FlawAtlas
Search the atlas
SUSE-RU-2015:1175-1 Not scored

Recommended update for Package Management Stack

This update provides fixes and enhancements for the Software Update Stack. gnome-packagekit: - Fix title of license agreement window. (bsc#927319) libsolv: - Rework splitprovides handling. (bnc#921332) - Add product:regflavor attribute. (bnc#896224) - Fix bug in reorder_dq_for_jobrules that could lead to crashes. (bnc#899907) - Fix bug in dislike_old_versions that could lead to a segfault. (bnc#922352) - Add manpages for the tools. libzypp: - Add configuration values for gpgcheck, repo_gpgcheck and pkg_gpgcheck to zypp.conf. (FATE#314603) - Support $releasever_major/$releasever_minor repo variables. (FATE#318354) - Support repo variable replacement in service url. - Support repo variable replacement in gpg url. - Add support for SHA224/384/512. - Don't execute scripts in /tmp or /var/tmp, as they could be mounted noexec for security reasons. (bnc#915928) - Let $ZYPP_REPO_RELEASEVER overwrite $releasever in .repo files. (bnc#911658) - Parse and offer productRegisterFlavor attribute. (bnc#896224) - Improve conflict message for locked packages. (bnc#828631) - Fix broken de-escaping in str::splitEscaped. (bnc#909772) - Filter PIDs running in a container. (bnc#909143) - Suppress informal license (no need to accept) upon update. (bnc#908976) - Adapt to gpg-2.1. (bnc#908135) - Call rpm with '--noglob'. (bnc#892431) - Fix URL path concatenation in MediaCurl. (bnc#901590) - Move doxygen html doc to libzypp-devel-doc. (bnc#901691) - Support parsing multiple baseurls from a repo file. (bnc#899510) - Suppress MediaChangeReport while testing multiple baseurls. (bnc#899510) - Fix handling local mirrorlist= files in .repo. (bnc#899510) - Prevent POODLE by talking TLS only. (bnc#903405) - Fix segmentation fault when dumping rpm header with epoch. (bnc#929483) - Handle repository aliases containing ']' correctly. (bnc#929528) - Avoid nested exception on user abort. (bnc#931601) - Fix SSL client certificate authentication via URL option ssl_clientcert/ssl_clientkey. (bnc#932393) libzypp-bindings: - Enforce Python 2.7 libzypp-bindings is not yet ready for Python 3. - Adapt to libzypp changes. zypper: - Implement and document GPG signature checking. (FATE#314603) - Enhance 'Digest verification failed' message and dialog. (FATE#315008) - Refresh plugin services on 'lr' 'ls -r' and 'ref'. (bnc#893294, FATE#318117) Repositories provided by a plugin service (SUSE Manager) must always be (auto-)refreshed to reflect server side changes immediately. - Allow repo:package to reinstall from a different repo. (bnc#725867) - Suppress MediaChangeReport while testing multiple baseurls. (bnc#899510) - A date limit must ignore newer patch candidates. (bnc#919709) - Notify about volatile changes to service repos. (bnc#916254) - Change column header from 'Login' to 'User'. (bnc#915461) - Fix wrong exit status using the --xmlout option. (bnc#914258) - Add new color/pkglistHighlightAttribute to zypper.conf. (bnc#914284) - New global option --releasever: Set the value of the $releasever variable in all .repo files. This can be used to switch to new distribution repositories when performing a distribution upgrade. (bnc#911658) - Clarify legacy warning. (bnc#911335) - Show new product:registerflavor attribute in 'zypper info'. (bnc#896224) - Enhance message text when skipping repos due to an error. (bnc#909244) - Fix additional spaces in zypper output and new colorization code. (bnc#908345) - Properly reset auto-retry counter. (bnc#906549) - Improve patch description in man page. (bnc#904737) - Warn about repositories with 'gpgcheck=0'. (bnc#848054) - Summary: quote names including spaces. (bnc#903675) - Warn if legacy CLI options are used. (bnc#899781) - Fix prompt returning undefined default value after wrong input. (bnc#925696) - Fix typo in man page. (bnc#923800) - Only use ANSI color codes on terminals. (bnc#925678) - Fix table sorting with option --sort-by-priority. (bnc#832519) - Clarify 'zypper lp --date' description. (bnc#929593) - Warn user that deleting a service repository is a volatile change. (bnc#929990) - Adapt Enterprise product detection, fixing display of package's support status. (bnc#933277) - Fix format of sizes in output. (bnc#897301) - Clarify comment in zypper.conf. (bnc#820693)

