August 2012 - openSUSE Security Announce

[security-announce] openSUSE-SU-2012:0992-1: important: opera to 12.01
by opensuse-security＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Security Update: opera to 12.01 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0992-1 Rating: important References: #774191 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Opera was updated to version 12.1, fixing various bugs and security issues. http://www.opera.com/docs/changelogs/unix/1201/ Fixes and Stability Enhancements since Opera 12.00 General and User Interface Several general fixes and stability improvements Website thumbnail memory usage improvements Address bar inline auto-completion no longer prefers shortest domain Corrected an error that could occur after removing the plugin wrapper Resolved an issue where favicons were squeezed too much when many tabs were open Display and Scripting Resolved an error with XHR transfers where content-type was incorrectly determined Improved handling of object literals with numeric duplicate properties Changed behavior of nested/chained comma expressions: now expressing and compiling them as a list rather than a tree Aligned behavior of the #caller property on function code objects in ECMAScript 5 strict mode with the specification Fixed an issue where input type=month would return an incorrect value in its valueAsDate property Resolved an issue with JSON.stringify() that could occur on cached number conversion Fixed a problem with redefining special properties using Object.defineProperty() Network and Site-Specific Fixed an issue where loading would stop at "Document 100%" but the page would still be loading tuenti.com: Corrected behavior when long content was displayed https://twitter.com: Fixed an issue with secure transaction errors Fixed an issue with Google Maps Labs that occured when compiling top-level loops inside strict evals Corrected a problem that could occur with DISQUS Fixed a crash occurring on Lenovo's "Shop now" page Corrected issues when calling window.console.log via a variable at watch4you Resolved an issue with Yahoo! chat Mail, News, Chat Resolved an issue where under certain conditions the mail panel would continuously scroll up Fixed a crash occurring when loading mail databases on startup Security Re-fixed an issue where certain URL constructs could allow arbitrary code execution, as reported by Andrey Stroganov; see our advisory Fixed an issue where certain characters in HTML could incorrectly be ignored, which could facilitate XSS attacks; see our advisory Fixed another issue where small windows could be used to trick users into executing downloads as reported by Jordi Chancel; see our advisory Fixed an issue where an element's HTML content could be incorrectly returned without escaping, bypassing some HTML sanitizers; see our advisory Fixed a low severity issue, details will be disclosed at a later date Advisory links from above: http://www.opera.com/support/kb/view/1016/ http://www.opera.com/support/kb/view/1026/ http://www.opera.com/support/kb/view/1027/ http://www.opera.com/support/kb/view/1025/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-515 - openSUSE 11.4: zypper in -t patch openSUSE-2012-515 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): opera-12.01-19.1 opera-gtk-12.01-19.1 opera-kde4-12.01-19.1 - openSUSE 11.4 (i586 x86_64): opera-12.01-25.1 opera-gtk-12.01-25.1 opera-kde4-12.01-25.1 References: https://bugzilla.novell.com/774191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0984-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 13 Aug '12

13 Aug '12

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0984-1 Rating: important References: #765092 #769062 Cross-References: CVE-2012-2122 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: MySQL has been upgraded to version 5.0.96 to fix several vulnerabilities. Security Issue reference: * CVE-2012-2122 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2122 > * CVE-2012-0075 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0075 > * CVE-2012-0114 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0114 > * CVE-2012-0490 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0490 > * CVE-2012-0484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0484 > * CVE-2012-0102 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0102 > * CVE-2012-0101 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0101 > * CVE-2012-0087 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0087 > * CVE-2009-5026 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5026 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libmysqlclient-devel-6613 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient-devel-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient_r15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ia64) [New Version: 5.0.96]: libmysqlclient_r15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient-devel-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient_r15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ia64) [New Version: 5.0.96]: libmysqlclient_r15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-Max-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 mysql-tools-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 5.0.96]: libmysqlclient15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-Max-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 mysql-tools-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-Max-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 mysql-tools-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 (ia64) [New Version: 5.0.96]: libmysqlclient15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 libmysqlclient_r15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 libmysqlclient_r15-32bit-5.0.96-0.4.1 References: http://support.novell.com/security/cve/CVE-2012-2122.html https://bugzilla.novell.com/765092 https://bugzilla.novell.com/769062 http://download.novell.com/patch/finder/?keywords=35c5a59a35da626d86071585e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0983-1: important: Security update for puppet
by opensuse-security＠opensuse.org 13 Aug '12

