.6.2-41.28.1 qemu-tools-2.6.2-41.28.1 qemu-tools-debuginfo-2.6.2-41.28.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): qemu-ipxe-1.0.0-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): qemu-2.6.2-41.28.1 qemu-block-curl-2.6.2-41.28.1 qemu-block-curl-debuginfo-2.6.2-41.28.1 qemu-block-ssh-2.6.2-41.28.1 qemu-block-ssh-debuginfo-2.6.2-41.28.1 qemu-debugsource-2.6.2-41.28.1 qemu-guest-agent-2.6.2-41.28.1 qemu-guest-agent-debuginfo-2.6.2-41.28.1 qemu-lang-2.6.2-41.28.1 qemu-tools-2.6.2-41.28.1 qemu-tools-debuginfo-2.6.2-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 x86_64): qemu-block-rbd-2.6.2-41.28.1 qemu-block-rbd-debuginfo-2.6.2-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): qemu-kvm-2.6.2-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le): qemu-ppc-2.6.2-41.28.1 qemu-ppc-debuginfo-2.6.2-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64): qemu-arm-2.6.2-41.28.1 qemu-arm-debuginfo-2.6.2-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): qemu-ipxe-1.0.0-41.28.1 qemu-seabios-1.9.1-41.28.1 qemu-sgabios-8-41.28.1 qemu-vgabios-1.9.1-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): qemu-x86-2.6.2-41.28.1 - SUSE Linux Enterprise Server 12-SP2 (s390x): qemu-s390-2.6.2-41.28.1 qemu-s390-debuginfo-2.6.2-41.28.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): qemu-2.6.2-41.28.1 qemu-block-curl-2.6.2-41.28.1 qemu-block-curl-debuginfo-2.6.2-41.28.1 qemu-debugsource-2.6.2-41.28.1 qemu-kvm-2.6.2-41.28.1 qemu-tools-2.6.2-41.28.1 qemu-tools-debuginfo-2.6.2-41.28.1 qemu-x86-2.6.2-41.28.1 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): qemu-ipxe-1.0.0-41.28.1 qemu-seabios-1.9.1-41.28.1 qemu-sgabios-8-41.28.1 qemu-vgabios-1.9.1-41.28.1 References: https://bugzilla.suse.com/1048902 https://bugzilla.suse.com/1069178 From sle-updates at lists.suse.com Thu Dec 21 13:11:07 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:11:07 +0100 (CET) Subject: SUSE-RU-2017:3404-1: Recommended update for libvirt Message-ID: <20171221201107.97792FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for libvirt ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3404-1 Rating: low References: #1035442 #1062620 #1062760 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for libvirt provides the following fixes: - daemon: drop minsize directive from hypervisor logrotate files (bsc#1062760) - nodedev: Increase the netlink socket buffer size (bsc#1035442) - spec: libvirt-daemon-qemu requires libvirt-daemon-driver-storage (bsc#1062620) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-2140=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2140=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2140=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2140=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2140=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): libvirt-client-32bit-2.0.0-27.24.2 libvirt-client-debuginfo-32bit-2.0.0-27.24.2 libvirt-debugsource-2.0.0-27.24.2 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libvirt-debugsource-2.0.0-27.24.2 libvirt-devel-2.0.0-27.24.2 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libvirt-2.0.0-27.24.2 libvirt-client-2.0.0-27.24.2 libvirt-client-debuginfo-2.0.0-27.24.2 libvirt-daemon-2.0.0-27.24.2 libvirt-daemon-config-network-2.0.0-27.24.2 libvirt-daemon-config-nwfilter-2.0.0-27.24.2 libvirt-daemon-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-interface-2.0.0-27.24.2 libvirt-daemon-driver-interface-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-lxc-2.0.0-27.24.2 libvirt-daemon-driver-lxc-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-network-2.0.0-27.24.2 libvirt-daemon-driver-network-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-nodedev-2.0.0-27.24.2 libvirt-daemon-driver-nodedev-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-nwfilter-2.0.0-27.24.2 libvirt-daemon-driver-nwfilter-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-qemu-2.0.0-27.24.2 libvirt-daemon-driver-qemu-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-secret-2.0.0-27.24.2 libvirt-daemon-driver-secret-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-storage-2.0.0-27.24.2 libvirt-daemon-driver-storage-debuginfo-2.0.0-27.24.2 libvirt-daemon-lxc-2.0.0-27.24.2 libvirt-daemon-qemu-2.0.0-27.24.2 libvirt-debugsource-2.0.0-27.24.2 libvirt-doc-2.0.0-27.24.2 libvirt-lock-sanlock-2.0.0-27.24.2 libvirt-lock-sanlock-debuginfo-2.0.0-27.24.2 libvirt-nss-2.0.0-27.24.2 libvirt-nss-debuginfo-2.0.0-27.24.2 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libvirt-2.0.0-27.24.2 libvirt-client-2.0.0-27.24.2 libvirt-client-debuginfo-2.0.0-27.24.2 libvirt-daemon-2.0.0-27.24.2 libvirt-daemon-config-network-2.0.0-27.24.2 libvirt-daemon-config-nwfilter-2.0.0-27.24.2 libvirt-daemon-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-interface-2.0.0-27.24.2 libvirt-daemon-driver-interface-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-lxc-2.0.0-27.24.2 libvirt-daemon-driver-lxc-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-network-2.0.0-27.24.2 libvirt-daemon-driver-network-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-nodedev-2.0.0-27.24.2 libvirt-daemon-driver-nodedev-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-nwfilter-2.0.0-27.24.2 libvirt-daemon-driver-nwfilter-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-qemu-2.0.0-27.24.2 libvirt-daemon-driver-qemu-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-secret-2.0.0-27.24.2 libvirt-daemon-driver-secret-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-storage-2.0.0-27.24.2 libvirt-daemon-driver-storage-debuginfo-2.0.0-27.24.2 libvirt-daemon-lxc-2.0.0-27.24.2 libvirt-daemon-qemu-2.0.0-27.24.2 libvirt-debugsource-2.0.0-27.24.2 libvirt-doc-2.0.0-27.24.2 libvirt-lock-sanlock-2.0.0-27.24.2 libvirt-lock-sanlock-debuginfo-2.0.0-27.24.2 libvirt-nss-2.0.0-27.24.2 libvirt-nss-debuginfo-2.0.0-27.24.2 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libvirt-daemon-driver-libxl-2.0.0-27.24.2 libvirt-daemon-driver-libxl-debuginfo-2.0.0-27.24.2 libvirt-daemon-xen-2.0.0-27.24.2 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): libvirt-2.0.0-27.24.2 libvirt-client-2.0.0-27.24.2 libvirt-client-32bit-2.0.0-27.24.2 libvirt-client-debuginfo-2.0.0-27.24.2 libvirt-client-debuginfo-32bit-2.0.0-27.24.2 libvirt-daemon-2.0.0-27.24.2 libvirt-daemon-config-network-2.0.0-27.24.2 libvirt-daemon-config-nwfilter-2.0.0-27.24.2 libvirt-daemon-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-interface-2.0.0-27.24.2 libvirt-daemon-driver-interface-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-libxl-2.0.0-27.24.2 libvirt-daemon-driver-libxl-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-lxc-2.0.0-27.24.2 libvirt-daemon-driver-lxc-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-network-2.0.0-27.24.2 libvirt-daemon-driver-network-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-nodedev-2.0.0-27.24.2 libvirt-daemon-driver-nodedev-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-nwfilter-2.0.0-27.24.2 libvirt-daemon-driver-nwfilter-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-qemu-2.0.0-27.24.2 libvirt-daemon-driver-qemu-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-secret-2.0.0-27.24.2 libvirt-daemon-driver-secret-debuginfo-2.0.0-27.24.2 libvirt-daemon-driver-storage-2.0.0-27.24.2 libvirt-daemon-driver-storage-debuginfo-2.0.0-27.24.2 libvirt-daemon-lxc-2.0.0-27.24.2 libvirt-daemon-qemu-2.0.0-27.24.2 libvirt-daemon-xen-2.0.0-27.24.2 libvirt-debugsource-2.0.0-27.24.2 libvirt-doc-2.0.0-27.24.2 References: https://bugzilla.suse.com/1035442 https://bugzilla.suse.com/1062620 https://bugzilla.suse.com/1062760 From sle-updates at lists.suse.com Thu Dec 21 13:12:01 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:12:01 +0100 (CET) Subject: SUSE-RU-2017:3405-1: moderate: Recommended update for OpenStack Monasca Message-ID: <20171221201201.7723CFC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for OpenStack Monasca ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3405-1 Rating: moderate References: #1072420 Affected Products: SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openstack-monasca-api fixes the following issues: openstack-monasca-api: - Update to version 1.7.1~dev7. openstack-monasca-agent: - Update to version 1.9.2 dev3. - Readd nsfs to the list of ignored filesystems. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2132=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (noarch): openstack-monasca-agent-1.10.1~dev2-5.1 openstack-monasca-api-1.7.1~dev7-6.1 python-monasca-agent-1.10.1~dev2-5.1 python-monasca-api-1.7.1~dev7-6.1 References: https://bugzilla.suse.com/1072420 From sle-updates at lists.suse.com Thu Dec 21 13:12:27 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:12:27 +0100 (CET) Subject: SUSE-RU-2017:3406-1: moderate: Recommended update for dbus-1 Message-ID: <20171221201227.5A3D2FCA4@maintenance.suse.de> SUSE Recommended Update: Recommended update for dbus-1 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3406-1 Rating: moderate References: #1071698 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dbus-1 provides the following fix: - The previously released fix for systemd-logind dbus disconnections was missing in some parts of the package, so properly apply it. (bsc#1071698) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2139=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2139=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2139=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2139=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2139=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): dbus-1-debuginfo-1.8.22-24.14.1 dbus-1-debugsource-1.8.22-24.14.1 dbus-1-devel-1.8.22-24.14.