December 2013 - openSUSE Security Announce

[security-announce] openSUSE-SU-2013:1891-1: important: ca-certificates-mozilla: add, remove or blacklist some certificates
by opensuse-security＠opensuse.org 16 Dec '13

16 Dec '13

openSUSE Security Update: ca-certificates-mozilla: add, remove or blacklist some certificates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1891-1 Rating: important References: #854163 #854367 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The Mozilla CA certificates package was updated to match the current Mozilla revision 1.95 of certdata.txt. It blacklists some misused certificate authorities, adds some new and adjusts some others. On openSUSE 13.1 a problem with names was also fixed. * distrust: AC DG Tresor SSL (bnc#854367) * new: CA_Disig_Root_R1:2.9.0.195.3.154.238.80.144.110.40.crt server auth, code signing, email signing * new: CA_Disig_Root_R2:2.9.0.146.184.136.219.176.138.193.99.crt server auth, code signing, email signing * new: China_Internet_Network_Information_Center_EV_Certificates_Ro ot:2.4.72.159.0.1.crt server auth * changed: Digital_Signature_Trust_Co._Global_CA_1:2.4.54.112.21.150.cr t removed code signing and server auth abilities * changed: Digital_Signature_Trust_Co._Global_CA_3:2.4.54.110.211.206.c rt removed code signing and server auth abilities * new: D-TRUST_Root_Class_3_CA_2_2009:2.3.9.131.243.crt server auth * new: D-TRUST_Root_Class_3_CA_2_EV_2009:2.3.9.131.244.crt server auth * removed: Equifax_Secure_eBusiness_CA_2:2.4.55.112.207.181.crt * new: PSCProcert:2.1.11.crt server auth, code signing, email signing * new: Swisscom_Root_CA_2:2.16.30.158.40.232.72.242.229.239.195.124 .74.30.90.24.103.182.crt server auth, code signing, email signing * new: Swisscom_Root_EV_CA_2:2.17.0.242.250.100.226.116.99.211.141. 253.16.29.4.31.118.202.88.crt server auth, code signing * changed: TC_TrustCenter_Universal_CA_III:2.14.99.37.0.1.0.2.20.141.51 .21.2.228.108.244.crt removed all abilities * new: TURKTRUST_Certificate_Services_Provider_Root_2007:2.1.1.crt server auth, code signing * changed: TWCA_Root_Certification_Authority:2.1.1.crt added code signing ability Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-983 - openSUSE 12.3: zypper in -t patch openSUSE-2013-983 - openSUSE 12.2: zypper in -t patch openSUSE-2013-983 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): ca-certificates-mozilla-1.95-3.4.1 - openSUSE 12.3 (noarch): ca-certificates-mozilla-1.95-3.4.1 - openSUSE 12.2 (noarch): ca-certificates-mozilla-1.95-8.12.1 References: https://bugzilla.novell.com/854163 https://bugzilla.novell.com/854367 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1871-1: important: Mozilla updates 2013/12
by opensuse-security＠opensuse.org 13 Dec '13

