July 2013 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] Why no SSL for download.opensuse.org ?
by Malte Gell 07 Jul '13

07 Jul '13

We have learned how much effort governments take to control and monitor the Internet. With this in regard, wouldn´t it make sense to switch download.opensuse.org to SSL? I know, rpm packages are signed with GnuPG, but if you add a new repo an attacker still is able to give you a forged GnuPG key and a forged repo, not the repo you actually tried to subscribe to. Thus, GnuPG signing of rpm does not prohibit man in the middle attacks. I think SSL for download.opensuse.org would give more safety to people living in authoritarian regimes who want to download openSUSE software. Malte

3 2

[opensuse-security] AWAY: Re: [security-announce] SUSE-SU-2013:1150-1: important: Security update for openswan
by markus＠palominosys.com 05 Jul '13

05 Jul '13

I am out of the office until July 9 and will not have access to email until then. For any urgent matter, please contact Aaron Metler, Director Client Services, at aaron(a)palominosys.com or 416 964 7333, ext 133. Alternatively, contact Mandi Kendell at sales(a)palominosys.com or 416 964 7333, option 2. Thank you, Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] NULL pointer dereference related to glibc crypt()
by mancha 05 Jul '13

05 Jul '13

Dear all: I noticed you upgraded your xdm with a fix I developed for Xorg (openSUSE-SU-2013:1117-1). You might be interested to know this patch is part of an ongoing project of mine where I am working with developers to introduce needed protections for possible crypt()-related NULL pointer dereference situations. I share this as you might find some of these fixes valuable for OpenSUSE. My progress is being documented in Slackware's de facto bug & discussion forum (LQ): https://www.linuxquestions.org/questions/slackware-14/%5Bslackware- current%5D-glibc-2-17-shadow-and-other-penumbrae-4175461061/ I am placing all patch files in a sourceforge project: https://sourceforge.net/projects/miscellaneouspa/files/glibc217/ --mancha PGP Key ID: 0xB5ABF4FFF7048E92 Key fingerprint = 7F1F E9BF 77CF 15AC 8F6B C934 B5AB F4FF F704 8E92 -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] Unsubscribe - [security-announce] openSUSE-SU-2013:1141-1: important: MozillaThunderbird: 17.0.7
by Kontakt 04 Jul '13

04 Jul '13

-----Ursprüngliche Nachricht----- Von: opensuse-security(a)opensuse.org [mailto:opensuse-security@opensuse.org] Gesendet: Donnerstag, 4. Juli 2013 12:17 An: opensuse-security-announce(a)opensuse.org Betreff: [security-announce] openSUSE-SU-2013:1141-1: important: MozillaThunderbird: 17.0.7 openSUSE Security Update: MozillaThunderbird: 17.0.7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1141-1 Rating: important References: #825935 Cross-References: CVE-2013-1682 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1697 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaThunderbird was updated to Thunderbird 17.0.7 (bnc#825935) Security issues fixed: * MFSA 2013-49/CVE-2013-1682 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-554 - openSUSE 12.2: zypper in -t patch openSUSE-2013-554 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-17.0.7-61.17.1 MozillaThunderbird-buildsymbols-17.0.7-61.17.1 MozillaThunderbird-debuginfo-17.0.7-61.17.1 MozillaThunderbird-debugsource-17.0.7-61.17.1 MozillaThunderbird-devel-17.0.7-61.17.1 MozillaThunderbird-devel-debuginfo-17.0.7-61.17.1 MozillaThunderbird-translations-common-17.0.7-61.17.1 MozillaThunderbird-translations-other-17.0.7-61.17.1 enigmail-1.5.1+17.0.7-61.17.1 enigmail-debuginfo-1.5.1+17.0.7-61.17.1 - openSUSE 12.2 (i586 x86_64): MozillaThunderbird-17.0.7-49.47.1 MozillaThunderbird-buildsymbols-17.0.7-49.47.1 MozillaThunderbird-debuginfo-17.0.7-49.47.1 MozillaThunderbird-debugsource-17.0.7-49.47.1 MozillaThunderbird-devel-17.0.7-49.47.1 MozillaThunderbird-devel-debuginfo-17.0.7-49.47.1 MozillaThunderbird-translations-common-17.0.7-49.47.1 MozillaThunderbird-translations-other-17.0.7-49.47.1 enigmail-1.5.1+17.0.7-49.47.1 enigmail-debuginfo-1.5.1+17.0.7-49.47.1 References: http://support.novell.com/security/cve/CVE-2013-1682.html http://support.novell.com/security/cve/CVE-2013-1684.html http://support.novell.com/security/cve/CVE-2013-1685.html http://support.novell.com/security/cve/CVE-2013-1686.html http://support.novell.com/security/cve/CVE-2013-1687.html http://support.novell.com/security/cve/CVE-2013-1690.html http://support.novell.com/security/cve/CVE-2013-1692.html http://support.novell.com/security/cve/CVE-2013-1693.html http://support.novell.com/security/cve/CVE-2013-1694.html http://support.novell.com/security/cve/CVE-2013-1697.html https://bugzilla.novell.com/825935 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org -- This email was Virus checked by Astaro Security Gateway. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] AWAY: Re: [security-announce] openSUSE-SU-2013:1140-1: important: regular updates for Mozilla applications (FF/TB)
by markus＠palominosys.com 04 Jul '13

04 Jul '13

I am out of the office until July 9 and will not have access to email until then. For any urgent matter, please contact Aaron Metler, Director Client Services, at aaron(a)palominosys.com or 416 964 7333, ext 133. Alternatively, contact Mandi Kendell at sales(a)palominosys.com or 416 964 7333, option 2. Thank you, Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] AWAY: Re: [security-announce] SUSE-SU-2013:0871-2: important: Security update for IBM Java
by markus＠palominosys.com 03 Jul '13

03 Jul '13

I am out of the office until July 9 and will not have access to email until then. For any urgent matter, please contact Aaron Metler, Director Client Services, at aaron(a)palominosys.com or 416 964 7333, ext 133. Alternatively, contact Mandi Kendell at sales(a)palominosys.com or 416 964 7333, option 2. Thank you, Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] AWAY: Re: [security-announce] SUSE-SU-2013:0835-3: important: Security update for IBM Java
by markus＠palominosys.com 02 Jul '13

02 Jul '13

I am out of the office until July 9 and will not have access to email until then. For any urgent matter, please contact Aaron Metler, Director Client Services, at aaron(a)palominosys.com or 416 964 7333, ext 133. Alternatively, contact Mandi Kendell at sales(a)palominosys.com or 416 964 7333, option 2. Thank you, Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] AWAY: Re: [security-announce] SUSE-SU-2013:1039-2: important: Security update for flash-player
by markus＠palominosys.com 01 Jul '13

01 Jul '13

I am out of the office until July 9 and will not have access to email until then. For any urgent matter, please contact Aaron Metler, Director Client Services, at aaron(a)palominosys.com or 416 964 7333, ext 133. Alternatively, contact Mandi Kendell at sales(a)palominosys.com or 416 964 7333, option 2. Thank you, Markus Latzel -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0