November 2012 - openSUSE Security Announce

[security-announce] SUSE-SU-2012:1455-1: important: Security update for openstack-glance
by opensuse-security＠opensuse.org 08 Nov '12

08 Nov '12

SUSE Security Update: Security update for openstack-glance ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1455-1 Rating: important References: #787814 Cross-References: CVE-2012-4573 Affected Products: SUSE Cloud 1.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: OpenStack glance had a bug where image deletion was allowed for all logged in users (CVE-2012-4573). This has been fixed. Security Issue reference: * CVE-2012-4573 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4573 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Cloud 1.0: zypper in -t patch sleclo10sp2-openstack-glance-7033 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Cloud 1.0 (x86_64): openstack-glance-2012.1+git.1344578005.120fcf4-0.7.1 python-glance-2012.1+git.1344578005.120fcf4-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-4573.html https://bugzilla.novell.com/787814 http://download.novell.com/patch/finder/?keywords=702ffac90e6c557e86e585da9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 11.4 has reached end of SUSE support - 11.4 Evergreen goes on
by Marcus Meissner 06 Nov '12

06 Nov '12

Hi, With the release of ruby on Monday 5th of November the SUSE sponsored maintenance of openSUSE 11.4 has ended. openSUSE 11.4 is now officially discontinued and out of support by SUSE. openSUSE 11.4 was the first openSUSE distribution maintained using OpenBuildService methods (known as "OBS Maintenance"), allowing full community participation. We also migrated it from the old internal SUSE method to the OBS method on the fly during the lifetime without any interruption. openSUSE 11.4 will be continued to be maintained by the Evergreen community team. Their wikipage is on http://en.opensuse.org/Evergreen , please check it out for more information. Here are some statistics: openSUSE 11.4 was released on March 4th 2011, making it 20 months of security and bugfix support. (2 openSUSE releases + 2 months) Some statistics on the released patches (compared to 11.3): Total updates: 723 (+142) Security: 416 (+58) Recommended: 306 (+85) Optional: 1 (-1) Quite some increase on updates, both security and bugfix wise. Some of this is due to the 2 months increased lifetime compared to openSUSE 11.3, some of this is due to a more open community bugfix involvement. CVE Entries: 1113 (-99) Top issues (compared to 11.3 for issues down to 5) 10 seamonkey (-4) 10 MozillaFirefox (-2) 9 php5 (+4) 9 MozillaThunderbird (-2) 8 flash-player (-4) 6 wireshark (+1) 6 opera (-4) 6 java-1_6_0-openjdk (-1) 6 bind ( 0) 5 openssl (-2) 5 libpng14 (new) 5 icedtea-web (new) And top issues sorted by CVE (Common Vulnerability Enumeration) count down to 10) (comparison to 11.3 for some ... but due to the OBS maintenance migration some CVEs are not easily accounted for) 139 MozillaThunderbird (+26) 139 MozillaFirefox (+28) 135 seamonkey (-3) 67 kernel (-61) 56 java-1_6_0-openjdk 44 flash-player (+38) 41 mozilla-nspr 30 mysql-community-server 29 php5 26 mozilla-kde4-integration 21 mariadb 21 freetype2 20 java-1_6_0-sun 18 wireshark 18 mozilla-xulrunner192 17 mysql-cluster 13 rubygem-actionpack-2_3 12 xen 11 rubygem-activerecord-2_3 10 rubygem-activesupport-2_3 10 puppet 10 libpng14

1 0

[security-announce] SUSE-SU-2012:1390-3: important: Security update for bind
by opensuse-security＠opensuse.org 05 Nov '12

05 Nov '12

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1390-3 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted RDATA could have caused the bind nameserver to lockup (CVE-2012-5166). This was a different flaw than CVE-2012-4244. Security Issue reference: * CVE-2012-5166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5166 > Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): bind-9.3.4-4.18 bind-devel-9.3.4-4.18 bind-utils-9.3.4-4.18 - SUSE CORE 9 (x86_64): bind-utils-32bit-9-201210261342 - SUSE CORE 9 (s390x): bind-utils-32bit-9-201210261352 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 http://download.novell.com/patch/finder/?keywords=cc769094d1b8a281e47121ac0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0