November 2013 - openSUSE Security Announce

[security-announce] openSUSE-SU-2013:1634-1: important: Mozilla updates 10/2013
by opensuse-security＠opensuse.org 07 Nov '13

07 Nov '13

openSUSE Security Update: Mozilla updates 10/2013 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1634-1 Rating: important References: #847708 Cross-References: CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: Update NSPR to 4.10.1 Update Thunderbird to 24.1.0 (incl. enigmail 1.6) Update Firefox to 24.1.0esr Changes in MozillaFirefox: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Changes in MozillaThunderbird: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates - update to Thunderbird 24.0.1 * fqdn for smtp server name was not accepted (bmo#913785) * fixed crash in PL_strncasecmp (bmo#917955) - update Enigmail to 1.6 * The passphrase timeout configuration in Enigmail is now read and written from/to gpg-agent. * New dialog to change the expiry date of keys * New function to search for the OpenPGP keys of all Address Book entries on a keyserver * removed obsolete enigmail-build.patch Changes in mozilla-nspr: - update to version 4.10.1 * bmo#888273: RWIN Scaling (RFC1323) limited to 2 on Windows 7 and 8 (Windows only) * bmo#907512: Unix platforms shouldn't mask errors specific to Unix domain sockets Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-155 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.1.0-91.1 MozillaFirefox-branding-upstream-24.1.0-91.1 MozillaFirefox-buildsymbols-24.1.0-91.1 MozillaFirefox-debuginfo-24.1.0-91.1 MozillaFirefox-debugsource-24.1.0-91.1 MozillaFirefox-devel-24.1.0-91.1 MozillaFirefox-translations-common-24.1.0-91.1 MozillaFirefox-translations-other-24.1.0-91.1 MozillaThunderbird-24.1.0-77.2 MozillaThunderbird-buildsymbols-24.1.0-77.2 MozillaThunderbird-debuginfo-24.1.0-77.2 MozillaThunderbird-debugsource-24.1.0-77.2 MozillaThunderbird-devel-24.1.0-77.2 MozillaThunderbird-translations-common-24.1.0-77.2 MozillaThunderbird-translations-other-24.1.0-77.2 enigmail-1.6.0+24.1.0-77.2 mozilla-nspr-4.10.1-32.1 mozilla-nspr-debuginfo-4.10.1-32.1 mozilla-nspr-debugsource-4.10.1-32.1 mozilla-nspr-devel-4.10.1-32.1 seamonkey-2.22-81.1 seamonkey-debuginfo-2.22-81.1 seamonkey-debugsource-2.22-81.1 seamonkey-dom-inspector-2.22-81.1 seamonkey-irc-2.22-81.1 seamonkey-translations-common-2.22-81.1 seamonkey-translations-other-2.22-81.1 seamonkey-venkman-2.22-81.1 - openSUSE 11.4 (x86_64): mozilla-nspr-32bit-4.10.1-32.1 mozilla-nspr-debuginfo-32bit-4.10.1-32.1 - openSUSE 11.4 (ia64): mozilla-nspr-debuginfo-x86-4.10.1-32.1 mozilla-nspr-x86-4.10.1-32.1 References: http://support.novell.com/security/cve/CVE-2013-5590.html http://support.novell.com/security/cve/CVE-2013-5591.html http://support.novell.com/security/cve/CVE-2013-5592.html http://support.novell.com/security/cve/CVE-2013-5593.html http://support.novell.com/security/cve/CVE-2013-5595.html http://support.novell.com/security/cve/CVE-2013-5596.html http://support.novell.com/security/cve/CVE-2013-5597.html http://support.novell.com/security/cve/CVE-2013-5599.html http://support.novell.com/security/cve/CVE-2013-5600.html http://support.novell.com/security/cve/CVE-2013-5601.html http://support.novell.com/security/cve/CVE-2013-5602.html http://support.novell.com/security/cve/CVE-2013-5603.html http://support.novell.com/security/cve/CVE-2013-5604.html https://bugzilla.novell.com/847708 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1633-1: important: Mozilla Suite: Update to October 2013 release
by opensuse-security＠opensuse.org 07 Nov '13