13 Aug '12

SUSE Security Update: Security update for puppet ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0983-1 Rating: important References: #770828 #770829 #770833 Cross-References: CVE-2012-3864 CVE-2012-3865 CVE-2012-3867 Affected Products: SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: The following bugs have been fixed in puppet: * bnc#770828, CVE-2012-3864: puppet: authenticated clients can read arbitrary files via a flaw in puppet master * bnc#770829, CVE-2012-3865: puppet: arbitrary file delete / Denial of Service on Puppet Master by authenticated clients * bnc#770833, CVE-2012-3867: puppet: insufficient input validation for agent certificate names Security Issue references: * CVE-2012-3867 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3867 > * CVE-2012-3864 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3864 > * CVE-2012-3865 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3865 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp1-puppet-6561 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-puppet-6561 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-puppet-6561 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-puppet-6561 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-puppet-6561 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 puppet-server-2.6.17-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 puppet-server-2.6.17-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 puppet-server-2.6.17-0.3.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 References: http://support.novell.com/security/cve/CVE-2012-3864.html http://support.novell.com/security/cve/CVE-2012-3865.html http://support.novell.com/security/cve/CVE-2012-3867.html https://bugzilla.novell.com/770828 https://bugzilla.novell.com/770829 https://bugzilla.novell.com/770833 http://download.novell.com/patch/finder/?keywords=546d90cdf89ec25e98329eee8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0982-1: important: update for icedtea-web
by opensuse-security＠opensuse.org 13 Aug '12

13 Aug '12

openSUSE Security Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0982-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of icedtea-web fixed multiple hewap buffer overflows. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-513 - openSUSE 11.4: zypper in -t patch openSUSE-2012-513 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2.1-10.1 icedtea-web-debuginfo-1.2.1-10.1 icedtea-web-debugsource-1.2.1-10.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2.1-10.1 - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2.1-0.17.1 icedtea-web-debuginfo-1.2.1-0.17.1 icedtea-web-debugsource-1.2.1-0.17.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2.1-0.17.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0981-1: important: icedtea-web: Update to 1.2.1 (bnc#)
by opensuse-security＠opensuse.org 10 Aug '12

10 Aug '12

openSUSE Security Update: icedtea-web: Update to 1.2.1 (bnc#) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0981-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - update to 1.2.1 (bnc#773458) - Security Updates * CVE-2012-3422, RH840592: Potential read from an uninitialized memory location * CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings - NetX * PR898: signed applications with big jnlp-file doesn't start (webstart affect like "frozen") * PR811: javaws is not handling urls with spaces (and other characters needing encoding) correctly * 816592: icedtea-web not loading GeoGebra java applets in Firefox or Chrome - Plugin * PR863: Error passing strings to applet methods in Chromium * PR895: IcedTea-Web searches for missing classes on each loadClass or findClass * PR518: NPString.utf8characters not guaranteed to be nul-terminated - Common * RH838417: Disambiguate signed applet security prompt from certificate warning * RH838559: Disambiguate signed applet security prompt from certificate warning Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-512 - openSUSE 11.4: zypper in -t patch openSUSE-2012-512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2.1-6.1 icedtea-web-debuginfo-1.2.1-6.1 icedtea-web-debugsource-1.2.1-6.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2.1-6.1 - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2.1-0.13.1 icedtea-web-debuginfo-1.2.1-0.13.1 icedtea-web-debugsource-1.2.1-0.13.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2.1-0.13.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0979-1: important: Security update for icedtea-web
by opensuse-security＠opensuse.org 09 Aug '12

09 Aug '12

SUSE Security Update: Security update for icedtea-web ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0979-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: The icedtea-web Java browser plugin was updated to 1.2.1 to fix security issues and bugs. * CVE-2012-3422: Potential read from a uninitialized memory location has been fixed. * CVE-2012-3423: Incorrect handling of not-0 terminated strings has been fixed. Security Issue references: * CVE-2012-3422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3422 > * CVE-2012-3423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3423 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-icedtea-web-6626 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-icedtea-web-6621 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 1.2.1]: icedtea-web-1.2.1-0.7.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 1.2.1]: icedtea-web-1.2.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458 http://download.novell.com/patch/finder/?keywords=5f0430d04113f5d3e980b6c97… http://download.novell.com/patch/finder/?keywords=d6a8bcd6fbc566e30623b17ca… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0978-1: important: rubygem-actionpack/activerecord-2_3
by opensuse-security＠opensuse.org 09 Aug '12

09 Aug '12

openSUSE Security Update: rubygem-actionpack/activerecord-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0978-1 Rating: important References: #765097 #766792 Cross-References: CVE-2012-2660 CVE-2012-2694 CVE-2012-2695 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: 3 Security issues were fixed in rails 2.3 core components. 2 NULL query issues where fixed in the actionpack gem. 1 SQL injection was fixed in the activerecord gem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-508 - openSUSE 11.4: zypper in -t patch openSUSE-2012-508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): rubygem-actionpack-2_3-2.3.14-3.8.1 rubygem-actionpack-2_3-doc-2.3.14-3.8.1 rubygem-actionpack-2_3-testsuite-2.3.14-3.8.1 rubygem-activerecord-2_3-2.3.14-3.8.1 rubygem-activerecord-2_3-doc-2.3.14-3.8.1 rubygem-activerecord-2_3-testsuite-2.3.14-3.8.1 - openSUSE 11.4 (i586 x86_64): rubygem-actionpack-2_3-2.3.14-0.16.1 rubygem-actionpack-2_3-doc-2.3.14-0.16.1 rubygem-actionpack-2_3-testsuite-2.3.14-0.16.1 rubygem-activerecord-2_3-2.3.14-0.16.1 rubygem-activerecord-2_3-doc-2.3.14-0.16.1 rubygem-activerecord-2_3-testsuite-2.3.14-0.16.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2694.html http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/765097 https://bugzilla.novell.com/766792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0958-1: important: Security update for auditlog-keeper
by opensuse-security＠opensuse.org 06 Aug '12