13 Dec '13

openSUSE Security Update: Mozilla updates 2013/12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1871-1 Rating: important References: #854367 #854370 Cross-References: CVE-2013-5609 CVE-2013-5610 CVE-2013-5613 CVE-2013-5615 CVE-2013-5616 CVE-2013-5618 CVE-2013-6629 CVE-2013-6630 CVE-2013-6671 CVE-2013-6673 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This patch contains * mozilla-nss 3.15.3.1 which includes a certstore update (1.95) to explicitely revoke AC DG Tresor SSL intermediate CA which was misused. * Firefox 24.2esr * Thunderbird 24.2 * Seamonkey 2.23 These updates fix several security issues: * CVE-2013-5611 Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105) * CVE-2013-5609 Mozilla: Miscellaneous memory safety hazards (rv:24.2) (MFSA 2013-104) * CVE-2013-5610 Mozilla: Miscellaneous memory safety hazards (rv:26.0) (MFSA 2013-104) * CVE-2013-5612 Mozilla: Character encoding cross-origin XSS attack (MFSA 2013-106) * CVE-2013-5614 Mozilla: Sandbox restrictions not applied to nested object elements (MFSA 2013-107) * CVE-2013-5616 Mozilla: Use-after-free in event listeners (MFSA 2013-108) * CVE-2013-5619 Mozilla: Potential overflow in JavaScript binary search algorithms (MFSA 2013-110) * CVE-2013-6671 Mozilla: Segmentation violation when replacing ordered list elements (MFSA 2013-111) * CVE-2013-6673 Mozilla: Trust settings for built-in roots ignored during EV certificate validation (MFSA 2013-113) * CVE-2013-5613 Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114) * CVE-2013-5615 Mozilla: GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115) * CVE-2013-6672 Mozilla: Linux clipboard information disclosure though selection paste (MFSA 2013-112) * CVE-2013-5618 Mozilla: Use-after-free during Table Editing (MFSA 2013-109) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-170 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.2.0-95.2 MozillaFirefox-branding-upstream-24.2.0-95.2 MozillaFirefox-buildsymbols-24.2.0-95.2 MozillaFirefox-debuginfo-24.2.0-95.2 MozillaFirefox-debugsource-24.2.0-95.2 MozillaFirefox-devel-24.2.0-95.2 MozillaFirefox-translations-common-24.2.0-95.2 MozillaFirefox-translations-other-24.2.0-95.2 MozillaThunderbird-24.2.0-81.2 MozillaThunderbird-buildsymbols-24.2.0-81.2 MozillaThunderbird-debuginfo-24.2.0-81.2 MozillaThunderbird-debugsource-24.2.0-81.2 MozillaThunderbird-devel-24.2.0-81.2 MozillaThunderbird-translations-common-24.2.0-81.2 MozillaThunderbird-translations-other-24.2.0-81.2 enigmail-1.6.0+24.2.0-81.2 libfreebl3-3.15.3.1-74.1 libfreebl3-debuginfo-3.15.3.1-74.1 libsoftokn3-3.15.3.1-74.1 libsoftokn3-debuginfo-3.15.3.1-74.1 mozilla-nss-3.15.3.1-74.1 mozilla-nss-certs-3.15.3.1-74.1 mozilla-nss-certs-debuginfo-3.15.3.1-74.1 mozilla-nss-debuginfo-3.15.3.1-74.1 mozilla-nss-debugsource-3.15.3.1-74.1 mozilla-nss-devel-3.15.3.1-74.1 mozilla-nss-sysinit-3.15.3.1-74.1 mozilla-nss-sysinit-debuginfo-3.15.3.1-74.1 mozilla-nss-tools-3.15.3.1-74.1 mozilla-nss-tools-debuginfo-3.15.3.1-74.1 seamonkey-2.23-85.1 seamonkey-debuginfo-2.23-85.1 seamonkey-debugsource-2.23-85.1 seamonkey-dom-inspector-2.23-85.1 seamonkey-irc-2.23-85.1 seamonkey-translations-common-2.23-85.1 seamonkey-translations-other-2.23-85.1 seamonkey-venkman-2.23-85.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.3.1-74.1 libfreebl3-debuginfo-32bit-3.15.3.1-74.1 libsoftokn3-32bit-3.15.3.1-74.1 libsoftokn3-debuginfo-32bit-3.15.3.1-74.1 mozilla-nss-32bit-3.15.3.1-74.1 mozilla-nss-certs-32bit-3.15.3.1-74.1 mozilla-nss-certs-debuginfo-32bit-3.15.3.1-74.1 mozilla-nss-debuginfo-32bit-3.15.3.1-74.1 mozilla-nss-sysinit-32bit-3.15.3.1-74.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.3.1-74.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.3.1-74.1 libfreebl3-x86-3.15.3.1-74.1 libsoftokn3-debuginfo-x86-3.15.3.1-74.1 libsoftokn3-x86-3.15.3.1-74.1 mozilla-nss-certs-debuginfo-x86-3.15.3.1-74.1 mozilla-nss-certs-x86-3.15.3.1-74.1 mozilla-nss-debuginfo-x86-3.15.3.1-74.1 mozilla-nss-sysinit-debuginfo-x86-3.15.3.1-74.1 mozilla-nss-sysinit-x86-3.15.3.1-74.1 mozilla-nss-x86-3.15.3.1-74.1 References: http://support.novell.com/security/cve/CVE-2013-5609.html http://support.novell.com/security/cve/CVE-2013-5610.html http://support.novell.com/security/cve/CVE-2013-5613.html http://support.novell.com/security/cve/CVE-2013-5615.html http://support.novell.com/security/cve/CVE-2013-5616.html http://support.novell.com/security/cve/CVE-2013-5618.html http://support.novell.com/security/cve/CVE-2013-6629.html http://support.novell.com/security/cve/CVE-2013-6630.html http://support.novell.com/security/cve/CVE-2013-6671.html http://support.novell.com/security/cve/CVE-2013-6673.html https://bugzilla.novell.com/854367 https://bugzilla.novell.com/854370 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1870-1: important: ca-certificates-mozilla: add, remove or blacklist some certificates
by opensuse-security＠opensuse.org 13 Dec '13

