August 2012 - openSUSE Security Announce

[security-announce] SUSE-SU-2012:1020-1: important: Security update for oracle-update
by opensuse-security＠opensuse.org 22 Aug '12

22 Aug '12

SUSE Security Update: Security update for oracle-update ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1020-1 Rating: important References: #757762 #771994 Cross-References: CVE-2012-0525 CVE-2012-0526 CVE-2012-0527 CVE-2012-0534 CVE-2012-0552 CVE-2012-1737 CVE-2012-1745 CVE-2012-3134 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 SUSE Manager 1.2 for SLE 11 SP1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update fixes two large sets of security issues in the Oracle Server. * http://www.oracle.com/technetwork/topics/security/cpujul2012 -392727.html <http://www.oracle.com/technetwork/topics/security/cpujul201 2-392727.html> (CVE-2012-1737, CVE-2012-1745, CVE-2012-3134) * http://www.oracle.com/technetwork/topics/security/cpuapr2012 -366314.html <http://www.oracle.com/technetwork/topics/security/cpuapr201 2-366314.html> (CVE-2012-0552, CVE-2012-0534, CVE-2012-0527, CVE-2012-0526, CVE-2012-0525) Security Issue references: * CVE-2012-0552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0552 > * CVE-2012-0534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0534 > * CVE-2012-1737 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1737 > * CVE-2012-1745 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1745 > * CVE-2012-3134 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3134 > * CVE-2012-0527 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0527 > * CVE-2012-0526 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0526 > * CVE-2012-0525 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0525 > Indications: Everyone using the Oracle DB on SUSE Manager should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-oracle-update-6685 - SUSE Manager 1.2 for SLE 11 SP1: zypper in -t patch sleman12sp1-oracle-update-6684 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): oracle-update-1.7-0.13.1 - SUSE Manager 1.2 for SLE 11 SP1 (x86_64): oracle-update-1.7-0.4.10.1 References: http://support.novell.com/security/cve/CVE-2012-0525.html http://support.novell.com/security/cve/CVE-2012-0526.html http://support.novell.com/security/cve/CVE-2012-0527.html http://support.novell.com/security/cve/CVE-2012-0534.html http://support.novell.com/security/cve/CVE-2012-0552.html http://support.novell.com/security/cve/CVE-2012-1737.html http://support.novell.com/security/cve/CVE-2012-1745.html http://support.novell.com/security/cve/CVE-2012-3134.html https://bugzilla.novell.com/757762 https://bugzilla.novell.com/771994 http://download.novell.com/patch/finder/?keywords=205067d3ac29a7b3a4b0a8d7f… http://download.novell.com/patch/finder/?keywords=c66e6782ca5a697b1ab08f6ec… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1015-1: important: Security update for rubygem-actionpack
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-actionpack ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1015-1 Rating: important References: #765097 #766791 Cross-References: CVE-2012-2660 CVE-2012-2694 Affected Products: WebYaST [Appliance - Tools] WebYaST 1.2 SUSE Studio Standard Edition 1.2 SUSE Studio Onsite 1.2 SUSE Studio Extension for System z 1.2 SUSE Linux Enterprise Software Development Kit 11 SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update to rubygem-actionpack fixes two unsafe query generations with "IS NULL" in the WHERE clause. (CVE-2012-2660 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2660 > , CVE-2012-2694 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2694 > ) Indications: Everyone using rubygem-actionpack should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST [Appliance - Tools]: zypper in -t patch slewystsp1-rubygem-actionpack-2_3-6619 - WebYaST 1.2: zypper in -t patch slewyst12-rubygem-actionpack-2_3-6665 - SUSE Studio Standard Edition 1.2: zypper in -t patch sleslms12-rubygem-actionpack-2_3-6665 - SUSE Studio Onsite 1.2: zypper in -t patch slestso12-rubygem-actionpack-2_3-6665 - SUSE Studio Extension for System z 1.2: zypper in -t patch slestso12-rubygem-actionpack-2_3-6665 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-rubygem-actionpack-2_3-6619 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST [Appliance - Tools] (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Studio Standard Edition 1.2 (x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Studio Onsite 1.2 (x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Studio Extension for System z 1.2 (s390x) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2694.html https://bugzilla.novell.com/765097 https://bugzilla.novell.com/766791 http://download.novell.com/patch/finder/?keywords=53095f9d9f8560f19044c15e6… http://download.novell.com/patch/finder/?keywords=625e07d428b32e10138b5c460… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1014-1: important: Security update for rubygem-activerecord