07 Nov '13

openSUSE Security Update: Mozilla Suite: Update to October 2013 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1633-1 Rating: important References: #840485 #847708 Cross-References: CVE-2013-1705 CVE-2013-1718 CVE-2013-1722 CVE-2013-1725 CVE-2013-1730 CVE-2013-1732 CVE-2013-1735 CVE-2013-1736 CVE-2013-1737 CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5598 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: MozillaFirefox was updated to Firefox 25.0. MozillaThunderbird was updated to Thunderbird 24.1.0. Mozilla XULRunner was updated to 17.0.10esr. Mozilla NSPR was updated to 4.10.1. Changes in MozillaFirefox: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Changes in MozillaThunderbird: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates - update to Thunderbird 24.0.1 * fqdn for smtp server name was not accepted (bmo#913785) * fixed crash in PL_strncasecmp (bmo#917955) - update Enigmail to 1.6 * The passphrase timeout configuration in Enigmail is now read and written from/to gpg-agent. * New dialog to change the expiry date of keys * New function to search for the OpenPGP keys of all Address Book entries on a keyserver * removed obsolete enigmail-build.patch Changes in xulrunner: - update to 17.0.10esr (bnc#847708) * require NSS 3.14.4 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - update to 17.0.9esr (bnc#840485) * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards * MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning * MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new Javascript objects can lead to memory corruption * MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes * MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats * MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling * MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong "this" object Changes in mozilla-nspr: - update to version 4.10.1 * bmo#888273: RWIN Scaling (RFC1323) limited to 2 on Windows 7 and 8 (Windows only) * bmo#907512: Unix platforms shouldn't mask errors specific to Unix domain sockets Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-819 - openSUSE 12.2: zypper in -t patch openSUSE-2013-819 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaFirefox-25.0-1.39.1 MozillaFirefox-branding-upstream-25.0-1.39.1 MozillaFirefox-buildsymbols-25.0-1.39.1 MozillaFirefox-debuginfo-25.0-1.39.1 MozillaFirefox-debugsource-25.0-1.39.1 MozillaFirefox-devel-25.0-1.39.1 MozillaFirefox-translations-common-25.0-1.39.1 MozillaFirefox-translations-other-25.0-1.39.1 MozillaThunderbird-24.1.0-61.31.1 MozillaThunderbird-buildsymbols-24.1.0-61.31.1 MozillaThunderbird-debuginfo-24.1.0-61.31.1 MozillaThunderbird-debugsource-24.1.0-61.31.1 MozillaThunderbird-devel-24.1.0-61.31.1 MozillaThunderbird-translations-common-24.1.0-61.31.1 MozillaThunderbird-translations-other-24.1.0-61.31.1 enigmail-1.6.0+24.1.0-61.31.1 enigmail-debuginfo-1.6.0+24.1.0-61.31.1 mozilla-js-17.0.10-1.30.2 mozilla-js-debuginfo-17.0.10-1.30.2 mozilla-nspr-4.10.1-1.18.1 mozilla-nspr-debuginfo-4.10.1-1.18.1 mozilla-nspr-debugsource-4.10.1-1.18.1 mozilla-nspr-devel-4.10.1-1.18.1 xulrunner-17.0.10-1.30.2 xulrunner-buildsymbols-17.0.10-1.30.2 xulrunner-debuginfo-17.0.10-1.30.2 xulrunner-debugsource-17.0.10-1.30.2 xulrunner-devel-17.0.10-1.30.2 xulrunner-devel-debuginfo-17.0.10-1.30.2 - openSUSE 12.3 (x86_64): mozilla-js-32bit-17.0.10-1.30.2 mozilla-js-debuginfo-32bit-17.0.10-1.30.2 mozilla-nspr-32bit-4.10.1-1.18.1 mozilla-nspr-debuginfo-32bit-4.10.1-1.18.1 xulrunner-32bit-17.0.10-1.30.2 xulrunner-debuginfo-32bit-17.0.10-1.30.2 - openSUSE 12.2 (i586 x86_64): MozillaFirefox-25.0-2.63.1 MozillaFirefox-branding-upstream-25.0-2.63.1 MozillaFirefox-buildsymbols-25.0-2.63.1 MozillaFirefox-debuginfo-25.0-2.63.1 MozillaFirefox-debugsource-25.0-2.63.1 MozillaFirefox-devel-25.0-2.63.1 MozillaFirefox-translations-common-25.0-2.63.1 MozillaFirefox-translations-other-25.0-2.63.1 MozillaThunderbird-24.1.0-49.59.2 MozillaThunderbird-buildsymbols-24.1.0-49.59.2 MozillaThunderbird-debuginfo-24.1.0-49.59.2 MozillaThunderbird-debugsource-24.1.0-49.59.2 MozillaThunderbird-devel-24.1.0-49.59.2 MozillaThunderbird-translations-common-24.1.0-49.59.2 MozillaThunderbird-translations-other-24.1.0-49.59.2 enigmail-1.6.0+24.1.0-49.59.2 mozilla-js-17.0.10-2.56.2 mozilla-js-debuginfo-17.0.10-2.56.2 mozilla-nspr-4.10.1-1.20.1 mozilla-nspr-debuginfo-4.10.1-1.20.1 mozilla-nspr-debugsource-4.10.1-1.20.1 mozilla-nspr-devel-4.10.1-1.20.1 xulrunner-17.0.10-2.56.2 xulrunner-buildsymbols-17.0.10-2.56.2 xulrunner-debuginfo-17.0.10-2.56.2 xulrunner-debugsource-17.0.10-2.56.2 xulrunner-devel-17.0.10-2.56.2 xulrunner-devel-debuginfo-17.0.10-2.56.2 - openSUSE 12.2 (x86_64): mozilla-js-32bit-17.0.10-2.56.2 mozilla-js-debuginfo-32bit-17.0.10-2.56.2 mozilla-nspr-32bit-4.10.1-1.20.1 mozilla-nspr-debuginfo-32bit-4.10.1-1.20.1 xulrunner-32bit-17.0.10-2.56.2 xulrunner-debuginfo-32bit-17.0.10-2.56.2 References: http://support.novell.com/security/cve/CVE-2013-1705.html http://support.novell.com/security/cve/CVE-2013-1718.html http://support.novell.com/security/cve/CVE-2013-1722.html http://support.novell.com/security/cve/CVE-2013-1725.html http://support.novell.com/security/cve/CVE-2013-1730.html http://support.novell.com/security/cve/CVE-2013-1732.html http://support.novell.com/security/cve/CVE-2013-1735.html http://support.novell.com/security/cve/CVE-2013-1736.html http://support.novell.com/security/cve/CVE-2013-1737.html http://support.novell.com/security/cve/CVE-2013-5590.html http://support.novell.com/security/cve/CVE-2013-5591.html http://support.novell.com/security/cve/CVE-2013-5592.html http://support.novell.com/security/cve/CVE-2013-5593.html http://support.novell.com/security/cve/CVE-2013-5595.html http://support.novell.com/security/cve/CVE-2013-5596.html http://support.novell.com/security/cve/CVE-2013-5597.html http://support.novell.com/security/cve/CVE-2013-5598.html http://support.novell.com/security/cve/CVE-2013-5599.html http://support.novell.com/security/cve/CVE-2013-5600.html http://support.novell.com/security/cve/CVE-2013-5601.html http://support.novell.com/security/cve/CVE-2013-5602.html http://support.novell.com/security/cve/CVE-2013-5603.html http://support.novell.com/security/cve/CVE-2013-5604.html https://bugzilla.novell.com/840485 https://bugzilla.novell.com/847708 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1631-2: important: Security update for vino
by opensuse-security＠opensuse.org 06 Nov '13