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): dbus-1-devel-doc-1.8.22-24.14.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): dbus-1-1.8.22-24.14.1 dbus-1-debuginfo-1.8.22-24.14.1 dbus-1-debugsource-1.8.22-24.14.1 dbus-1-x11-1.8.22-24.14.1 dbus-1-x11-debuginfo-1.8.22-24.14.1 dbus-1-x11-debugsource-1.8.22-24.14.1 libdbus-1-3-1.8.22-24.14.1 libdbus-1-3-debuginfo-1.8.22-24.14.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): dbus-1-1.8.22-24.14.1 dbus-1-debuginfo-1.8.22-24.14.1 dbus-1-debugsource-1.8.22-24.14.1 dbus-1-x11-1.8.22-24.14.1 dbus-1-x11-debuginfo-1.8.22-24.14.1 dbus-1-x11-debugsource-1.8.22-24.14.1 libdbus-1-3-1.8.22-24.14.1 libdbus-1-3-debuginfo-1.8.22-24.14.1 - SUSE Linux Enterprise Server 12-SP2 (s390x x86_64): dbus-1-debuginfo-32bit-1.8.22-24.14.1 libdbus-1-3-32bit-1.8.22-24.14.1 libdbus-1-3-debuginfo-32bit-1.8.22-24.14.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): dbus-1-1.8.22-24.14.1 dbus-1-debuginfo-1.8.22-24.14.1 dbus-1-debuginfo-32bit-1.8.22-24.14.1 dbus-1-debugsource-1.8.22-24.14.1 dbus-1-x11-1.8.22-24.14.1 dbus-1-x11-debuginfo-1.8.22-24.14.1 dbus-1-x11-debugsource-1.8.22-24.14.1 libdbus-1-3-1.8.22-24.14.1 libdbus-1-3-32bit-1.8.22-24.14.1 libdbus-1-3-debuginfo-1.8.22-24.14.1 libdbus-1-3-debuginfo-32bit-1.8.22-24.14.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): dbus-1-1.8.22-24.14.1 dbus-1-debuginfo-1.8.22-24.14.1 dbus-1-debugsource-1.8.22-24.14.1 dbus-1-x11-debuginfo-1.8.22-24.14.1 dbus-1-x11-debugsource-1.8.22-24.14.1 libdbus-1-3-1.8.22-24.14.1 libdbus-1-3-debuginfo-1.8.22-24.14.1 References: https://bugzilla.suse.com/1071698 From sle-updates at lists.suse.com Thu Dec 21 13:12:52 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:12:52 +0100 (CET) Subject: SUSE-RU-2017:3407-1: moderate: Recommended update for dbus-1 Message-ID: <20171221201252.39BA0FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for dbus-1 ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3407-1 Rating: moderate References: #1046173 #1071698 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dbus-1 provides the following fixes: - The previously released fix for systemd-logind dbus disconnections was missing in some parts of the package, so properly apply it. (bsc#1071698) - Remove call to initscripts related macros from the spec file as dbus-1 does not ship any initscript anymore. (bsc#1046173) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2137=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2137=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2137=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2137=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): dbus-1-debugsource-1.8.22-29.10.2 dbus-1-devel-1.8.22-29.10.2 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): dbus-1-devel-doc-1.8.22-29.10.2 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): dbus-1-1.8.22-29.10.2 dbus-1-debuginfo-1.8.22-29.10.2 dbus-1-debugsource-1.8.22-29.10.2 dbus-1-x11-1.8.22-29.10.2 dbus-1-x11-debuginfo-1.8.22-29.10.2 dbus-1-x11-debugsource-1.8.22-29.10.2 libdbus-1-3-1.8.22-29.10.2 libdbus-1-3-debuginfo-1.8.22-29.10.2 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): libdbus-1-3-32bit-1.8.22-29.10.2 libdbus-1-3-debuginfo-32bit-1.8.22-29.10.2 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): dbus-1-1.8.22-29.10.2 dbus-1-debuginfo-1.8.22-29.10.2 dbus-1-debugsource-1.8.22-29.10.2 dbus-1-x11-1.8.22-29.10.2 dbus-1-x11-debuginfo-1.8.22-29.10.2 dbus-1-x11-debugsource-1.8.22-29.10.2 libdbus-1-3-1.8.22-29.10.2 libdbus-1-3-32bit-1.8.22-29.10.2 libdbus-1-3-debuginfo-1.8.22-29.10.2 libdbus-1-3-debuginfo-32bit-1.8.22-29.10.2 - SUSE Container as a Service Platform ALL (x86_64): dbus-1-1.8.22-29.10.2 dbus-1-debuginfo-1.8.22-29.10.2 dbus-1-debugsource-1.8.22-29.10.2 dbus-1-nox11-1.8.22-29.10.2 dbus-1-nox11-debuginfo-1.8.22-29.10.2 dbus-1-x11-debuginfo-1.8.22-29.10.2 dbus-1-x11-debugsource-1.8.22-29.10.2 libdbus-1-3-1.8.22-29.10.2 libdbus-1-3-debuginfo-1.8.22-29.10.2 References: https://bugzilla.suse.com/1046173 https://bugzilla.suse.com/1071698 From sle-updates at lists.suse.com Thu Dec 21 13:13:25 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:13:25 +0100 (CET) Subject: SUSE-RU-2017:3408-1: moderate: Recommended update for rubygem-yajl-ruby Message-ID: <20171221201325.7579BFC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for rubygem-yajl-ruby ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3408-1 Rating: moderate References: #1066565 Affected Products: SUSE OpenStack Cloud 7 SUSE OpenStack Cloud 6 SUSE Enterprise Storage 4 SUSE Enterprise Storage 3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-yajl-ruby provides the following fixes: - Update to version 1.3.1 - Fix crafted JSON file allows to crash ruby process with a SIGABRT (bsc#1066565, CVE-2017-1651) Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2136=1 - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-2136=1 - SUSE Enterprise Storage 4: zypper in -t patch SUSE-Storage-4-2017-2136=1 - SUSE Enterprise Storage 3: zypper in -t patch SUSE-Storage-3-2017-2136=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (aarch64 s390x x86_64): ruby2.1-rubygem-yajl-ruby-1.3.1-4.3.2 ruby2.1-rubygem-yajl-ruby-debuginfo-1.3.1-4.3.2 rubygem-yajl-ruby-debugsource-1.3.1-4.3.2 - SUSE OpenStack Cloud 6 (x86_64): ruby2.1-rubygem-yajl-ruby-1.3.1-4.3.2 ruby2.1-rubygem-yajl-ruby-debuginfo-1.3.1-4.3.2 rubygem-yajl-ruby-debugsource-1.3.1-4.3.2 - SUSE Enterprise Storage 4 (aarch64 x86_64): ruby2.1-rubygem-yajl-ruby-1.3.1-4.3.2 ruby2.1-rubygem-yajl-ruby-debuginfo-1.3.1-4.3.2 rubygem-yajl-ruby-debugsource-1.3.1-4.3.2 - SUSE Enterprise Storage 3 (aarch64 x86_64): ruby2.1-rubygem-yajl-ruby-1.3.1-4.3.2 ruby2.1-rubygem-yajl-ruby-debuginfo-1.3.1-4.3.2 rubygem-yajl-ruby-debugsource-1.3.1-4.3.2 References: https://www.suse.com/security/cve/CVE-2017-1651.html https://bugzilla.suse.com/1066565 From sle-updates at lists.suse.com Thu Dec 21 13:13:50 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Thu, 21 Dec 2017 21:13:50 +0100 (CET) Subject: SUSE-RU-2017:3409-1: moderate: Recommended update for OpenStack Message-ID: <20171221201350.CE8F4FC9D@maintenance.suse.de> SUSE Recommended Update: Recommended update for OpenStack ______________________________________________________________________________ Announcement ID: SUSE-RU-2017:3409-1 Rating: moderate References: #1046787 #1061197 #1064060 #1064088 #1064704 Affected Products: SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update for OpenStack brings the latest version provided by the OpenStack upstream project and fixes various issues. openstack-barbican: - Fix pep8 gate failure because of missing dependency. openstack-ceilometer: - Remove incorrect configuration parameters from the ceilometer expirer cron script. The location of configuration files is computed automatically by oslo.config. (bsc#1061197, bsc#1064060, bsc#1046787, bsc#1064088) openstack-dashboard: - Drop LBaaS v1 dashboard after the feature was removed from neutron-lbaas in Newton. openstack-heat-templates: - Replace LBaaS with LBaaSv2. openstack-keystone: - Add patch to allow setting ldap.OPT_NETWORK_TIMEOUT. (bsc#1064704) openstack-neutron: - Add missing /etc/neutron/neutron-metering-agent.conf.d directory. openstack-neutron-fwaas: - Switch to use stable data\_utils - Modify an order between iptables and conntrack when update firewall. openstack-nova: - Refined fix for validating image on rebuild. - Update bindep.txt for doc builds. openstack-octavia: - Remove usage of credentials\_factory.AdminManager. openstack-sahara: - Fix error during node group template update. Patch Instructions: To install this SUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2017-2134=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 7 (noarch): openstack-barbican-3.0.1~dev9-2.7.1 openstack-barbican-api-3.0.1~dev9-2.7.1 openstack-barbican-doc-3.0.1~dev9-2.7.3 openstack-barbican-keystone-listener-3.0.1~dev9-2.7.1 openstack-barbican-retry-3.0.1~dev9-2.7.1 openstack-barbican-worker-3.0.1~dev9-2.7.1 openstack-ceilometer-7.1.1~dev4-4.12.1 openstack-ceilometer-agent-central-7.1.1~dev4-4.12.1 openstack-ceilometer-agent-compute-7.1.1~dev4-4.12.1 openstack-ceilometer-agent-ipmi-7.1.1~dev4-4.12.1 openstack-ceilometer-agent-notification-7.1.1~dev4-4.12.1 openstack-ceilometer-api-7.1.1~dev4-4.12.1 openstack-ceilometer-collector-7.1.1~dev4-4.12.1 openstack-ceilometer-doc-7.1.1~dev4-4.12.2 openstack-ceilometer-polling-7.1.1~dev4-4.12.1 openstack-dashboard-10.0.6~dev4-4.6.1 openstack-heat-templates-0.0.0+git.1512592135.eb93bfe-9.1 openstack-keystone-10.0.3~dev9-7.9.1 openstack-keystone-doc-10.0.3~dev9-7.9.2 openstack-neutron-9.4.2~dev21-7.12.1 openstack-neutron-dhcp-agent-9.4.2~dev21-7.12.1 openstack-neutron-doc-9.4.2~dev21-7.12.3 openstack-neutron-fwaas-9.0.2~dev5-4.3.3 openstack-neutron-fwaas-doc-9.0.2~dev5-4.3.5 openstack-neutron-ha-tool-9.4.2~dev21-7.12.1 