July 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2010:0437-1 (low): release-notes-openSUSE: Various additions and translations
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: release-notes-openSUSE: Various additions and translations ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0437-1 Rating: low References: #617092 #619193 #621469 #621890 #623179 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. It includes one version update. Description: Enhancements to the openSUSE release notes. It adds and updates some translations. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch release-notes-openSUSE-2793 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src) [New Version: 11.3.6]: release-notes-openSUSE-11.3.6-0.1.1 References: https://bugzilla.novell.com/617092 https://bugzilla.novell.com/619193 https://bugzilla.novell.com/621469 https://bugzilla.novell.com/621890 https://bugzilla.novell.com/623179

1 0

openSUSE-RU-2010:0436-1 (low): gnome-panel: Fix newly created panels to be visible
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: gnome-panel: Fix newly created panels to be visible ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0436-1 Rating: low References: #620418 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes an issue in Gnome Panel: - bnc#620418: New Panel failed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-panel-2743 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): gnome-panel-2.30.0-5.1.1 - openSUSE 11.3 (i586 x86_64): gnome-panel-devel-2.30.0-5.1.1 gnome-panel-doc-2.30.0-5.1.1 gnome-panel-extras-2.30.0-5.1.1 libpanel-applet-2-0-2.30.0-5.1.1 - openSUSE 11.3 (x86_64): libpanel-applet-2-0-32bit-2.30.0-5.1.1 - openSUSE 11.3 (noarch): gnome-panel-lang-2.30.0-5.1.1 References: https://bugzilla.novell.com/620418

1 0

openSUSE-RU-2010:0435-1 (low): lvm2: Fixed lvcreate --snapshot .. results in scary messages to console and /var/log/messages
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: lvm2: Fixed lvcreate --snapshot .. results in scary messages to console and /var/log/messages ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0435-1 Rating: low References: #556177 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes an issue in lvm2: - bnc#556177: lvcreate --snapshot .. results in scary messages to console and /var/log/messages Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch device-mapper-2746 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): device-mapper-1.02.31-11.3.1 lvm2-2.02.45-11.3.1 lvm2-clvm-2.02.45-11.3.1 - openSUSE 11.2 (i586 x86_64): device-mapper-devel-1.02.31-11.3.1 - openSUSE 11.2 (x86_64): device-mapper-32bit-1.02.31-11.3.1 References: https://bugzilla.novell.com/556177

1 0

openSUSE-RU-2010:0434-1 (low): postfix: Chrooted mysql.sock lost on mysql restart. Fixed by this update.
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: postfix: Chrooted mysql.sock lost on mysql restart. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0434-1 Rating: low References: #606251 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This updates fixes several problems with postfix: - using my_print_defaults command for parsing of /etc/my.cnf - using quotation marks: "$PF_CHROOT" - adding sysconfig option POSTFIX_MYSQL_CONN=(socket,tcp) - MYSQL_SOCK_DIR is mounted with '-o bind' to postfix CHROOT now Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch postfix-2737 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): postfix-2.7.1-2.1.1 - openSUSE 11.3 (i586 x86_64): postfix-devel-2.7.1-2.1.1 postfix-mysql-2.7.1-2.1.1 postfix-postgresql-2.7.1-2.1.1 - openSUSE 11.3 (noarch): postfix-doc-2.7.1-2.1.1 References: https://bugzilla.novell.com/606251

1 0

openSUSE-RU-2010:0433-1 (low): udisks: Fixed ejecting usb-drives or disks as normal user
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: udisks: Fixed ejecting usb-drives or disks as normal user ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0433-1 Rating: low References: #618955 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: A problem in udisks was fixed: - bnc#618955: Cannot eject usb-drives or disks as normal user Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch udisks-2741 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): udisks-1.0.1-2.1.1 - openSUSE 11.3 (i586 x86_64): udisks-devel-1.0.1-2.1.1 References: https://bugzilla.novell.com/618955

