Security update for GNU Health and it's dependencies SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0009-1 Final 1 1 2017-01-02T12:42:03Z current 2017-01-02T12:42:03Z 2017-01-02T12:42:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for GNU Health and it's dependencies This update provides version 3.0.5 of GNU Health including several fixes and improvements. - Update to ICD10 version 2016. - Fix error when printing prescription using review dates. - Fix error on summary report when no date of birth is assigned to the person. Additionally the following dependencies have been updated: tryton: - Update to 3.8.12. - Sanitize path in file open. (boo#1016886, CVE-2016-1242) - Prevent read of user password hash. (boo#1016885, CVE-2016-1241) trytond: - Update to 3.8.9. - Sanitize path in file open. (boo#1016886, CVE-2016-1242) - Prevent read of user password hash. (boo#1016885, CVE-2016-1241) trytond_account: - Update to 3.8.5. trytond_account_invoice: - Update to 3.8.4. trytond_stock: - Update to 3.8.4. trytond_stock_lot: - Update to 3.8.1. porteus: - Update to 3.8.5. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-01/msg00005.html E-Mail link for openSUSE-SU-2017:0009-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 gnuhealth-3.0.5-3.1 proteus-3.8.5-3.1 tryton-3.8.12-3.1 trytond-3.8.9-4.1 trytond_account-3.8.5-3.1 trytond_account_invoice-3.8.4-3.1 trytond_stock-3.8.4-3.1 trytond_stock_lot-3.8.1-3.1 gnuhealth-3.0.5-3.1 as a component of openSUSE Leap 42.2 proteus-3.8.5-3.1 as a component of openSUSE Leap 42.2 tryton-3.8.12-3.1 as a component of openSUSE Leap 42.2 trytond-3.8.9-4.1 as a component of openSUSE Leap 42.2 trytond_account-3.8.5-3.1 as a component of openSUSE Leap 42.2 trytond_account_invoice-3.8.4-3.1 as a component of openSUSE Leap 42.2 trytond_stock-3.8.4-3.1 as a component of openSUSE Leap 42.2 trytond_stock_lot-3.8.1-3.1 as a component of openSUSE Leap 42.2 Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors. CVE-2016-1241 openSUSE Leap 42.2:gnuhealth-3.0.5-3.1 openSUSE Leap 42.2:proteus-3.8.5-3.1 openSUSE Leap 42.2:tryton-3.8.12-3.1 openSUSE Leap 42.2:trytond-3.8.9-4.1 openSUSE Leap 42.2:trytond_account-3.8.5-3.1 openSUSE Leap 42.2:trytond_account_invoice-3.8.4-3.1 openSUSE Leap 42.2:trytond_stock-3.8.4-3.1 openSUSE Leap 42.2:trytond_stock_lot-3.8.1-3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-01/msg00005.html https://www.suse.com/security/cve/CVE-2016-1241.html CVE-2016-1241 https://bugzilla.suse.com/1016817 SUSE Bug 1016817 https://bugzilla.suse.com/1016885 SUSE Bug 1016885 file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors. CVE-2016-1242 openSUSE Leap 42.2:gnuhealth-3.0.5-3.1 openSUSE Leap 42.2:proteus-3.8.5-3.1 openSUSE Leap 42.2:tryton-3.8.12-3.1 openSUSE Leap 42.2:trytond-3.8.9-4.1 openSUSE Leap 42.2:trytond_account-3.8.5-3.1 openSUSE Leap 42.2:trytond_account_invoice-3.8.4-3.1 openSUSE Leap 42.2:trytond_stock-3.8.4-3.1 openSUSE Leap 42.2:trytond_stock_lot-3.8.1-3.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-01/msg00005.html https://www.suse.com/security/cve/CVE-2016-1242.html CVE-2016-1242 https://bugzilla.suse.com/1016817 SUSE Bug 1016817 https://bugzilla.suse.com/1016886 SUSE Bug 1016886