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-activerecord ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1014-1 Rating: important References: #766792 Cross-References: CVE-2012-2660 CVE-2012-2661 CVE-2012-2694 CVE-2012-2695 Affected Products: WebYaST 1.2 SUSE Studio Standard Edition 1.2 SUSE Studio Onsite 1.2 SUSE Studio Extension for System z 1.2 SUSE Linux Enterprise Software Development Kit 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: This update to rubygem-activerecord fixes a SQL injection caused by mishandling nested parameters . ( CVE-2012-2695 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2695 > ) Indications: Everyone using rubygem-activerecord should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST 1.2: zypper in -t patch slewyst12-rubygem-activerecord-2_3-6633 - SUSE Studio Standard Edition 1.2: zypper in -t patch sleslms12-rubygem-activerecord-2_3-6633 - SUSE Studio Onsite 1.2: zypper in -t patch slestso12-rubygem-activerecord-2_3-6633 - SUSE Studio Extension for System z 1.2: zypper in -t patch slestso12-rubygem-activerecord-2_3-6633 - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-rubygem-activerecord-2_3-6632 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Studio Standard Edition 1.2 (x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Studio Onsite 1.2 (x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Studio Extension for System z 1.2 (s390x) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): rubygem-activerecord-2_3-2.3.14-0.10.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2661.html http://support.novell.com/security/cve/CVE-2012-2694.html http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/766792 http://download.novell.com/patch/finder/?keywords=4db5459b2ac69e20925f9e05c… http://download.novell.com/patch/finder/?keywords=61bc7e2d0afb2e10760ccbe02… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1013-1: important: Security update for java-1_4_2-ibm-sap
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for java-1_4_2-ibm-sap ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1013-1 Rating: important References: #768611 Affected Products: SUSE Linux Enterprise for SAP Applications 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 SR13 FP12 has been released which fixes various bugs and security issues. The CVEs being addressed are CVE-2011-3563 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3563 > , CVE-2012-0499 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0499 > , CVE-2012-0502 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0502 > , CVE-2012-0503 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0503 > , CVE-2012-0505 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0505 > and CVE-2012-0506 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0506 > . Further information on this update is available from http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> . Indications: Everyone using java-1_4_2-sap should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise for SAP Applications 11 SP2: zypper in -t patch slesapp2-java-1_4_2-ibm-sap-6637 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise for SAP Applications 11 SP2 (x86_64): java-1_4_2-ibm-sap-1.4.2_sr13.12-0.3.1 java-1_4_2-ibm-sap-devel-1.4.2_sr13.12-0.3.1 References: https://bugzilla.novell.com/768611 http://download.novell.com/patch/finder/?keywords=f91fba551e97a31809b6ccaf5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1012-1: important: Security update for rubygem-actionpack
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-actionpack ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1012-1 Rating: important References: #765097 #766791 Cross-References: CVE-2012-2660 CVE-2012-2661 CVE-2012-2694 CVE-2012-2695 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update to rubygem-actionpack fixes two unsafe query generations with "IS NULL" in the WHERE clause. (CVE-2012-2660 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2660 > , CVE-2012-2694 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2694 > ) Indications: Everyone using rubygem-actionpack should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-rubygem-actionpack-2_3-6630 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): rubygem-actionpack-2_3-2.3.14-0.10.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2661.html http://support.novell.com/security/cve/CVE-2012-2694.html http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/765097 https://bugzilla.novell.com/766791 http://download.novell.com/patch/finder/?keywords=2f5d4cde838678b72eb3a71ff… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1011-1: important: Security update for rubygem-activerecord
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-activerecord ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1011-1 Rating: important References: #766792 Cross-References: CVE-2012-2695 Affected Products: WebYaST [Appliance - Tools] SUSE Linux Enterprise Software Development Kit 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update to rubygem-activerecord fixes a SQL injection caused by mishandling nested parameters . ( CVE-2012-2695 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2695 > ) Indications: Everyone using rubygem-activerecord should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST [Appliance - Tools]: zypper in -t patch slewystsp1-rubygem-activerecord-2_3-6620 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-rubygem-activerecord-2_3-6620 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST [Appliance - Tools] (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 References: http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/766792 http://download.novell.com/patch/finder/?keywords=f213753c3fb3cf96e214395b7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1001-2: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 Aug '12