openstack-neutron-l3-agent-9.4.2~dev21-7.12.1 openstack-neutron-linuxbridge-agent-9.4.2~dev21-7.12.1 openstack-neutron-macvtap-agent-9.4.2~dev21-7.12.1 openstack-neutron-metadata-agent-9.4.2~dev21-7.12.1 openstack-neutron-metering-agent-9.4.2~dev21-7.12.1 openstack-neutron-openvswitch-agent-9.4.2~dev21-7.12.1 openstack-neutron-server-9.4.2~dev21-7.12.1 openstack-nova-14.0.11~dev2-4.14.1 openstack-nova-api-14.0.11~dev2-4.14.1 openstack-nova-cells-14.0.11~dev2-4.14.1 openstack-nova-cert-14.0.11~dev2-4.14.1 openstack-nova-compute-14.0.11~dev2-4.14.1 openstack-nova-conductor-14.0.11~dev2-4.14.1 openstack-nova-console-14.0.11~dev2-4.14.1 openstack-nova-consoleauth-14.0.11~dev2-4.14.1 openstack-nova-doc-14.0.11~dev2-4.14.3 openstack-nova-novncproxy-14.0.11~dev2-4.14.1 openstack-nova-placement-api-14.0.11~dev2-4.14.1 openstack-nova-scheduler-14.0.11~dev2-4.14.1 openstack-nova-serialproxy-14.0.11~dev2-4.14.1 openstack-nova-vncproxy-14.0.11~dev2-4.14.1 openstack-octavia-0.9.2~dev16-3.6.1 openstack-octavia-amphora-agent-0.9.2~dev16-3.6.1 openstack-octavia-api-0.9.2~dev16-3.6.1 openstack-octavia-health-manager-0.9.2~dev16-3.6.1 openstack-octavia-housekeeping-0.9.2~dev16-3.6.1 openstack-octavia-worker-0.9.2~dev16-3.6.1 openstack-sahara-5.0.2~dev3-9.1 openstack-sahara-api-5.0.2~dev3-9.1 openstack-sahara-doc-5.0.2~dev3-9.1 openstack-sahara-engine-5.0.2~dev3-9.1 python-barbican-3.0.1~dev9-2.7.1 python-ceilometer-7.1.1~dev4-4.12.1 python-horizon-10.0.6~dev4-4.6.1 python-keystone-10.0.3~dev9-7.9.1 python-neutron-9.4.2~dev21-7.12.1 python-neutron-fwaas-9.0.2~dev5-4.3.3 python-nova-14.0.11~dev2-4.14.1 python-octavia-0.9.2~dev16-3.6.1 python-sahara-5.0.2~dev3-9.1 References: https://bugzilla.suse.com/1046787 https://bugzilla.suse.com/1061197 https://bugzilla.suse.com/1064060 https://bugzilla.suse.com/1064088 https://bugzilla.suse.com/1064704 From sle-updates at lists.suse.com Thu Dec 21 16:07:56 2017 From: sle-updates at lists.suse.com (sle-updates at lists.suse.com) Date: Fri, 22 Dec 2017 00:07:56 +0100 (CET) Subject: SUSE-SU-2017:3410-1: important: Security update for the Linux Kernel Message-ID: <20171221230756.6BE25FCA4@maintenance.suse.de> SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3410-1 Rating: important References: #1010201 #1012382 #1012829 #1017461 #1020645 #1021424 #1022595 #1022600 #1022914 #1024412 #1025461 #1027301 #1028971 #1030061 #1031717 #1034048 #1037890 #1046107 #1050060 #1050231 #1053919 #1055567 #1056003 #1056365 #1056427 #1056979 #1057199 #1058135 #1059863 #1060333 #1060682 #1060985 #1061451 #1061756 #1062520 #1062941 #1062962 #1063026 #1063460 #1063475 #1063501 #1063509 #1063516 #1063520 #1063695 #1064206 #1064701 #1064926 #1065180 #1065600 #1065639 #1065692 #1065717 #1065866 #1066045 #1066192 #1066213 #1066223 #1066285 #1066382 #1066470 #1066471 #1066472 #1066573 #1066606 #1066629 #1067105 #1067132 #1067494 #1067888 #1068671 #1068978 #1068980 #1068982 #1069270 #1069793 #1069942 #1069996 #1070006 #1070145 #1070535 #1070767 #1070771 #1070805 #1070825 #1070964 #1071231 #1071693 #1071694 #1071695 #1071833 #963575 #964944 #966170 #966172 #966186 #966191 #966316 #966318 #969474 #969475 #969476 #969477 #971975 #974590 #979928 #989261 #996376 Cross-References: CVE-2017-1000410 CVE-2017-11600 CVE-2017-12193 CVE-2017-15115 CVE-2017-15265 CVE-2017-16528 CVE-2017-16536 CVE-2017-16537 CVE-2017-16645 CVE-2017-16646 CVE-2017-16994 CVE-2017-17448 CVE-2017-17449 CVE-2017-17450 CVE-2017-7482 CVE-2017-8824 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise High Availability 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has 92 fixes is now available. Description: The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.103 to receive various security and bugfixes. This update enables SMB encryption in the CIFS support in the Linux Kernel (fate#324404) The following security bugs were fixed: - CVE-2017-1000410: The Linux kernel was affected by an information leak in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. (bnc#1070535). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520). - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132). - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105). - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996). - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693). - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). The following non-security bugs were fixed: - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717). - adv7604: Initialize drive strength to default when using DT (bnc#1012382). - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382). - alsa: au88x0: avoid theoretical uninitialized access (bnc#1012382). - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382). - alsa: compress: Remove unused variable (bnc#1012382). - alsa: hda: Add Raven PCI ID (bnc#1012382). - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE (bnc#1012382). - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717). - alsa: hda - fix headset mic problem for Dell machines with alc236 (bnc#1012382). - alsa: hda - No loopback on ALC299 codec (git-fixes). - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon (bsc#1031717). - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382). - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382). - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717). - alsa: hda: Remove superfluous '-' added by printk conversion (bnc#1012382). - alsa: line6: Fix leftover URB at error-path during probe (bnc#1012382). - alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717). - alsa: seq: Avoid invalid lockdep class warning (bsc#1031717). - alsa: seq: Enable 'use' locking in all configurations (bnc#1012382). - alsa: seq: Fix copy_from_user() call inside lock (bnc#1012382). - alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382). - alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382). - alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382). - alsa: timer: Remove kernel warning at compat ioctl error paths (bsc#1031717). - alsa: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital (bnc#1012382). - alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717). - alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717). - alsa: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (bnc#1012382). - alsa: usb-audio: Fix potential out-of-bound access at parsing SU (bsc#1031717). - alsa: usb-audio: Kill stray URB at exiting (bnc#1012382). - alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717). - alsa: usx2y: Suppress kernel warning at page allocation failures (bnc#1012382). - alsa: vx: Do not try to update capture stream before running (bnc#1012382). - alsa: vx: Fix possible transfer overflow (bnc#1012382). - Apply generic ppc build fixes to vanilla (bsc#1070805) - arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382). - arm64: ensure __dump_instr() checks addr_limit (bnc#1012382). - arm64: fix dump_instr when PAN and UAO are in use (bnc#1012382). - arm: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM (bnc#1012382). - arm: 8715/1: add a private asm/unaligned.h (bnc#1012382). - arm: 8720/1: ensure dump_instr() checks addr_limit (bnc#1012382). - arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382). - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bnc#1012382). - arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382). - arm: dts: Fix am335x and dm814x scm syscon to probe children (bnc#1012382). - arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382). - arm: dts: Fix omap3 off mode pull defines (bnc#1012382). - arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382). - arm: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes (bnc#1012382). - arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382). - arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6 (bnc#1012382). - arm: pxa: Do not rely on public mmc header to include leds.h (bnc#1012382). - arm: remove duplicate 'const' annotations' (bnc#1012382). - asm/sections: add helpers to check for section data (bsc#1063026). - asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382). - asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717). - asoc: dapm: fix some pointer error handling (bnc#1012382). - asoc: dapm: handle probe deferrals (bnc#1012382). - asoc: davinci-mcasp: Fix an error handling path in 'davinci_mcasp_probe()' (bsc#1031717). - asoc: rsnd: do not double free kctrl (bnc#1012382). - asoc: samsung: Fix possible double iounmap on s3c24xx driver probe failure (bsc#1031717). - asoc: wm_adsp: Do not overrun firmware file buffer when reading region data (bnc#1012382). - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382). - ata: fixes kernel crash while tracing ata_eh_link_autopsy event (bnc#1012382). - ata: SATA_HIGHBANK should depend on HAS_DMA (bnc#1012382). - ata: SATA_MV should depend on HAS_DMA (bnc#1012382). - ath10k: convert warning about non-existent OTP board id to debug message (git-fixes). - ath10k: fix a warning during channel switch with multiple vaps (bsc#1031717). - ath10k: fix board data fetch error message (bsc#1031717). - ath10k: fix diag_read to collect data for larger memory (bsc#1031717). - ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382). - ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() (bnc#1012382). - ath10k: free cached fw bin contents when get board id fails (bsc#1031717). - ath10k: ignore configuring the incorrect board_id (bnc#1012382). - ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382). - ath9k_htc: check for underflow in ath9k_htc_rx_msg() (bsc#1031717). - ath9k: off by one in ath9k_hw_nvram_read_array() (bsc#1031717). - audit: log 32-bit socketcalls (bnc#1012382). - autofs: do not fail mount for transient error (bsc#1065180). - backlight: adp5520: Fix error handling in adp5520_bl_probe() (bnc#1012382). - backlight: lcd: Fix race condition during register (bnc#1012382). - bcache: check ca->alloc_thread initialized before wake up it (bnc#1012382). - block: Fix a race between blk_cleanup_queue() and timeout handling (FATE#319965, bsc#964944). - bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382). - bnxt_en: Call firmware to approve the random VF MAC address (bsc#963575 FATE#320144). - bnxt_en: Do not setup MAC address in bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144). - bnxt_en: Fix possible corrupted NVRAM parameters from firmware response (bsc#963575 FATE#320144). - bnxt_en: Fix VF PCIe link speed and width logic (bsc#963575 FATE#320144). - bnxt_en: Re-arrange bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144). - bnxt_en: use eth_hw_addr_random() (bsc#963575 FATE#320144). - bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382). - bpf: one perf event close won't free bpf program attached by another perf event (bnc#1012382). - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382). - brcmfmac: add length check in brcmf_cfg80211_escan_handler() (bnc#1012382). - brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382). - brcmfmac: setup passive scan if requested by user-space (bnc#1012382). - brcmsmac: make some local variables 'static const' to reduce stack size (bnc#1012382). - bridge: netlink: register netdevice before executing changelink (bnc#1012382). - bt8xx: fix memory leak (bnc#1012382). - btrfs: add a node counter to each of the rbtrees (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: add cond_resched() calls when resolving backrefs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: allow backref search checks for shared extents (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, add tracepoints for prelim_ref insertion and merging (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, add unode_aux_to_inode_list helper (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, cleanup __ namespace abuse (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: backref, constify some arguments (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: btrfs_check_shared should manage its own transaction (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: clean up extraneous computations in add_delayed_refs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: constify tracepoint arguments (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: convert prelimary reference tracking to use rbtrees (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: fix leak and use-after-free in resolve_indirect_refs (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: Fix typo in may_commit_transaction Rather than comparing the result of the percpu comparison I was comparing the value of the percpu counter against 0 or 1. - btrfs: remove ref_tree implementation from backref.c (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - btrfs: return the actual error value from from btrfs_uuid_tree_iterate (bnc#1012382). - btrfs: struct-funcs, constify readers (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461). - bus: mbus: fix window size calculation for 4GB windows (bnc#1012382). - can: c_can: do not indicate triple sampling support for D_CAN (bnc#1012382). - can: esd_usb2: Fix can_dlc value for received RTR, frames (bnc#1012382). - can: gs_usb: fix busy loop if no more TX context is available (bnc#1012382). - can: kvaser_usb: Correct return value in printout (bnc#1012382). - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages (bnc#1012382). - can: sun4i: fix loopback mode (bnc#1012382). - can: sun4i: handle overrun in RX FIFO (bnc#1012382). - cdc_ncm: Set NTB format again after altsetting switch for Huawei devices (bnc#1012382). - ceph: avoid panic in create_session_open_msg() if utsname() returns NULL (bsc#1061451). - ceph: check negative offsets in ceph_llseek() (bsc#1061451). - ceph: clean up unsafe d_parent accesses in build_dentry_path (bnc#1012382). - ceph: unlock dangling spinlock in try_flush_caps() (bsc#1065639). - cgroup, net_cls: iterate the fds of only the tasks which are being migrated (bnc#1064926). - cifs: add build_path_from_dentry_optional_prefix() (fate#323482) - cifs: Add capability to decrypt big read responses (FATE#324404). Allow to decrypt transformed packets that are bigger than the big buffer size. In particular it is used for read responses that can only exceed the big buffer size. - cifs: Add capability to transform requests before sending (FATE#324404). This will allow us to do protocol specific tranformations of packets before sending to the server. For SMB3 it can be used to support encryption. - cifs: Add copy into pages callback for a read operation (FATE#324404). Since we have two different types of reads (pagecache and direct) we need to process such responses differently after decryption of a packet. The change allows to specify a callback that copies a read payload data into preallocated pages. - cifs: Add mid handle callback (FATE#324404). We need to process read responses differently because the data should go directly into preallocated pages. This can be done by specifying a mid handle callback. - cifs: Add soft dependencies (FATE#324404). List soft dependencies of cifs so that mkinitrd and dracut can include the required helper modules. - cifs: Add transform header handling callbacks (FATE#324404). We need to recognize and parse transformed packets in demultiplex thread to find a corresponsing mid and process it further. - cifs: add use_ipc flag to SMB2_ioctl() (fate#323482) - cifs: Allow to switch on encryption with seal mount option (FATE#324404). This allows users to inforce encryption for SMB3 shares if a server supports it. - cifs: check MaxPathNameComponentLength != 0 before using it (bnc#1012382). - cifs: Decrypt and process small encrypted packets (FATE#324404). Allow to decrypt transformed packets, find a corresponding mid and process as usual further. - cifs: do not bother with kmap on read_pages side (FATE#324404). just do ITER_BVEC recvmsg - cifs: Enable encryption during session setup phase (FATE#324404). In order to allow encryption on SMB connection we need to exchange a session key and generate encryption and decryption keys. - cifs: Encrypt SMB3 requests before sending (FATE#324404). This change allows to encrypt packets if it is required by a server for SMB sessions or tree connections. - cifs: fix circular locking dependency (bsc#1064701). - cifs: Fix some return values in case of error in 'crypt_message' (fate#324404). - cifs: Fix sparse warnings (fate#323482) - cifs: implement get_dfs_refer for SMB2+ (fate#323482) - cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482) - cifs: Make send_cancel take rqst as argument (FATE#324404). - cifs: Make SendReceive2() takes resp iov (FATE#324404). Now SendReceive2 frees the first iov and returns a response buffer in it that increases a code complexity. Simplify this by making a caller responsible for freeing request buffer itself and returning a response buffer in a separate iov. - cifs: move DFS response parsing out of SMB1 code (fate#323482) - cifs: no need to wank with copying and advancing iovec on recvmsg side either (FATE#324404). - cifs: Only select the required crypto modules (FATE#324404). The sha256 and cmac crypto modules are only needed for SMB2+, so move the select statements to config CIFS_SMB2. Also select CRYPTO_AES there as SMB2+ needs it. - cifs: Prepare for encryption support (first part). Add decryption and encryption key generation. (FATE#324404). - cifs_readv_receive: use cifs_read_from_socket() (FATE#324404). - cifs: Reconnect expired SMB sessions (bnc#1012382). - cifs: remove any preceding delimiter from prefix_path (fate#323482) - cifs: Send RFC1001 length in a separate iov (FATE#324404). In order to simplify further encryption support we need to separate RFC1001 length and SMB2 header when sending a request. Put the length field in iov[0] and the rest of the packet into following iovs. - cifs: Separate RFC1001 length processing for SMB2 read (FATE#324404). Allocate and initialize SMB2 read request without RFC1001 length field to directly call cifs_send_recv() rather than SendReceive2() in a read codepath. - cifs: Separate SMB2 header structure (FATE#324404). In order to support compounding and encryption we need to separate RFC1001 length field and SMB2 header structure because the protocol treats them differently. This change will allow to simplify parsing of such complex SMB2 packets further. - cifs: Separate SMB2 sync header processing (FATE#324404). Do not process RFC1001 length in smb2_hdr_assemble() because it is not a part of SMB2 header. This allows to cleanup the code and adds a possibility combine several SMB2 packets into one for compounding. - cifs: set signing