Exploit probability Not scored
Published June 15, 2015
Required by Not available
Last source change May 2, 2025

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Workstation Extension 12 PackageKit
SUSE:Linux Enterprise Server 12 libyui-ncurses-pkg
SUSE:Linux Enterprise Server 12 libsolv
SUSE:Linux Enterprise Server 12 gnome-packagekit
SUSE:Linux Enterprise Desktop 12 libzypp-bindings
SUSE:Linux Enterprise Server 12 libyui-qt-pkg
SUSE:Linux Enterprise Software Development Kit 12 libyui-qt-pkg
SUSE:Linux Enterprise Desktop 12 libsolv
SUSE:Linux Enterprise Software Development Kit 12 PackageKit
SUSE:Linux Enterprise Desktop 12 zypper
SUSE:Linux Enterprise Server for SAP Applications 12 gnome-packagekit
SUSE:Linux Enterprise Server for SAP Applications 12 libyui-ncurses-pkg
SUSE:Linux Enterprise Desktop 12 libyui-qt-pkg
SUSE:Linux Enterprise Server for SAP Applications 12 libzypp-bindings
SUSE:Linux Enterprise Server 12 zypper
SUSE:Linux Enterprise Server for SAP Applications 12 libzypp
SUSE:Linux Enterprise Server 12 yast2-pkg-bindings
SUSE:Linux Enterprise Server for SAP Applications 12 libyui-qt-pkg
SUSE:Linux Enterprise Desktop 12 yast2-pkg-bindings
SUSE:Linux Enterprise Desktop 12 gnome-packagekit
SUSE:Linux Enterprise Server 12 libzypp-bindings
SUSE:Linux Enterprise Server 12 PackageKit
SUSE:Linux Enterprise Desktop 12 libzypp
SUSE:Linux Enterprise Software Development Kit 12 libzypp-bindings
SUSE:Linux Enterprise Desktop 12 libyui-ncurses-pkg
SUSE:Linux Enterprise Software Development Kit 12 libyui-ncurses-pkg
SUSE:Linux Enterprise Server for SAP Applications 12 zypper
SUSE:Linux Enterprise Server 12 libzypp
SUSE:Linux Enterprise Software Development Kit 12 libsolv
SUSE:Linux Enterprise Server for SAP Applications 12 PackageKit
SUSE:Linux Enterprise Server for SAP Applications 12 libsolv
SUSE:Linux Enterprise Desktop 12 PackageKit
SUSE:Linux Enterprise Software Development Kit 12 libzypp
SUSE:Linux Enterprise Server for SAP Applications 12 yast2-pkg-bindings