13 Dec '13

openSUSE Security Update: ca-certificates-mozilla: add, remove or blacklist some certificates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1870-1 Rating: important References: #854163 #854367 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The Mozilla CA certificates package was updated to match the current Mozilla revision 1.95 of certdata.txt. It blacklists some misused certificate authorities, adds some new and adjusts some others. On openSUSE 13.1 a problem with names was also fixed. * distrust: AC DG Tresor SSL (bnc#854367) * new: CA_Disig_Root_R1:2.9.0.195.3.154.238.80.144.110.40.crt server auth, code signing, email signing * new: CA_Disig_Root_R2:2.9.0.146.184.136.219.176.138.193.99.crt server auth, code signing, email signing * new: China_Internet_Network_Information_Center_EV_Certificates_Ro ot:2.4.72.159.0.1.crt server auth * changed: Digital_Signature_Trust_Co._Global_CA_1:2.4.54.112.21.150.cr t removed code signing and server auth abilities * changed: Digital_Signature_Trust_Co._Global_CA_3:2.4.54.110.211.206.c rt removed code signing and server auth abilities * new: D-TRUST_Root_Class_3_CA_2_2009:2.3.9.131.243.crt server auth * new: D-TRUST_Root_Class_3_CA_2_EV_2009:2.3.9.131.244.crt server auth * removed: Equifax_Secure_eBusiness_CA_2:2.4.55.112.207.181.crt * new: PSCProcert:2.1.11.crt server auth, code signing, email signing * new: Swisscom_Root_CA_2:2.16.30.158.40.232.72.242.229.239.195.124 .74.30.90.24.103.182.crt server auth, code signing, email signing * new: Swisscom_Root_EV_CA_2:2.17.0.242.250.100.226.116.99.211.141. 253.16.29.4.31.118.202.88.crt server auth, code signing * changed: TC_TrustCenter_Universal_CA_III:2.14.99.37.0.1.0.2.20.141.51 .21.2.228.108.244.crt removed all abilities * new: TURKTRUST_Certificate_Services_Provider_Root_2007:2.1.1.crt server auth, code signing * changed: TWCA_Root_Certification_Authority:2.1.1.crt added code signing ability Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-171 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): ca-certificates-mozilla-1.95-17.1 References: https://bugzilla.novell.com/854163 https://bugzilla.novell.com/854367 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1861-1: important: chromium: update to 31.0.1650.57
by opensuse-security＠opensuse.org 12 Dec '13