flag in SMB2+ TreeConnect if needed (fate#323482) - cifs: Simplify SMB2 and SMB311 dependencies (FATE#324404). - clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382). - clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382). - clockevents/drivers/cs5535: Improve resilience to spurious interrupts (bnc#1012382). - cma: fix calculation of aligned offset (VM Functionality, bsc#1050060). - coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382). - cpufreq: CPPC: add ACPI_PROCESSOR dependency (bnc#1012382). - crypto: shash - Fix zero-length shash ahash digest crash (bnc#1012382). - crypto: vmx - disable preemption to enable vsx in aes_ctr.c (bnc#1012382). - crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382). - crypto: xts - Add ECB dependency (bnc#1012382). - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382). - cxgb4: Fix error codes in c4iw_create_cq() (bsc#1021424). - cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223). - cxl: Fix leaking pid refs in some error paths (bsc#1066223). - cxl: Force context lock during EEH flow (bsc#1066223). - cxl: Prevent adapter reset if an active context exists (bsc#1066223). - cxl: Route eeh events to all drivers in cxl_pci_error_detected() (bsc#1066223). - direct-io: Prevent NULL pointer access in submit_page_section (bnc#1012382). - Disable patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcounting-in-bio_map_us e.patch (bsc#1070767) - dmaengine: dmatest: warn user when dma test times out (bnc#1012382). - dmaengine: edma: Align the memcpy acnt array size with the transfer (bnc#1012382). - dmaengine: zx: set DMA_CYCLIC cap_mask bit (bnc#1012382). - dm bufio: fix integer overflow when limiting maximum cache size (bnc#1012382). - dm: fix race between dm_get_from_kobject() and __dm_destroy() (bnc#1012382). - driver core: platform: Do not read past the end of "driver_override" buffer (bnc#1012382). - drivers: dma-mapping: Do not leave an invalid area->pages pointer in dma_common_contiguous_remap() (Git-fixes, bsc#1065692). - drivers: firmware: psci: drop duplicate const from psci_of_match (bnc#1012382). - drivers: hv: fcopy: restore correct transfer length (bnc#1012382). - drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382). - drm/amdkfd: fix improper return value on error (bnc#1012382). - drm/amdkfd: NULL dereference involving create_process() (bsc#1031717). - drm: Apply range restriction after color adjustment when allocation (bnc#1012382). - drm/armada: Fix compile fail (bnc#1012382). - drm: bridge: add DT bindings for TI ths8135 (bnc#1012382). - drm: drm_minor_register(): Clean up debugfs on failure (bnc#1012382). - drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define (bnc#1012382). - drm: gma500: fix logic error (bsc#1031717). - drm/i915/bios: ignore HDMI on port A (bnc#1012382). - drm/i915/bxt: set min brightness from VBT (bsc#1031717). - drm/i915: Do not try indexed reads to alternate slave addresses (bsc#1031717). - drm/i915: fix backlight invert for non-zero minimum brightness (bsc#1031717). - drm/i915: Prevent zero length "index" write (bsc#1031717). - drm/i915: Read timings from the correct transcoder in intel_crtc_mode_get() (bsc#1031717). - drm/msm: fix an integer overflow test (bnc#1012382). - drm/msm: Fix potential buffer overflow issue (bnc#1012382). - drm/nouveau/bsp/g92: disable by default (bnc#1012382). - drm/nouveau/gr: fallback to legacy paths during firmware lookup (bsc#1031717). - drm/nouveau/mmu: flush tlbs before deleting page tables (bnc#1012382). - drm/omap: Fix error handling path in 'omap_dmm_probe()' (bsc#1031717). - drm/panel: simple: Add missing panel_simple_unprepare() calls (bsc#1031717). - drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache (bnc#1012382). - drm/vc4: Fix leak of HDMI EDID (bsc#1031717). - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382). - e1000e: Fix error path in link detection (bnc#1012382). - e1000e: Fix return value test (bnc#1012382). - e1000e: Separate signaling for link check/link up (bnc#1012382). - ecryptfs: fix dereference of NULL user_key_payload (bnc#1012382). - eCryptfs: use after free in ecryptfs_release_messaging() (bsc#1012829). - epoll: avoid calling ep_call_nested() from ep_poll_safewake() (bsc#1056427). - epoll: remove ep_call_nested() from ep_eventpoll_poll() (bsc#1056427). - ext4: cleanup goto next group (bsc#1066285). - ext4: do not allow encrypted operations without keys (bnc#1012382). patches.drivers/0001-iwlwifi-nvm-fix-up-phy-section-when-reading-it.patch. - ext4: do not use stripe_width if it is not set (bnc#1012382). - ext4: fix interaction between i_size, fallocate, and delalloc after a crash (bnc#1012382). - ext4: fix stripe-unaligned allocations (bnc#1012382). - ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets (bnc#1012382). - ext4: reduce lock contention in __ext4_new_inode (bsc#1066285). - extcon: axp288: Use vbus-valid instead of -present to determine cable presence (bnc#1012382). - extcon: palmas: Check the parent instance to prevent the NULL (bnc#1012382). - exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382). - exynos-gsc: Do not swap cb/cr for semi planar formats (bnc#1012382). - f2fs crypto: add missing locking for keyring_key access (bnc#1012382). - f2fs crypto: replace some BUG_ON()'s with error checks (bnc#1012382). - f2fs: do not wait for writeback in write_begin (bnc#1012382). - fealnx: Fix building error on MIPS (bnc#1012382). - fix a page leak in vhost_scsi_iov_to_sgl() error recovery (bnc#1012382). - Fix serial console on SNI RM400 machines (bsc#1031717). - Fix tracing sample code warning (bnc#1012382). - fix unbalanced page refcounting in bio_map_user_iov (bnc#1012382). - fix whitespace according to upstream commit - fm10k: request reset when mbx->state changes (bnc#1012382). - fm10k: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - fs/9p: Compare qid.path in v9fs_test_inode (bsc#1012829). - fs-cache: fix dereference of NULL user_key_payload (bnc#1012382). - fscrypt: fix dereference of NULL user_key_payload (bnc#1012382). - fscrypt: lock mutex before checking for bounce page pool (bnc#1012382). - fscrypto: require write access to mount to set encryption policy (bnc#1012382). - fs/epoll: cache leftmost node (bsc#1056427). - ftrace: Fix kmemleak in unregister_ftrace_graph (bnc#1012382). - fuse: fix READDIRPLUS skipping an entry (bnc#1012382). - gfs2: Fix reference to ERR_PTR in gfs2_glock_iter_next (bnc#1012382). - gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap (bnc#1012382). - hid: elo: clear BTN_LEFT mapping (bsc#1065866). - hid: i2c-hid: allocate hid buffers for real worst case (bnc#1012382). - hid: usbhid: fix out-of-bounds bug (bnc#1012382). - hpsa: correct lun data caching bitmap definition (bsc#1028971). - hsi: ssi_protocol: double free in ssip_pn_xmit() (bsc#1031717). - hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes (bnc#1012382). - i2c: at91: ensure state is restored after suspending (bnc#1012382). - i2c: cadance: fix ctrl/addr reg write order (bsc#1031717). - i2c: imx: Use correct function to write to register (bsc#1031717). - i2c: ismt: Separate I2C block read from SMBus block read (bnc#1012382). - i2c: meson: fix wrong variable usage in meson_i2c_put_data (bnc#1012382). - i2c: riic: correctly finish transfers (bnc#1012382). - i2c: riic: fix restart condition (git-fixes). - i40e: Initialize 64-bit statistics TX ring seqcount (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - i40e: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - i40evf: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - i40iw: Add missing memory barriers (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - i40iw: Fix port number for query QP (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350). - ib/core: Fix for core panic (bsc#1022595 FATE#322350). - ib/core: Fix the validations of a multicast LID in attach or detach operations (bsc#1022595 FATE#322350). - ib/core: Namespace is mandatory input for address resolution (bsc#1022595 FATE#322350). - ib/i40iw: Fix error code in i40iw_create_cq() (bsc#969476 FATE#319648 bsc#969477 FATE#319816). - ib/ipoib: Change list_del to list_del_init in the tx object (bnc#1012382). - ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350). - ib/ipoib: Fix deadlock over vlan_mutex (bnc#1012382). - ib/ipoib: Prevent setting negative values to max_nonsrq_conn_qp (bsc#1022595 FATE#322350). - ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350). - ib/ipoib: Replace list_del of the neigh->list with list_del_init (bnc#1012382). - ib/ipoib: rtnl_unlock can not come after free_netdev (bnc#1012382). - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed completion initialization (bsc#1022595 FATE#322350). - ib/mlx5: Fix Raw Packet QP event handler assignment (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - ibmvnic: Add netdev_dbg output for debugging (fate#323285). - ibmvnic: Add vnic client data to login buffer (bsc#1069942). - ibmvnic: Convert vnic server reported statistics to cpu endian (fate#323285). - ibmvnic: Enable scatter-gather support (bsc#1066382). - ibmvnic: Enable TSO support (bsc#1066382). - ibmvnic: Feature implementation of Vital Product Data (VPD) for the ibmvnic driver (bsc#1069942). - ibmvnic: Fix calculation of number of TX header descriptors (bsc#1066382). - ibmvnic: fix dma_mapping_error call (bsc#1069942). - ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382). - ibmvnic: Implement .get_channels (fate#323285). - ibmvnic: Implement .get_ringparam (fate#323285). - ibmvnic: Implement per-queue statistics reporting (fate#323285). - ibmvnic: Let users change net device features (bsc#1066382). - ibmvnic: Set state UP (bsc#1062962). - ibmvnic: Update reset infrastructure to support tunable parameters (bsc#1066382). - ib/qib: fix false-postive maybe-uninitialized warning (bnc#1012382). - ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595 FATE#322350). - ib/srpt: Do not accept invalid initiator port names (bnc#1012382). - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350). - ib/uverbs: Fix NULL pointer dereference during device removal (bsc#1022595 FATE#322350). - igb: close/suspend race in netif_device_detach (bnc#1012382). - igb: Fix hw_dbg logging in igb_update_flash_i210 (bnc#1012382). - igb: re-assign hw address pointer on reset after PCI error (bnc#1012382). - igb: reset the PHY before reading the PHY ID (bnc#1012382). - igb: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - igbvf: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - iio: ad7793: Fix the serial interface reset (bnc#1012382). - iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications (bnc#1012382). - iio: adc: hx711: Add DT binding for avia,hx711 (bnc#1012382). - iio: adc: mcp320x: Fix oops on module unload (bnc#1012382). - iio: adc: mcp320x: Fix readout of negative voltages (bnc#1012382). - iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()' (bnc#1012382). - iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()' (bnc#1012382). - iio: adc: xilinx: Fix error handling (bnc#1012382). - iio: ad_sigma_delta: Implement a dedicated reset function (bnc#1012382). - iio: core: Return error for failed read_reg (bnc#1012382). - iio: dummy: events: Add missing break (bsc#1031717). - iio: light: fix improper return value (bnc#1012382). - iio: trigger: free trigger resource correctly (bnc#1012382). - ima: do not update security.ima if appraisal status is not INTEGRITY_PASS (bnc#1012382). - input: ar1021_i2c - fix too long name in driver's device table (bsc#1031717). - input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree (bsc#1031717). - input: elan_i2c - add ELAN060C to the ACPI table (bnc#1012382). - input: elan_i2c - add ELAN0611 to the ACPI table (bnc#1012382). - input: gtco - fix potential out-of-bound access (bnc#1012382). - input: mpr121 - handle multiple bits change of status register (bnc#1012382). - input: mpr121 - set missing event capability (bnc#1012382). - input: ti_am335x_tsc - fix incorrect step config for 5 wire touchscreen (bsc#1031717). - input: twl4030-pwrbutton - use correct device for irq request (bsc#1031717). - input: ucb1400_ts - fix suspend and resume handling (bsc#1031717). - input: uinput - avoid crash when sending FF request to device going away (bsc#1031717). - iommu/amd: Finish TLB flush in amd_iommu_unmap() (bnc#1012382). - iommu/arm-smmu-v3: Clear prior settings when updating STEs (bnc#1012382). - iommu/io-pgtable-arm: Check for leaf entry before dereferencing it (bnc#1012382). - iommu/vt-d: Do not register bus-notifier under dmar_global_lock (bsc#1069793). - ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err (bnc#1012382). - ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header (bnc#1012382). - ipip: only increase err_count for some certain type icmp in ipip_err (bnc#1012382). - ipmi: Disable IPMI fix patches due to regression (bsc#1071833) - ipmi: fix unsigned long underflow (bnc#1012382). - ipmi: Pick up slave address from SMBIOS on an ACPI device (bsc#1070006). - ipmi: Prefer ACPI system interfaces over SMBIOS ones (bsc#1070006). - ipmi_si: Clean up printks (bsc#1070006). - ipmi_si: fix memory leak on new_smi (bsc#1070006). - ipsec: do not ignore crypto err in ah4 input (bnc#1012382). - ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382). - ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER (bnc#1012382). - ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365). - irqchip/crossbar: Fix incorrect type of local variables (bnc#1012382). - isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717). - iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382). - isdn/i4l: fetch the ppp_write buffer in one shot (bnc#1012382). - isofs: fix timestamps beyond 2027 (bnc#1012382). - iwlwifi: add workaround to disable wide channels in 5GHz (bnc#1012382). - iwlwifi: mvm: fix the coex firmware API (bsc#1031717). - iwlwifi: mvm: return -ENODATA when reading the temperature with the FW down (bsc#1031717). - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask when sending sta to fw (bsc#1031717). - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD (bnc#1012382). - iwlwifi: split the regulatory rules when the bandwidth flags require it (bsc#1031717). - ixgbe: add mask for 64 RSS queues (bnc#1012382). - ixgbe: do not disable FEC from the driver (bnc#1012382). - ixgbe: fix AER error handling (bnc#1012382). - ixgbe: Fix incorrect bitwise operations of PTP Rx timestamp flags (bsc#969474 FATE#319812 bsc#969475 FATE#319814). - ixgbe: Fix skb list corruption on Power systems (bnc#1012382). - ixgbe: handle close/suspend race with netif_device_detach/present (bnc#1012382). - ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382). - ixgbevf: Use smp_rmb rather than read_barrier_depends (bnc#1012382). - kABI: protect struct l2tp_tunnel (kabi). - kABI: protect struct regulator_dev (kabi). - kABI: protect struct rm_data_op (kabi). - kABI: protect struct sdio_func (kabi). - kABI: protect structs rt_rq+root_domain (kabi). - kABI: protect typedef rds_rdma_cookie_t (kabi). - kernel-docs: unpack the source instead of using kernel-source (bsc#1057199). - kernel/sysctl.c: remove duplicate UINT_MAX check on do_proc_douintvec_conv() (bsc#1066470). - kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516). - keys: do not let add_key() update an uninstantiated key (bnc#1012382). - keys: do not revoke uninstantiated key in request_key_auth_new() (bsc#1031717). - keys: encrypted: fix dereference of NULL user_key_payload (bnc#1012382). - keys: fix cred refcount leak in request_key_auth_new() (bsc#1031717). - keys: fix key refcount leak in keyctl_assume_authority() (bsc#1031717). - keys: fix key refcount leak in keyctl_read_key() (bsc#1031717). - keys: fix NULL pointer dereference during ASN.1 parsing [ver #2] (bnc#1012382). - keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382). - keys: Fix race between updating and finding a negative key (bnc#1012382). - keys: return full count in keyring_read() if buffer is too small (bnc#1012382). - keys: trusted: fix writing past end of buffer in trusted_read() (bnc#1012382). - keys: trusted: sanitize all key material (bnc#1012382). - kvm: nVMX: fix guest CR4 loading when emulating L2 to L1 exit (bnc#1012382). - kvm: nVMX: set IDTR and GDTR limits when loading L1 host state (bnc#1012382). - kvm: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter (bnc#1012382). - kvm: SVM: obey guest PAT (bnc#1012382). - l2tp: Avoid schedule while atomic in exit_net (bnc#1012382). - l2tp: check ps->sock before running pppol2tp_session_ioctl() (bnc#1012382). - l2tp: fix race condition in l2tp_tunnel_delete (bnc#1012382). - libata: transport: Remove circular dependency at free time (bnc#1012382). - lib/digsig: fix dereference of NULL user_key_payload (bnc#1012382). - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717). - lib/mpi: call cond_resched() from mpi_powm() loop (bnc#1012382). - libnvdimm, namespace: fix label initialization to use valid seq numbers (bnc#1012382). - libnvdimm, namespace: make 'resource' attribute only readable by root (bnc#1012382). - libnvdimm, pfn: make 'resource' attribute only readable by root (FATE#319858). - lib/ratelimit.c: use deferred printk() version (bsc#979928). - locking/lockdep: Add nest_lock integrity test (bnc#1012382). - lsm: fix smack_inode_removexattr and xattr_getsecurity memleak (bnc#1012382). - mac80211: agg-tx: call drv_wake_tx_queue in proper context (bsc#1031717). - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472). - mac80211: do not send SMPS action frame in AP mode when not needed (bsc#1031717). - mac80211: Fix addition of mesh configuration element (git-fixes). - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717). - mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717). - mac80211: fix power saving clients handling in iwlwifi (bnc#1012382). - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length (bnc#1012382). - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() (bsc#1031717). - mac80211: Remove invalid flag operations in mesh TSF synchronization (bnc#1012382). - mac80211: Remove unused 'beaconint_us' variable (bsc#1031717). - mac80211: Remove unused 'i' variable (bsc#1031717). - mac80211: Remove unused 'len' variable (bsc#1031717). - mac80211: Remove unused 'rates_idx' variable (bsc#1031717). - mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717). - mac80211: Remove unused 'struct ieee80211_rx_status' ptr (bsc#1031717). - mac80211: Suppress NEW_PEER_CANDIDATE event if no room (bnc#1012382). - mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717). - mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717). - mac80211: use constant time comparison with keys (bsc#1066471). - md/linear: shutup lockdep warnning (bnc#1012382). - md/raid10: submit bio directly to replacement disk (bnc#1012382). - media: au0828: fix RC_CORE dependency (bsc#1031717). - media: Do not do DMA on stack for firmware upload in the AS102 driver (bnc#1012382). - media: em28xx: calculate left volume level correctly (bsc#1031717). - media: mceusb: fix memory leaks in error path (bsc#1031717). - media: rc: check for integer overflow (bnc#1012382). - media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382). - megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do not support it (bsc#1027301). - mei: return error on notification request to a disconnected client (bnc#1012382). - mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382). - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped (bnc#1012382). - misc: panel: properly restore atomic counter on error path (bnc#1012382). - mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms array (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - mm/backing-dev.c: fix an error handling path in 'cgwb_create()' (bnc#1063475). - mmc: block: return error on failed mmc_blk_get() (bsc#1031717). - mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717). - mmc: dw_mmc: rockchip: Set the drive phase properly (bsc#1031717). - mm: check the return value of lookup_page_ext for all call sites (bnc#1068982). - mmc: host: omap_hsmmc: avoid possible overflow of timeout value (bsc#1031717). - mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() (bsc#1031717). - mmc: mediatek: Fixed size in dma_free_coherent (bsc#1031717). - mm,compaction: serialize waitqueue_active() checks (for real) (bsc#971975). - mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382). - mmc: sdio: fix alignment issue in struct sdio_func (bnc#1012382). - mmc: sd: limit SD card power limit according to cards capabilities (bsc#1031717). - mm: discard memblock data later (bnc#1063460). - mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for all call sites" (bnc#1012382). - mm/madvise.c: fix madvise() infinite loop under special circumstances (bnc#1070964). - mm/memblock.c: reversed logic in memblock_discard() (bnc#1063460). - mm: meminit: mark init_reserved_page as __meminit (bnc#1063509). - mm/memory_hotplug: change pfn_to_section_nr/section_nr_to_pfn macro to inline function (bnc#1063501). - mm/memory_hotplug: define find_{smallest|biggest}_section_pfn as unsigned long (bnc#1063520). - mm/page_alloc.c: broken deferred calculation (bnc#1068980). - mm, page_alloc: fix potential false positive in __zone_watermark_ok (Git-fixes, bsc#1068978). - mm/page_ext.c: check if page_ext is not prepared (bnc#1068982). - mm/page_owner: avoid null pointer dereference (bnc#1068982). - mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382). - net: 3com: typhoon: typhoon_init_one: fix incorrect return values (bnc#1012382). - net: 3com: typhoon: typhoon_init_one: make return values more specific (bnc#1012382). - net/9p: Switch to wait_event_killable() (bnc#1012382). - net: Allow IP_MULTICAST_IF to set index to L3 slave (bnc#1012382). - net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382). - net: cdc_ncm: GetNtbFormat endian fix (git-fixes). - net: core: Prevent from dereferencing null pointer when releasing SKB (bnc#1012382). - net: dsa: select NET_SWITCHDEV (bnc#1012382). - net: emac: Fix napi poll list corruption (bnc#1012382). - netfilter: invoke synchronize_rcu after set the _hook_ to NULL (bnc#1012382). - netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed (bnc#1012382). - netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value (bnc#1012382). - netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max (bnc#1012382). - netfilter: nf_tables: fix oob access (bnc#1012382). - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family (bnc#1012382). - netfilter: nft_queue: use raw_smp_processor_id() (bnc#1012382). - net: ibm: ibmvnic: constify vio_device_id (fate#323285). - net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled (bsc#966191 FATE#320230 bsc#966186 FATE#320228). - net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs (bnc#1012382). - net/mlx4_en: fix overflow in mlx4_en_init_timestamp() (bnc#1012382). - net/mlx5e: Fix wrong delay calculation for overflow check scheduling (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5e: Schedule overflow check work to mlx5e workqueue (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net/mlx5: Skip mlx5_unload_one if mlx5_load_one fails (bsc#966170 FATE#320225 bsc#966172 FATE#320226). - net: mvpp2: release reference to txq_cpu[] entry after unmapping (bnc#1012382). - net/packet: check length in getsockopt() called with PACKET_HDRLEN (bnc#1012382). - net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382). - net/sctp: Always set scope_id in sctp_inet6_skb_msgname (bnc#1012382). - net: Set sk_prot_creator when cloning sockets to the right proto (bnc#1012382). - net/unix: do not show information about sockets from other namespaces (bnc#1012382). - nfc: fix device-allocation error return (bnc#1012382). - nfsd/callback: Cleanup callback cred on shutdown (bnc#1012382). - nfsd: deal with revoked delegations appropriately (bnc#1012382). - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID (bsc#989261). - nfs: Fix typo in nomigration mount option (bnc#1012382). - nfs: Fix ugly referral attributes (bnc#1012382). - nilfs2: fix race condition that causes file system corruption (bnc#1012382). - nl80211: Define policy for packet pattern attributes (bnc#1012382). - nvme: Fix memory order on async queue deletion (bnc#1012382). - nvme: protect against simultaneous shutdown invocations (FATE#319965 bnc#1012382 bsc#964944). - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (bnc#1012382). - ocfs2: should wait dio before inode lock in ocfs2_setattr() (bnc#1012382). - packet: avoid panic in packet_getsockopt() (bnc#1012382). - packet: only test po->has_vnet_hdr once in packet_snd (bnc#1012382). - parisc: Avoid trashing sr2 and sr3 in LWS code (bnc#1012382). - parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels (bnc#1012382). - parisc: Fix validity check of pointer size argument in new CAS implementation (bnc#1012382). - parisc: perf: Fix potential NULL pointer dereference (bnc#1012382). - partitions/efi: Fix integer overflow in GPT size calculation (bnc#1012382). - pci: Apply _HPX settings only to relevant devices (bnc#1012382). - pci: mvebu: Handle changes to the bridge windows while enabled (bnc#1012382). - percpu: make this_cpu_generic_read() atomic w.r.t. interrupts (bnc#1012382). - perf tools: Fix build failure on perl script context (bnc#1012382). - perf tools: Only increase index if perf_evsel__new_idx() succeeds (bnc#1012382). - perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes d2878d642a4ed). - phy: increase size of MII_BUS_ID_SIZE and bus_id (bnc#1012382). - pkcs#7: fix unitialized boolean 'want' (bnc#1012382). - pkcs7: Prevent NULL pointer dereference, since sinfo is not always set (bnc#1012382). - platform/x86: acer-wmi: setup accelerometer when ACPI device was found (bsc#1031717). - platform/x86: hp-wmi: Do not shadow error values (bnc#1012382). - platform/x86: hp-wmi: Fix detection for dock and tablet mode (bnc#1012382). - platform/x86: hp-wmi: Fix error value for hp_wmi_tablet_state (bnc#1012382). - platform/x86: intel_mid_thermal: Fix module autoload (bnc#1012382). - platform/x86: sony-laptop: Fix error handling in sony_nc_setup_rfkill() (bsc#1031717). - pm / OPP: Add missing of_node_put(np) (bnc#1012382). - power: bq27xxx_battery: Fix bq27541 AveragePower register address (bsc#1031717). - power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717). - powerCap: Fix an error code in powercap_register_zone() (bsc#1031717). - power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717). - powerpc/64: Fix race condition in setting lock bit in idle/wakeup code (bsc#1066223). - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223). - powerpc/corenet: explicitly disable the SDHC controller on kmcoge4 (bnc#1012382). - powerpc: Correct instruction code for xxlor instruction (bsc#1066223). - powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC (bsc#1066223). - powerpc/mm: Fix check of multiple 16G pages from device tree (bsc#1066223). - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash (bsc#1066223). - powerpc/mm/hash64: Fix subpage protection with 4K HPTE config (bsc#1010201, bsc#1066223). - powerpc/mm/hash: Free the subpage_prot_table correctly (bsc#1066223). - powerpc/numa: Fix multiple bugs in memory_hotplug_max() (bsc#1066223). - powerpc/numa: Fix whitespace in hot_add_drconf_memory_max() (bsc#1066223). - powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223). - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8 (bsc#1066223). - powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223). - powerpc/powernv: Make opal_event_shutdown() callable from IRQ context (bsc#1066223). - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888). - powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888). - powerpc/signal: Properly handle return value from