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-RU-2015:1175-1

This update provides fixes and enhancements for the Software Update Stack. gnome-packagekit: - Fix title of license agreement window. (bsc#927319) libsolv: - Rework splitprovides handling. (bnc#921332) - Add product:regflavor attribute. (bnc#896224) - Fix bug in reorder_dq_for_jobrules that could lead to crashes. (bnc#899907) - Fix bug in dislike_old_versions that could lead to a segfault. (bnc#922352) - Add manpages for the tools. libzypp: - Add configuration values for gpgcheck, repo_gpgcheck and pkg_gpgcheck to zypp.conf. (FATE#314603) - Support $releasever_major/$releasever_minor repo variables. (FATE#318354) - Support repo variable replacement in service url. - Support repo variable replacement in gpg url. - Add support for SHA224/384/512. - Don't execute scripts in /tmp or /var/tmp, as they could be mounted noexec for security reasons. (bnc#915928) - Let $ZYPP_REPO_RELEASEVER overwrite $releasever in .repo files. (bnc#911658) - Parse and offer productRegisterFlavor attribute. (bnc#896224) - Improve conflict message for locked packages. (bnc#828631) - Fix broken de-escaping in str::splitEscaped. (bnc#909772) - Filter PIDs running in a container. (bnc#909143) - Suppress informal license (no need to accept) upon update. (bnc#908976) - Adapt to gpg-2.1. (bnc#908135) - Call rpm with '--noglob'. (bnc#892431) - Fix URL path concatenation in MediaCurl. (bnc#901590) - Move doxygen html doc to libzypp-devel-doc. (bnc#901691) - Support parsing multiple baseurls from a repo file. (bnc#899510) - Suppress MediaChangeReport while testing multiple baseurls. (bnc#899510) - Fix handling local mirrorlist= files in .repo. (bnc#899510) - Prevent POODLE by talking TLS only. (bnc#903405) - Fix segmentation fault when dumping rpm header with epoch. (bnc#929483) - Handle repository aliases containing ']' correctly. (bnc#929528) - Avoid nested exception on user abort. (bnc#931601) - Fix SSL client certificate authentication via URL option ssl_clientcert/ssl_clientkey. (bnc#932393) libzypp-bindings: - Enforce Python 2.7 libzypp-bindings is not yet ready for Python 3. - Adapt to libzypp changes. zypper: - Implement and document GPG signature checking. (FATE#314603) - Enhance 'Digest verification failed' message and dialog. (FATE#315008) - Refresh plugin services on 'lr' 'ls -r' and 'ref'. (bnc#893294, FATE#318117) Repositories provided by a plugin service (SUSE Manager) must always be (auto-)refreshed to reflect server side changes immediately. - Allow repo:package to reinstall from a different repo. (bnc#725867) - Suppress MediaChangeReport while testing multiple baseurls. (bnc#899510) - A date limit must ignore newer patch candidates. (bnc#919709) - Notify about volatile changes to service repos. (bnc#916254) - Change column header from 'Login' to 'User'. (bnc#915461) - Fix wrong exit status using the --xmlout option. (bnc#914258) - Add new color/pkglistHighlightAttribute to zypper.conf. (bnc#914284) - New global option --releasever: Set the value of the $releasever variable in all .repo files. This can be used to switch to new distribution repositories when performing a distribution upgrade. (bnc#911658) - Clarify legacy warning. (bnc#911335) - Show new product:registerflavor attribute in 'zypper info'. (bnc#896224) - Enhance message text when skipping repos due to an error. (bnc#909244) - Fix additional spaces in zypper output and new colorization code. (bnc#908345) - Properly reset auto-retry counter. (bnc#906549) - Improve patch description in man page. (bnc#904737) - Warn about repositories with 'gpgcheck=0'. (bnc#848054) - Summary: quote names including spaces. (bnc#903675) - Warn if legacy CLI options are used. (bnc#899781) - Fix prompt returning undefined default value after wrong input. (bnc#925696) - Fix typo in man page. (bnc#923800) - Only use ANSI color codes on terminals. (bnc#925678) - Fix table sorting with option --sort-by-priority. (bnc#832519) - Clarify 'zypper lp --date' description. (bnc#929593) - Warn user that deleting a service repository is a volatile change. (bnc#929990) - Adapt Enterprise product detection, fixing display of package's support status. (bnc#933277) - Fix format of sizes in output. (bnc#897301) - Clarify comment in zypper.conf. (bnc#820693)

View original source

05 / REFERENCES

Further evidence