12 Dec '13

openSUSE Security Update: chromium: update to 31.0.1650.57 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1861-1 Rating: important References: Cross-References: CVE-2013-2906 CVE-2013-2907 CVE-2013-2908 CVE-2013-2909 CVE-2013-2910 CVE-2013-2911 CVE-2013-2912 CVE-2013-2913 CVE-2013-2914 CVE-2013-2915 CVE-2013-2916 CVE-2013-2917 CVE-2013-2918 CVE-2013-2919 CVE-2013-2920 CVE-2013-2921 CVE-2013-2922 CVE-2013-2923 CVE-2013-2924 CVE-2013-2925 CVE-2013-2926 CVE-2013-2927 CVE-2013-2928 CVE-2013-2931 CVE-2013-6621 CVE-2013-6622 CVE-2013-6623 CVE-2013-6624 CVE-2013-6625 CVE-2013-6626 CVE-2013-6627 CVE-2013-6628 CVE-2013-6629 CVE-2013-6630 CVE-2013-6631 CVE-2013-6632 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 36 vulnerabilities is now available. Description: Chromium was updated to 31.0.1650.57: Stable channel update: - Security Fixes: * CVE-2013-6632: Multiple memory corruption issues. - Update to Chromium 31.0.1650.48 Stable Channel update: - Security fixes: * CVE-2013-6621: Use after free related to speech input elements.. * CVE-2013-6622: Use after free related to media elements. * CVE-2013-6623: Out of bounds read in SVG. * CVE-2013-6624: Use after free related to “id” attribute strings. * CVE-2013-6625: Use after free in DOM ranges. * CVE-2013-6626: Address bar spoofing related to interstitial warnings. * CVE-2013-6627: Out of bounds read in HTTP parsing. * CVE-2013-6628: Issue with certificates not being checked during TLS renegotiation. * CVE-2013-2931: Various fixes from internal audits, fuzzing and other initiatives. * CVE-2013-6629: Read of uninitialized memory in libjpeg and libjpeg-turbo. * CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo. * CVE-2013-6631: Use after free in libjingle. - Added patch chromium-fix-chromedriver-build.diff to fix the chromedriver build - Enable ARM build for Chromium. * Added patches chromium-arm-webrtc-fix.patch, chromium-fix-arm-icu.patch and chromium-fix-arm-sysroot.patch to resolve ARM specific build issues - Update to Chromium 30.0.1599.114 Stable Channel update: fix build for 32bit systems - Drop patch chromium-fix-chromedriver-build.diff. This is now fixed upstream - For openSUSE versions lower than 13.1, build against the in-tree libicu - Update to Chromium 30.0.1599.101 - Security Fixes: + CVE-2013-2925: Use after free in XHR + CVE-2013-2926: Use after free in editing + CVE-2013-2927: Use after free in forms. + CVE-2013-2928: Various fixes from internal audits, fuzzing and other initiatives. - Update to Chromium 30.0.1599.66 - Easier searching by image - A number of new apps/extension APIs - Lots of under the hood changes for stability and performance - Security fixes: + CVE-2013-2906: Races in Web Audio + CVE-2013-2907: Out of bounds read in Window.prototype object + CVE-2013-2908: Address bar spoofing related to the “204 No Content” status code + CVE-2013-2909: Use after free in inline-block rendering + CVE-2013-2910: Use-after-free in Web Audio + CVE-2013-2911: Use-after-free in XSLT + CVE-2013-2912: Use-after-free in PPAPI + CVE-2013-2913: Use-after-free in XML document parsing + CVE-2013-2914: Use after free in the Windows color chooser dialog + CVE-2013-2915: Address bar spoofing via a malformed scheme + CVE-2013-2916: Address bar spoofing related to the “204 No Content” status code + CVE-2013-2917: Out of bounds read in Web Audio + CVE-2013-2918: Use-after-free in DOM + CVE-2013-2919: Memory corruption in V8 + CVE-2013-2920: Out of bounds read in URL parsing + CVE-2013-2921: Use-after-free in resource loader + CVE-2013-2922: Use-after-free in template element + CVE-2013-2923: Various fixes from internal audits, fuzzing and other initiatives + CVE-2013-2924: Use-after-free in ICU. Upstream bug Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-961 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-31.0.1650.57-8.2 chromedriver-debuginfo-31.0.1650.57-8.2 chromium-31.0.1650.57-8.2 chromium-debuginfo-31.0.1650.57-8.2 chromium-debugsource-31.0.1650.57-8.2 chromium-desktop-gnome-31.0.1650.57-8.2 chromium-desktop-kde-31.0.1650.57-8.2 chromium-ffmpegsumo-31.0.1650.57-8.2 chromium-ffmpegsumo-debuginfo-31.0.1650.57-8.2 chromium-suid-helper-31.0.1650.57-8.2 chromium-suid-helper-debuginfo-31.0.1650.57-8.2 References: http://support.novell.com/security/cve/CVE-2013-2906.html http://support.novell.com/security/cve/CVE-2013-2907.html http://support.novell.com/security/cve/CVE-2013-2908.html http://support.novell.com/security/cve/CVE-2013-2909.html http://support.novell.com/security/cve/CVE-2013-2910.html http://support.novell.com/security/cve/CVE-2013-2911.html http://support.novell.com/security/cve/CVE-2013-2912.html http://support.novell.com/security/cve/CVE-2013-2913.html http://support.novell.com/security/cve/CVE-2013-2914.html http://support.novell.com/security/cve/CVE-2013-2915.html http://support.novell.com/security/cve/CVE-2013-2916.html http://support.novell.com/security/cve/CVE-2013-2917.html http://support.novell.com/security/cve/CVE-2013-2918.html http://support.novell.com/security/cve/CVE-2013-2919.html http://support.novell.com/security/cve/CVE-2013-2920.html http://support.novell.com/security/cve/CVE-2013-2921.html http://support.novell.com/security/cve/CVE-2013-2922.html http://support.novell.com/security/cve/CVE-2013-2923.html http://support.novell.com/security/cve/CVE-2013-2924.html http://support.novell.com/security/cve/CVE-2013-2925.html http://support.novell.com/security/cve/CVE-2013-2926.html http://support.novell.com/security/cve/CVE-2013-2927.html http://support.novell.com/security/cve/CVE-2013-2928.html http://support.novell.com/security/cve/CVE-2013-2931.html http://support.novell.com/security/cve/CVE-2013-6621.html http://support.novell.com/security/cve/CVE-2013-6622.html http://support.novell.com/security/cve/CVE-2013-6623.html http://support.novell.com/security/cve/CVE-2013-6624.html http://support.novell.com/security/cve/CVE-2013-6625.html http://support.novell.com/security/cve/CVE-2013-6626.html http://support.novell.com/security/cve/CVE-2013-6627.html http://support.novell.com/security/cve/CVE-2013-6628.html http://support.novell.com/security/cve/CVE-2013-6629.html http://support.novell.com/security/cve/CVE-2013-6630.html http://support.novell.com/security/cve/CVE-2013-6631.html http://support.novell.com/security/cve/CVE-2013-6632.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1828-1: critical: Security update for ruby
by opensuse-security＠opensuse.org 05 Dec '13