06 Aug '12

SUSE Security Update: Security update for auditlog-keeper ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0958-1 Rating: important References: #771335 Cross-References: CVE-2012-0421 Affected Products: SUSE Manager 1.2 for SLE 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: auditlog-keeper was updated to fix the following issue: * /etc/auditlog-keeper.conf was world-readable and contains various passwords. (CVE-2012-0421) Security Issue reference: * CVE-2012-0421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0421 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.2 for SLE 11 SP1: zypper in -t patch sleman12sp1-auditlog-keeper-6603 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.2 for SLE 11 SP1 (noarch) [New Version: 0.2.1]: auditlog-keeper-0.2.1-0.4.6.1 References: http://support.novell.com/security/cve/CVE-2012-0421.html https://bugzilla.novell.com/771335 http://download.novell.com/patch/finder/?keywords=286a6089e03a2dc757e711cf4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0935-1: important: seamonkey: Update to Seamonkey 2.11
by opensuse-security＠opensuse.org 01 Aug '12

01 Aug '12

openSUSE Security Update: seamonkey: Update to Seamonkey 2.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0935-1 Rating: important References: #771583 Cross-References: CVE-2012-1948 CVE-2012-1949 CVE-2012-1951 CVE-2012-1952 CVE-2012-1953 CVE-2012-1954 CVE-2012-1955 CVE-2012-1957 CVE-2012-1958 CVE-2012-1959 CVE-2012-1960 CVE-2012-1961 CVE-2012-1962 CVE-2012-1963 CVE-2012-1967 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: Seamonkey was updated to version 2.11 (bnc#771583) * MFSA 2012-42/CVE-2012-1949/CVE-2012-1948 Miscellaneous memory safety hazards * MFSA 2012-44/CVE-2012-1951/CVE-2012-1954/CVE-2012-1953/CVE-2012-1 952 Gecko memory corruption * MFSA 2012-45/CVE-2012-1955 (bmo#757376) Spoofing issue with location * MFSA 2012-47/CVE-2012-1957 (bmo#750096) Improper filtering of javascript in HTML feed-view * MFSA 2012-48/CVE-2012-1958 (bmo#750820) use-after-free in nsGlobalWindow::PageHidden * MFSA 2012-49/CVE-2012-1959 (bmo#754044, bmo#737559) Same-compartment Security Wrappers can be bypassed * MFSA 2012-50/CVE-2012-1960 (bmo#761014) Out of bounds read in QCMS * MFSA 2012-51/CVE-2012-1961 (bmo#761655) X-Frame-Options header ignored when duplicated * MFSA 2012-52/CVE-2012-1962 (bmo#764296) JSDependentString::undepend string conversion results in memory corruption * MFSA 2012-53/CVE-2012-1963 (bmo#767778) Content Security Policy 1.0 implementation errors cause data leakage * MFSA 2012-56/CVE-2012-1967 (bmo#758344) Code execution through javascript: URLs * relicensed to MPL-2.0 - updated/removed patches - requires NSS 3.13.5 - update to Seamonkey 2.10.1 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-473 - openSUSE 11.4: zypper in -t patch openSUSE-2012-473 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): seamonkey-2.11-2.24.2 seamonkey-debuginfo-2.11-2.24.2 seamonkey-debugsource-2.11-2.24.2 seamonkey-dom-inspector-2.11-2.24.2 seamonkey-irc-2.11-2.24.2 seamonkey-translations-common-2.11-2.24.2 seamonkey-translations-other-2.11-2.24.2 seamonkey-venkman-2.11-2.24.2 - openSUSE 11.4 (i586 x86_64): seamonkey-2.11-24.3 seamonkey-debuginfo-2.11-24.3 seamonkey-debugsource-2.11-24.3 seamonkey-dom-inspector-2.11-24.3 seamonkey-irc-2.11-24.3 seamonkey-translations-common-2.11-24.3 seamonkey-translations-other-2.11-24.3 seamonkey-venkman-2.11-24.3 References: http://support.novell.com/security/cve/CVE-2012-1948.html http://support.novell.com/security/cve/CVE-2012-1949.html http://support.novell.com/security/cve/CVE-2012-1951.html http://support.novell.com/security/cve/CVE-2012-1952.html http://support.novell.com/security/cve/CVE-2012-1953.html http://support.novell.com/security/cve/CVE-2012-1954.html http://support.novell.com/security/cve/CVE-2012-1955.html http://support.novell.com/security/cve/CVE-2012-1957.html http://support.novell.com/security/cve/CVE-2012-1958.html http://support.novell.com/security/cve/CVE-2012-1959.html http://support.novell.com/security/cve/CVE-2012-1960.html http://support.novell.com/security/cve/CVE-2012-1961.html http://support.novell.com/security/cve/CVE-2012-1962.html http://support.novell.com/security/cve/CVE-2012-1963.html http://support.novell.com/security/cve/CVE-2012-1967.html https://bugzilla.novell.com/771583 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0