uprobe_deny_signal() (bsc#1066223). - powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223). - power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520 ("bsc#1069270"). - power: supply: isp1704: Fix unchecked return value of devm_kzalloc (bsc#1031717). - power: supply: lp8788: prevent out of bounds array access (bsc#1031717). - power_supply: tps65217-charger: Fix NULL deref during property export (bsc#1031717). - ppp: fix race in ppp device destruction (bnc#1012382). - printk/console: Always disable boot consoles that use init memory before it is freed (bsc#1063026). - printk/console: Enhance the check for consoles using init memory (bsc#1063026). - printk: include instead of (bsc#1063026). - printk: only unregister boot consoles when necessary (bsc#1063026). - qed: Fix stack corruption on probe (bsc#966318 FATE#320158 bsc#966316 FATE#320159). - quota: Check for register_shrinker() failure (bsc#1012829). - r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717). - rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382). - rcu: Allow for page faults in NMI handlers (bnc#1012382). - rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350). - rds: ib: add error handle (bnc#1012382). - rds: rdma: Fix the composite message user notification (bnc#1012382). - rds: rdma: return appropriate error on rdma map failures (bnc#1012382). - regulator: core: Limit propagation of parent voltage count and list (bsc#1070145). - regulator: fan53555: fix I2C device ids (bnc#1012382). - Revert "bpf: one perf event close won't free bpf program attached by another perf event" (kabi). - Revert "bsg-lib: do not free job in bsg_prepare_job" (bnc#1012382). - Revert "crypto: xts - Add ECB dependency" (bnc#1012382). - Revert "drm: bridge: add DT bindings for TI ths8135" (bnc#1012382). - Revert "KEYS: Fix race between updating and finding a negative key" (kabi). - Revert "phy: increase size of MII_BUS_ID_SIZE and bus_id" (kabi). - Revert "sctp: do not peel off an assoc from one netns to another one" (bnc#1012382). - Revert "tty: goldfish: Fix a parameter of a call to free_irq" (bnc#1012382). - Revert "uapi: fix linux/rds.h userspace compilation errors" (bnc#1012382). - rpm/kernel-binary.spec.in: add the kernel-binary dependencies to kernel-binary-base (bsc#1060333). - rpm/kernel-binary.spec.in: Correct supplements for recent SLE products (bsc#1067494) - rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size (bsc#1056979). - rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717). - rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks (bsc#1031717). - rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL (bsc#1031717). - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717). - rtc: sa1100: fix unbalanced clk_prepare_enable/clk_disable_unprepare (bsc#1031717). - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time (bnc#1012382). - rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382). - rtlwifi: rtl8821ae: Fix connection lost problem (bnc#1012382). - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation (bsc#1031717). - s390/dasd: check for device error pointer within state change interrupts (bnc#1012382). - s390/disassembler: add missing end marker for e7 table (bnc#1012382). - s390/disassembler: correct disassembly lines alignment (bsc#1070825). - s390/disassembler: increase show_code buffer size (bnc#1012382). - s390: fix transactional execution control register handling (bnc#1012382). - s390/kbuild: enable modversions for symbols exported from asm (bnc#1012382). - s390/qeth: issue STARTLAN as first IPA command (bnc#1012382). - s390/runtime instrumention: fix possible memory corruption (bnc#1012382). - sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task() (bnc#1012382). - sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs (bnc#1012382). - sched: Make resched_cpu() unconditional (bnc#1012382). - sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382). - scsi: aacraid: Process Error for response I/O (bnc#1012382). - scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941). - scsi: hpsa: add 'ctlr_num' sysfs attribute (bsc#1028971). - scsi: hpsa: bump driver version (bsc#1022600 fate#321928). - scsi: hpsa: change driver version (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: Check for null device pointers (bsc#1028971). - scsi: hpsa: Check for null devices in ioaccel (bsc#1028971). - scsi: hpsa: Check for vpd support before sending (bsc#1028971). - scsi: hpsa: cleanup reset handler (bsc#1022600 fate#321928). - scsi: hpsa: correct call to hpsa_do_reset (bsc#1028971). - scsi: hpsa: correct logical resets (bsc#1028971). - scsi: hpsa: correct queue depth for externals (bsc#1022600 fate#321928). - scsi: hpsa: correct resets on retried commands (bsc#1022600 fate#321928). - scsi: hpsa: correct scsi 6byte lba calculation (bsc#1028971). - scsi: hpsa: Determine device external status earlier (bsc#1028971). - scsi: hpsa: do not get enclosure info for external devices (bsc#1022600 fate#321928). - scsi: hpsa: do not reset enclosures (bsc#1022600 fate#321928). - scsi: hpsa: do not timeout reset operations (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: fallback to use legacy REPORT PHYS command (bsc#1028971). - scsi: hpsa: fix volume offline state (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: limit outstanding rescans (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: Prevent sending bmic commands to externals (bsc#1028971). - scsi: hpsa: remove abort handler (bsc#1022600 fate#321928). - scsi: hpsa: remove coalescing settings for ioaccel2 (bsc#1028971). - scsi: hpsa: remove memory allocate failure message (bsc#1028971). - scsi: hpsa: Remove unneeded void pointer cast (bsc#1028971). - scsi: hpsa: rescan later if reset in progress (bsc#1022600 fate#321928). - scsi: hpsa: send ioaccel requests with 0 length down raid path (bsc#1022600 fate#321928). - scsi: hpsa: separate monitor events from rescan worker (bsc#1022600 fate#321928). - scsi: hpsa: update check for logical volume status (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: update identify physical device structure (bsc#1022600 fate#321928). - scsi: hpsa: update pci ids (bsc#1022600 bsc#1028971 fate#321928). - scsi: hpsa: update reset handler (bsc#1022600 fate#321928). - scsi: hpsa: use designated initializers (bsc#1028971). - scsi: hpsa: use %phN for short hex dumps (bsc#1028971). - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213). - scsi: ipr: Set no_report_opcodes for RAID arrays (bsc#1066213). - scsi: libfc: fix a deadlock in fc_rport_work (bsc#1063695). - scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003). - scsi: lpfc: Add missing memory barrier (bnc#1012382). - scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload (bnc#1012382). - scsi: lpfc: Correct host name in symbolic_name field (bnc#1012382). - scsi: lpfc: Correct issue leading to oops during link reset (bnc#1012382). - scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort (bnc#1012382). - scsi: reset wait for IO completion (bsc#996376). - scsi: scsi_devinfo: fixup string compare (bsc#1062941). updated patches.fixes/scsi_devinfo-fixup-string-compare.patch to the version merged upstream. - scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941). - scsi: scsi_dh_emc: return success in clariion_std_inquiry() (bnc#1012382). - scsi: scsi_transport_fc: Also check for NOTPRESENT in fc_remote_port_add() (bsc#1037890). - scsi: scsi_transport_fc: set scsi_target_id upon rescan (bsc#1058135). - scsi: sd: Do not override max_sectors_kb sysfs setting (bsc#1025461). - scsi: sd: Remove LBPRZ dependency for discards (bsc#1060985). - scsi: sg: close race condition in sg_remove_sfp_usercontext() (bsc#1064206). - scsi: sg: do not return bogus Sg_requests (bsc#1064206). - scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206). - scsi: sg: Re-fix off by one in sg_fill_request_table() (bnc#1012382). - scsi: ufs: add capability to keep auto bkops always enabled (bnc#1012382). - scsi: ufs-qcom: Fix module autoload (bnc#1012382). - scsi: virtio_scsi: let host do exception handling (bsc#1060682). - scsi: zfcp: fix erp_action use-before-initialize in REC action trace (bnc#1012382). - sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect (bnc#1012382). - sctp: do not peel off an assoc from one netns to another one (bnc#1012382). - sctp: do not peel off an assoc from one netns to another one (bnc#1012382). - sctp: potential read out of bounds in sctp_ulpevent_type_enabled() (bnc#1012382). - sctp: reset owner sk for data chunks on out queues when migrating a sock (bnc#1012382). - security/keys: add CONFIG_KEYS_COMPAT to Kconfig (bnc#1012382). - selftests: firmware: add empty string and async tests (bnc#1012382). - selftests: firmware: send expected errors to /dev/null (bnc#1012382). - serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() (bsc#1031717). - serial: 8250_uniphier: fix serial port index in private data (bsc#1031717). - serial: omap: Fix EFR write on RTS deassertion (bnc#1012382). - serial: Remove unused port type (bsc#1066045). - serial: sh-sci: Fix register offsets for the IRDA serial port (bnc#1012382). - sh_eth: use correct name for ECMR_MPDE bit (bnc#1012382). - slub: do not merge cache if slub_debug contains a never-merge flag (bnc#1012382). - smb3: parsing for new snapshot timestamp mount parm (FATE#324404). New mount option "snapshot=