05 Dec '13

SUSE Security Update: Security update for ruby ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1828-1 Rating: critical References: #851803 Cross-References: CVE-2009-0689 CVE-2013-4164 Affected Products: WebYaST 1.3 SUSE Studio Onsite 1.3 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 SUSE Lifecycle Management Server 1.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The following security issue has been fixed: * CVE-2013-4164: heap overflow in float point parsing Security Issue references: * CVE-2013-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164 > * CVE-2009-0689 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0689 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST 1.3: zypper in -t patch slewyst13-ruby-8578 - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-ruby-8578 - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-ruby-8579 - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-ruby-8578 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-ruby-8579 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-ruby-8579 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-ruby-8578 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-ruby-8578 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-ruby-8579 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-ruby-8578 - SUSE Lifecycle Management Server 1.3: zypper in -t patch sleslms13-ruby-8578 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST 1.3 (i586 ia64 ppc64 s390x x86_64): ruby-devel-1.8.7.p357-0.9.13.1 - SUSE Studio Onsite 1.3 (x86_64): ruby-devel-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): ruby-devel-1.8.7.p357-0.9.13.1 ruby-doc-html-1.8.7.p357-0.9.13.1 ruby-doc-ri-1.8.7.p357-0.9.13.1 ruby-examples-1.8.7.p357-0.9.13.1 ruby-test-suite-1.8.7.p357-0.9.13.1 ruby-tk-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): ruby-devel-1.8.7.p357-0.9.13.1 ruby-doc-html-1.8.7.p357-0.9.13.1 ruby-doc-ri-1.8.7.p357-0.9.13.1 ruby-examples-1.8.7.p357-0.9.13.1 ruby-test-suite-1.8.7.p357-0.9.13.1 ruby-tk-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): ruby-1.8.7.p357-0.9.13.1 ruby-doc-html-1.8.7.p357-0.9.13.1 ruby-tk-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): ruby-1.8.7.p357-0.9.13.1 ruby-doc-html-1.8.7.p357-0.9.13.1 ruby-tk-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): ruby-1.8.7.p357-0.9.13.1 ruby-doc-html-1.8.7.p357-0.9.13.1 ruby-tk-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): ruby-1.8.7.p357-0.9.13.1 ruby-doc-html-1.8.7.p357-0.9.13.1 ruby-tk-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): ruby-1.8.7.p357-0.9.13.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): ruby-1.8.7.p357-0.9.13.1 - SUSE Lifecycle Management Server 1.3 (x86_64): ruby-devel-1.8.7.p357-0.9.13.1 References: http://support.novell.com/security/cve/CVE-2009-0689.html http://support.novell.com/security/cve/CVE-2013-4164.html https://bugzilla.novell.com/851803 http://download.novell.com/patch/finder/?keywords=55e519fd3f439fd9aafa49788… http://download.novell.com/patch/finder/?keywords=7cc8b87908b21ff43fefbb832… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1807-1: important: Security update for mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 02 Dec '13