1 0

openSUSE-RU-2010:0432-1 (moderate): yast2-gtk: updated to version 2.21.68 fixing bnc#609778 and bnc#620513
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: yast2-gtk: updated to version 2.21.68 fixing bnc#609778 and bnc#620513 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0432-1 Rating: moderate References: #609778 #620513 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes one version update. Description: yast2-gtk was updated to fix the following bugs bnc#609778 - yast software management (qt,gtk,ncurses): configuration > online from menubar does not work as expected. Partly fixed by this update for the gtk interface by omitting online-update configuration menu item when not running online-update. bnc#620513 - sw_single (gtk): freeze when opening the Dependencies box. Fixes were also made to make the Versions box for a selected package more prominent. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch yast2-gtk-2745 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 2.21.68]: yast2-gtk-2.21.68-0.1.1 References: https://bugzilla.novell.com/609778 https://bugzilla.novell.com/620513

1 0

openSUSE-RU-2010:0431-1 (low): NetworkManager-NovellVPN: Fix for NovellVPN Connection Requires to Accept Advanced Options to Work
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: NetworkManager-NovellVPN: Fix for NovellVPN Connection Requires to Accept Advanced Options to Work ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0431-1 Rating: low References: #622854 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes: - bnc#622854: NovellVPN Connection Requires to Accept Advanced Options to Work Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch NetworkManager-novellvpn-2775 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): NetworkManager-novellvpn-0.7.2.r1138-7.1.1 - openSUSE 11.3 (i586 x86_64): NetworkManager-novellvpn-gnome-0.7.2.r1138-7.1.1 References: https://bugzilla.novell.com/622854

1 0

openSUSE-SU-2010:0430-1 (important): seamonkey: Update to 2.0.6 security release
by opensuse-security＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Security Update: seamonkey: Update to 2.0.6 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0430-1 Rating: important References: #622506 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update brings Mozilla Seamonkey to the 2.0.6 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesse Ruderman, Ehsan Akhgari, Mats Palmgren, Igor Bukanov, Gary Kwong, Tobias Markus and Daniel Holbert reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. MFSA 2010-35 / CVE-2010-1208: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in the DOM attribute cloning routine where under certain circumstances an event attribute node can be deleted while another object still contains a reference to it. This reference could subsequently be accessed, potentially causing the execution of attacker controlled memory. MFSA 2010-36 / CVE-2010-1209: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in Mozilla's implementation of NodeIterator in which a malicious NodeFilter could be created which would detach nodes from the DOM tree while it was being traversed. The use of a detached and subsequently deleted node could result in the execution of attacker-controlled memory. MFSA 2010-37 / CVE-2010-1214: Security researcher J23 reported via TippingPoint's Zero Day Initiative an error in the code used to store the names and values of plugin parameter elements. A malicious page could embed plugin content containing a very large number of parameter elements which would cause an overflow in the integer value counting them. This integer is later used in allocating a memory buffer used to store the plugin parameters. Under such conditions, too small a buffer would be created and attacker-controlled data could be written past the end of the buffer, potentially resulting in code execution. MFSA 2010-39 / CVE-2010-2752: Security researcher J23 reported via TippingPoint's Zero Day Initiative that an array class used to store CSS values contained an integer overflow vulnerability. The 16 bit integer value used in allocating the size of the array could overflow, resulting in too small a memory buffer being created. When the array was later populated with CSS values data would be written past the end of the buffer potentially resulting in the execution of attacker-controlled memory. MFSA 2010-40 / CVE-2010-2753: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an integer overflow vulnerability in the implementation of the XUL <tree> element's selection attribute. When the size of a new selection is sufficiently large the integer used in calculating the length of the selection can overflow, resulting in a bogus range being marked selected. When adjustSelection is then called on the bogus range the range is deleted leaving dangling references to the ranges which could be used by an attacker to call into deleted memory and run arbitrary code on a victim's computer. MFSA 2010-41 / CVE-2010-1205: OUSPG researcher Aki Helin reported a buffer overflow in Mozilla graphics code which consumes image data processed by libpng. A malformed PNG file could be created which would cause libpng to incorrectly report the size of the image to downstream consumers. When the dimensions of such images are underreported, the Mozilla code responsible for displaying the graphic will allocate too small a memory buffer to contain the image data and will wind up writing data past the end of the buffer. This could result in the execution of attacker-controlled memory. MFSA 2011-42 / CVE-2010-1213: Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites. MFSA 2010-45 / CVE-2010-1206: Google security researcher Michal Zalewski reported two methods for spoofing the contents of the location bar. The first method works by opening a new window containing a resource that responds with an HTTP 204 (no content) and then using the reference to the new window to insert HTML content into the blank document. The second location bar spoofing method does not require that the resource opened in a new window respond with 204, as long as the opener calls window.stop() before the document is loaded. In either case a user could be mislead as to the correct location of the document they are currently viewing. MFSA 2010-45 / CVE-2010-2751: Security researcher Jordi Chancel reported that the location bar could be spoofed to look like a secure page when the current document was served via plaintext. The vulnerability is triggered by a server by first redirecting a request for a plaintext resource to another resource behind a valid SSL/TLS certificate. A second request made to the original plaintext resource which is responded to not with a redirect but with JavaScript containing history.back() and history.forward() will result in the plaintext resource being displayed with valid SSL/TLS badging in the location bar. References MFSA 2010-46 / CVE-2010-0654: Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target page, then the region between the two injection points becomes readable to JavaScript through, for example, the getComputedStyle() API. MFSA 2010-47 / CVE-2010-2754: Security researcher Soroush Dalili reported that potentially sensitive URL parameters could be leaked across domains upon script errors when the script filename and line number is included in the error message. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch seamonkey-2754 - openSUSE 11.2: zypper in -t patch seamonkey-2754 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 2.0.6]: seamonkey-2.0.6-0.1.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.0.6]: seamonkey-dom-inspector-2.0.6-0.1.1 seamonkey-irc-2.0.6-0.1.1 seamonkey-translations-common-2.0.6-0.1.1 seamonkey-translations-other-2.0.6-0.1.1 seamonkey-venkman-2.0.6-0.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 2.0.6]: seamonkey-2.0.6-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 2.0.6]: seamonkey-dom-inspector-2.0.6-0.1.1 seamonkey-irc-2.0.6-0.1.1 seamonkey-venkman-2.0.6-0.1.1 References: https://bugzilla.novell.com/622506