06 Nov '13

SUSE Security Update: Security update for vino ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1631-2 Rating: important References: #843174 Cross-References: CVE-2013-5745 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: vino has been updated to fix a remote denial of service problem where remote attackers could have caused a infinite loop in vino (CPU consumption). (CVE-2013-5745) Security Issue reference: * CVE-2013-5745 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5745 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-vino-8443 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-vino-8443 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-vino-8443 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): vino-2.28.1-2.5.1 vino-lang-2.28.1-2.5.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): vino-2.28.1-2.5.1 vino-lang-2.28.1-2.5.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): vino-2.28.1-2.5.1 vino-lang-2.28.1-2.5.1 References: http://support.novell.com/security/cve/CVE-2013-5745.html https://bugzilla.novell.com/843174 http://download.novell.com/patch/finder/?keywords=31ea438ae8405031fe087487a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1631-1: important: Security update for vino
by opensuse-security＠opensuse.org 06 Nov '13

06 Nov '13

SUSE Security Update: Security update for vino ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1631-1 Rating: important References: #843174 Cross-References: CVE-2013-5745 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: vino has been updated to fix a remote denial of service problem where remote attackers could have caused a infinite loop in vino (CPU consumption). (CVE-2013-5745) Security Issue reference: * CVE-2013-5745 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5745 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-vino-8442 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-vino-8442 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-vino-8442 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): vino-2.28.1-2.5.1 vino-lang-2.28.1-2.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): vino-2.28.1-2.5.1 vino-lang-2.28.1-2.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): vino-2.28.1-2.5.1 vino-lang-2.28.1-2.5.1 References: http://support.novell.com/security/cve/CVE-2013-5745.html https://bugzilla.novell.com/843174 http://download.novell.com/patch/finder/?keywords=82db9ceb786085d56f99202b6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1627-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 04 Nov '13