02 Dec '13

SUSE Security Update: Security update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1807-1 Rating: important References: #850148 Cross-References: CVE-2013-1741 CVE-2013-5605 CVE-2013-5606 CVE-2013-5607 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes two new package versions. Description: Mozilla NSPR and NSS were updated to fix various security bugs that could be used to crash the browser or potentially execute code. Mozilla NSPR 4.10.2 has the following bug fixes: * Bug 770534: Possible pointer overflow in PL_ArenaAllocate(). Fixed by Pascal Cuoq and Kamil Dudka. * Bug 888546: ptio.c:PR_ImportUDPSocket doesn't work. Fixed by Miloslav Trmac. * Bug 915522: VS2013 support for NSPR. Fixed by Makoto Kato. * Bug 927687: Avoid unsigned integer wrapping in PL_ArenaAllocate. (CVE-2013-5607) Mozilla NSS 3.15.3 is a patch release for NSS 3.15 and includes the following bug fixes: * Bug 925100: Ensure a size is <= half of the maximum PRUint32 value. (CVE-2013-1741) * Bug 934016: Handle invalid handshake packets. (CVE-2013-5605) * Bug 910438: Return the correct result in CERT_VerifyCert on failure, if a verifyLog isn't used. (CVE-2013-5606) Security Issue references: * CVE-2013-1741 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1741 > * CVE-2013-5605 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605 > * CVE-2013-5606 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606 > * CVE-2013-5607 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5607 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-nss-201311-8573 - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-nss-201311-8572 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-nss-201311-8573 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-nss-201311-8573 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-nss-201311-8572 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-nss-201311-8572 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-nss-201311-8574 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-nss-201311-8573 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-nss-201311-8572 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: mozilla-nspr-devel-4.10.2-0.3.1 mozilla-nss-devel-3.15.3-0.8.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: mozilla-nspr-devel-4.10.2-0.3.1 mozilla-nss-devel-3.15.3-0.3.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-3.15.3-0.8.1 libsoftokn3-3.15.3-0.8.1 mozilla-nspr-4.10.2-0.3.1 mozilla-nss-3.15.3-0.8.1 mozilla-nss-tools-3.15.3-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-32bit-3.15.3-0.8.1 libsoftokn3-32bit-3.15.3-0.8.1 mozilla-nspr-32bit-4.10.2-0.3.1 mozilla-nss-32bit-3.15.3-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-3.15.3-0.8.1 libsoftokn3-3.15.3-0.8.1 mozilla-nspr-4.10.2-0.3.1 mozilla-nss-3.15.3-0.8.1 mozilla-nss-tools-3.15.3-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-32bit-3.15.3-0.8.1 libsoftokn3-32bit-3.15.3-0.8.1 mozilla-nspr-32bit-4.10.2-0.3.1 mozilla-nss-32bit-3.15.3-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-x86-3.15.3-0.8.1 libsoftokn3-x86-3.15.3-0.8.1 mozilla-nspr-x86-4.10.2-0.3.1 mozilla-nss-x86-3.15.3-0.8.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-3.15.3-0.3.1 mozilla-nspr-4.10.2-0.3.1 mozilla-nss-3.15.3-0.3.1 mozilla-nss-tools-3.15.3-0.3.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-32bit-3.15.3-0.3.1 mozilla-nspr-32bit-4.10.2-0.3.1 mozilla-nss-32bit-3.15.3-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-3.15.3-0.3.1 mozilla-nspr-4.10.2-0.3.1 mozilla-nss-3.15.3-0.3.1 mozilla-nss-tools-3.15.3-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-32bit-3.15.3-0.3.1 mozilla-nspr-32bit-4.10.2-0.3.1 mozilla-nss-32bit-3.15.3-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-x86-3.15.3-0.3.1 mozilla-nspr-x86-4.10.2-0.3.1 mozilla-nss-x86-3.15.3-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-3.15.3-0.3.1 mozilla-nspr-4.10.2-0.3.1 mozilla-nss-3.15.3-0.3.1 mozilla-nss-tools-3.15.3-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-32bit-3.15.3-0.3.1 mozilla-nspr-32bit-4.10.2-0.3.1 mozilla-nss-32bit-3.15.3-0.3.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: mozilla-nspr-4.10.2-0.5.1 mozilla-nspr-devel-4.10.2-0.5.1 mozilla-nss-3.15.3-0.5.1 mozilla-nss-devel-3.15.3-0.5.1 mozilla-nss-tools-3.15.3-0.5.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64) [New Version: 3.15.3 and 4.10.2]: mozilla-nspr-32bit-4.10.2-0.5.1 mozilla-nss-32bit-3.15.3-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64) [New Version: 3.15.3 and 4.10.2]: mozilla-nspr-4.10.2-0.5.1 mozilla-nspr-devel-4.10.2-0.5.1 mozilla-nss-3.15.3-0.5.1 mozilla-nss-devel-3.15.3-0.5.1 mozilla-nss-tools-3.15.3-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64) [New Version: 3.15.3 and 4.10.2]: mozilla-nspr-32bit-4.10.2-0.5.1 mozilla-nss-32bit-3.15.3-0.5.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-3.15.3-0.8.1 libsoftokn3-3.15.3-0.8.1 mozilla-nspr-4.10.2-0.3.1 mozilla-nss-3.15.3-0.8.1 mozilla-nss-tools-3.15.3-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-32bit-3.15.3-0.8.1 libsoftokn3-32bit-3.15.3-0.8.1 mozilla-nspr-32bit-4.10.2-0.3.1 mozilla-nss-32bit-3.15.3-0.8.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-3.15.3-0.3.1 mozilla-nspr-4.10.2-0.3.1 mozilla-nss-3.15.3-0.3.1 mozilla-nss-tools-3.15.3-0.3.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 3.15.3 and 4.10.2]: libfreebl3-32bit-3.15.3-0.3.1 mozilla-nspr-32bit-4.10.2-0.3.1 mozilla-nss-32bit-3.15.3-0.3.1 References: http://support.novell.com/security/cve/CVE-2013-1741.html http://support.novell.com/security/cve/CVE-2013-5605.html http://support.novell.com/security/cve/CVE-2013-5606.html http://support.novell.com/security/cve/CVE-2013-5607.html https://bugzilla.novell.com/850148 http://download.novell.com/patch/finder/?keywords=06e5fb9c1bb44bc958d26f52b… http://download.novell.com/patch/finder/?keywords=3847822af2a8723bbe4fbc4f6… http://download.novell.com/patch/finder/?keywords=50ea7d515940ba15ce107c64c… http://download.novell.com/patch/finder/?keywords=758c70c36ded607941fc576de… http://download.novell.com/patch/finder/?keywords=be957c00b1a9648f69c250c60… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0