17 Aug '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1001-2 Rating: important References: #775986 Cross-References: CVE-2012-1535 Affected Products: SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of flash-player fixes a security issue that could allow attackers to execute arbitrary code remotely. (CVE-2012-1535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1535 > ) Package List: - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.238]: flash-player-11.2.202.238-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-1535.html https://bugzilla.novell.com/775986 http://download.novell.com/patch/finder/?keywords=288a9919aa9137400b6d0a7a6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1001-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 Aug '12

17 Aug '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1001-1 Rating: important References: #775986 Cross-References: CVE-2012-1535 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of flash-player fixes a security issue that could allow attackers to execute arbitrary code remotely. (CVE-2012-1535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1535 > ) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-flash-player-6678 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-flash-player-6678 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.238]: flash-player-11.2.202.238-0.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 11.2.202.238]: flash-player-11.2.202.238-0.3.1 References: http://support.novell.com/security/cve/CVE-2012-1535.html https://bugzilla.novell.com/775986 http://download.novell.com/patch/finder/?keywords=69ad427c45a606a21500c688f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0996-1: critical: flash-player to 11.2.202.238
by opensuse-security＠opensuse.org 16 Aug '12

16 Aug '12

openSUSE Security Update: flash-player to 11.2.202.238 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0996-1 Rating: critical References: #775986 Cross-References: CVE-2012-1535 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.238 fixing various bugs and security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-518 - openSUSE 11.4: zypper in -t patch openSUSE-2012-518 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.238-27.1 flash-player-gnome-11.2.202.238-27.1 flash-player-kde4-11.2.202.238-27.1 - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.238-20.1 flash-player-gnome-11.2.202.238-20.1 flash-player-kde4-11.2.202.238-20.1 References: http://support.novell.com/security/cve/CVE-2012-1535.html https://bugzilla.novell.com/775986 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0993-1: important: update for chromium, v8
by opensuse-security＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Security Update: update for chromium, v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0993-1 Rating: important References: #760264 #770821 Cross-References: CVE-2011-3084 CVE-2011-3098 CVE-2012-2842 CVE-2012-2843 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Version upgrade of chromium to address multiple security vulnerabilities. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-516 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromedriver-22.0.1226.0-1.29.1 chromedriver-debuginfo-22.0.1226.0-1.29.1 chromium-22.0.1226.0-1.29.1 chromium-debuginfo-22.0.1226.0-1.29.1 chromium-debugsource-22.0.1226.0-1.29.1 chromium-desktop-gnome-22.0.1226.0-1.29.1 chromium-desktop-kde-22.0.1226.0-1.29.1 chromium-suid-helper-22.0.1226.0-1.29.1 chromium-suid-helper-debuginfo-22.0.1226.0-1.29.1 libv8-3-3.12.19.1-1.33.1 libv8-3-debuginfo-3.12.19.1-1.33.1 v8-devel-3.12.19.1-1.33.1 v8-private-headers-devel-3.12.19.1-1.33.1 References: http://support.novell.com/security/cve/CVE-2011-3084.html http://support.novell.com/security/cve/CVE-2011-3098.html http://support.novell.com/security/cve/CVE-2012-2842.html http://support.novell.com/security/cve/CVE-2012-2843.html https://bugzilla.novell.com/760264 https://bugzilla.novell.com/770821 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0