04 Nov '13

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1627-1 Rating: important References: #829077 Cross-References: CVE-2011-3102 CVE-2011-3919 CVE-2012-0841 CVE-2012-2807 CVE-2012-5134 CVE-2013-0338 CVE-2013-0339 CVE-2013-2877 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: libxml2 has been updated to fix the following security issue: * CVE-2013-0338: libxml2 allowed context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. Security Issue references: * CVE-2013-0338 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0338 > * CVE-2013-0339 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0339 > * CVE-2012-5134 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5134 > * CVE-2012-2807 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2807 > * CVE-2011-3102 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3102 > * CVE-2012-0841 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0841 > * CVE-2011-3919 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919 > * CVE-2013-2877 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877 > Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): libxml2-2.6.23-15.39.1 libxml2-devel-2.6.23-15.39.1 libxml2-python-2.6.23-15.39.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): libxml2-32bit-2.6.23-15.39.1 libxml2-devel-32bit-2.6.23-15.39.1 References: http://support.novell.com/security/cve/CVE-2011-3102.html http://support.novell.com/security/cve/CVE-2011-3919.html http://support.novell.com/security/cve/CVE-2012-0841.html http://support.novell.com/security/cve/CVE-2012-2807.html http://support.novell.com/security/cve/CVE-2012-5134.html http://support.novell.com/security/cve/CVE-2013-0338.html http://support.novell.com/security/cve/CVE-2013-0339.html http://support.novell.com/security/cve/CVE-2013-2877.html https://bugzilla.novell.com/829077 http://download.novell.com/patch/finder/?keywords=aeb05c467f847178dc94b70e3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1626-1: important: Security update for guestfs
by opensuse-security＠opensuse.org 04 Nov '13

04 Nov '13

SUSE Security Update: Security update for guestfs ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1626-1 Rating: important References: #845720 Cross-References: CVE-2013-4419 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A predictable socketname in the guestfish commandline tool could be used by a local attacker to gain access to guestfish sessions of other users on the same system. (CVE-2013-4419) Security Issue reference: * CVE-2013-4419 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4419 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-guestfs-data-8465 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-guestfs-data-8465 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): libguestfs-devel-1.20.4-0.18.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): guestfs-data-1.20.4-0.18.1 guestfs-tools-1.20.4-0.18.1 guestfsd-1.20.4-0.18.1 libguestfs0-1.20.4-0.18.1 References: http://support.novell.com/security/cve/CVE-2013-4419.html https://bugzilla.novell.com/845720 http://download.novell.com/patch/finder/?keywords=a62e0c01924fc90649fc00040… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1625-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 04 Nov '13

04 Nov '13

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1625-1 Rating: important References: #739894 #748561 #764538 #769184 #793334 #805233 #829077 Cross-References: CVE-2011-3102 CVE-2011-3919 CVE-2012-0841 CVE-2012-2807 CVE-2012-5134 CVE-2013-0338 CVE-2013-0339 CVE-2013-2877 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This is a LTSS rollup update for the libxml2 library that fixes various security issues. * CVE-2013-2877: parser.c in libxml2 allowed remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state. * CVE-2013-0338: libxml2 allowed context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. * CVE-2012-5134: Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. * CVE-2012-2807: Multiple integer overflows in libxml2 on 64-bit Linux platforms allowed remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. * CVE-2011-3102: Off-by-one error in libxml2 allowed remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors. * CVE-2012-0841: libxml2 computed hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data. * CVE-2011-3919: A heap-based buffer overflow during decoding of entity references with overly long names has been fixed. Security Issue references: * CVE-2013-0338 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0338 > * CVE-2013-0339 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0339 > * CVE-2012-5134 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5134 > * CVE-2012-2807 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2807 > * CVE-2011-3102 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3102 > * CVE-2012-0841 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0841 > * CVE-2011-3919 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919 > * CVE-2013-2877 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877 > Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): libxml2-2.6.23-15.39.1 libxml2-devel-2.6.23-15.39.1 libxml2-python-2.6.23-15.39.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): libxml2-32bit-2.6.23-15.39.1 libxml2-devel-32bit-2.6.23-15.39.1 References: http://support.novell.com/security/cve/CVE-2011-3102.html http://support.novell.com/security/cve/CVE-2011-3919.html http://support.novell.com/security/cve/CVE-2012-0841.html http://support.novell.com/security/cve/CVE-2012-2807.html http://support.novell.com/security/cve/CVE-2012-5134.html http://support.novell.com/security/cve/CVE-2013-0338.html http://support.novell.com/security/cve/CVE-2013-0339.html http://support.novell.com/security/cve/CVE-2013-2877.html https://bugzilla.novell.com/739894 https://bugzilla.novell.com/748561 https://bugzilla.novell.com/764538 https://bugzilla.novell.com/769184 https://bugzilla.novell.com/793334 https://bugzilla.novell.com/805233 https://bugzilla.novell.com/829077 http://download.novell.com/patch/finder/?keywords=a3fdb1e2e30b1877238605841… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0