1 0

openSUSE-RU-2010:0429-1 (low): openSUSE 11.0 security and bugfix support is discontinued
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: openSUSE 11.0 security and bugfix support is discontinued ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0429-1 Rating: low References: #624993 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This patch concludes the openSUSE 11.0 security and bugfix support cycle after 2 years. No more updates will be published after this one. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch openSUSE-release-2805 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): openSUSE-release-11.0-47.3 - openSUSE 11.0 (i586 ppc x86_64): openSUSE-release-dvd-11.0-47.3 openSUSE-release-live-11.0-47.3 References: https://bugzilla.novell.com/624993

1 0

openSUSE-SU-2010:0428-1 (low): rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates.
by opensuse-security＠opensuse.org 24 Jul '10

24 Jul '10

openSUSE Security Update: rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0428-1 Rating: low References: #536256 #610941 Cross-References: CVE-2010-2059 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes the problem where RPM misses to clear the SUID/SGID bit of old files during package updates. (CVE-2010-2059) Also the following bug was fixed: do not use glibc for passwd/group lookups when --root is used [bnc#536256] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch popt-2527 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): rpm-4.4.2-199.3 - openSUSE 11.0 (i586 ppc x86_64): popt-1.7-427.3 popt-devel-1.7-427.3 rpm-devel-4.4.2-199.3 - openSUSE 11.0 (x86_64): popt-32bit-1.7-427.3 - openSUSE 11.0 (ppc): popt-64bit-1.7-427.3 References: http://support.novell.com/security/cve/CVE-2010-2059.html https://bugzilla.novell.com/536256 https://bugzilla.novell.com/610941

1 0