March 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0417-1: moderate: update for MozillaFirefox, MozillaThunderbird
by opensuse-security＠opensuse.org 27 Mar '12

27 Mar '12

openSUSE Security Update: update for MozillaFirefox, MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0417-1 Rating: moderate References: #745303 #746591 #747320 #749440 #750044 #750673 Cross-References: CVE-2011-3658 CVE-2012-0451 CVE-2012-0455 CVE-2012-0456 CVE-2012-0457 CVE-2012-0458 CVE-2012-0459 CVE-2012-0460 CVE-2012-0461 CVE-2012-0462 CVE-2012-0463 CVE-2012-0464 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: Changes in MozillaThunderbird: - update to Thunderbird 11.0 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in mozilla-xulrunner192: - security update to 1.9.2.28 (bnc#750044) * MFSA 2011-55/CVE-2011-3658 (bmo#708186) nsSVGValue out-of-bounds access * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in MozillaFirefox: - update to Firefox 11.0 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in seamonkey: - update to Seamonkey 2.8 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in chmsee: - Update to version 1.99.08 Changes in mozilla-nss: - update to 3.13.3 RTM - distrust Trustwave's MITM certificates (bmo#724929) - fix generic blacklisting mechanism (bmo#727204) Changes in mozilla-nspr: - update to version 4.9 RTM Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-175 - openSUSE 11.4: zypper in -t patch openSUSE-2012-175 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): MozillaFirefox-11.0-2.23.1 MozillaFirefox-branding-upstream-11.0-2.23.1 MozillaFirefox-buildsymbols-11.0-2.23.1 MozillaFirefox-debuginfo-11.0-2.23.1 MozillaFirefox-debugsource-11.0-2.23.1 MozillaFirefox-devel-11.0-2.23.1 MozillaFirefox-translations-common-11.0-2.23.1 MozillaFirefox-translations-other-11.0-2.23.1 MozillaThunderbird-11.0-33.14.1 MozillaThunderbird-buildsymbols-11.0-33.14.1 MozillaThunderbird-debuginfo-11.0-33.14.1 MozillaThunderbird-debugsource-11.0-33.14.1 MozillaThunderbird-devel-11.0-33.14.1 MozillaThunderbird-translations-common-11.0-33.14.1 MozillaThunderbird-translations-other-11.0-33.14.1 chmsee-1.99.08-2.15.2 chmsee-debuginfo-1.99.08-2.15.2 chmsee-debugsource-1.99.08-2.15.2 enigmail-1.4.0+11.0-33.14.1 enigmail-debuginfo-1.4.0+11.0-33.14.1 libfreebl3-3.13.3-9.13.1 libfreebl3-debuginfo-3.13.3-9.13.1 libsoftokn3-3.13.3-9.13.1 libsoftokn3-debuginfo-3.13.3-9.13.1 mozilla-js-11.0-2.23.1 mozilla-js-debuginfo-11.0-2.23.1 mozilla-js192-1.9.2.28-2.12.2 mozilla-js192-debuginfo-1.9.2.28-2.12.2 mozilla-nspr-4.9.0-3.3.1 mozilla-nspr-debuginfo-4.9.0-3.3.1 mozilla-nspr-debugsource-4.9.0-3.3.1 mozilla-nspr-devel-4.9.0-3.3.1 mozilla-nss-3.13.3-9.13.1 mozilla-nss-certs-3.13.3-9.13.1 mozilla-nss-certs-debuginfo-3.13.3-9.13.1 mozilla-nss-debuginfo-3.13.3-9.13.1 mozilla-nss-debugsource-3.13.3-9.13.1 mozilla-nss-devel-3.13.3-9.13.1 mozilla-nss-sysinit-3.13.3-9.13.1 mozilla-nss-sysinit-debuginfo-3.13.3-9.13.1 mozilla-nss-tools-3.13.3-9.13.1 mozilla-nss-tools-debuginfo-3.13.3-9.13.1 mozilla-xulrunner192-1.9.2.28-2.12.2 mozilla-xulrunner192-buildsymbols-1.9.2.28-2.12.2 mozilla-xulrunner192-debuginfo-1.9.2.28-2.12.2 mozilla-xulrunner192-debugsource-1.9.2.28-2.12.2 mozilla-xulrunner192-devel-1.9.2.28-2.12.2 mozilla-xulrunner192-devel-debuginfo-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-debuginfo-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-common-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-other-1.9.2.28-2.12.2 seamonkey-2.8-2.15.1 seamonkey-debuginfo-2.8-2.15.1 seamonkey-debugsource-2.8-2.15.1 seamonkey-dom-inspector-2.8-2.15.1 seamonkey-irc-2.8-2.15.1 seamonkey-translations-common-2.8-2.15.1 seamonkey-translations-other-2.8-2.15.1 seamonkey-venkman-2.8-2.15.1 xulrunner-11.0-2.23.1 xulrunner-buildsymbols-11.0-2.23.1 xulrunner-debuginfo-11.0-2.23.1 xulrunner-debugsource-11.0-2.23.1 xulrunner-devel-11.0-2.23.1 xulrunner-devel-debuginfo-11.0-2.23.1 - openSUSE 12.1 (x86_64): libfreebl3-32bit-3.13.3-9.13.1 libfreebl3-debuginfo-32bit-3.13.3-9.13.1 libsoftokn3-32bit-3.13.3-9.13.1 libsoftokn3-debuginfo-32bit-3.13.3-9.13.1 mozilla-js-32bit-11.0-2.23.1 mozilla-js-debuginfo-32bit-11.0-2.23.1 mozilla-js192-32bit-1.9.2.28-2.12.2 mozilla-js192-debuginfo-32bit-1.9.2.28-2.12.2 mozilla-nspr-32bit-4.9.0-3.3.1 mozilla-nspr-debuginfo-32bit-4.9.0-3.3.1 mozilla-nss-32bit-3.13.3-9.13.1 mozilla-nss-certs-32bit-3.13.3-9.13.1 mozilla-nss-certs-debuginfo-32bit-3.13.3-9.13.1 mozilla-nss-debuginfo-32bit-3.13.3-9.13.1 mozilla-nss-sysinit-32bit-3.13.3-9.13.1 mozilla-nss-sysinit-debuginfo-32bit-3.13.3-9.13.1 mozilla-xulrunner192-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-debuginfo-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-debuginfo-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-common-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-other-32bit-1.9.2.28-2.12.2 xulrunner-32bit-11.0-2.23.1 xulrunner-debuginfo-32bit-11.0-2.23.1 - openSUSE 11.4 (i586 x86_64): MozillaFirefox-11.0-0.15.2 MozillaFirefox-branding-upstream-11.0-0.15.2 MozillaFirefox-buildsymbols-11.0-0.15.2 MozillaFirefox-debuginfo-11.0-0.15.2 MozillaFirefox-debugsource-11.0-0.15.2 MozillaFirefox-devel-11.0-0.15.2 MozillaFirefox-translations-common-11.0-0.15.2 MozillaFirefox-translations-other-11.0-0.15.2 MozillaThunderbird-3.1.20-0.15.4 MozillaThunderbird-buildsymbols-3.1.20-0.15.4 MozillaThunderbird-debuginfo-3.1.20-0.15.4 MozillaThunderbird-debugsource-3.1.20-0.15.4 MozillaThunderbird-devel-3.1.20-0.15.4 MozillaThunderbird-devel-debuginfo-3.1.20-0.15.4 MozillaThunderbird-translations-common-3.1.20-0.15.4 MozillaThunderbird-translations-other-3.1.20-0.15.4 enigmail-1.1.2+3.1.20-0.15.4 enigmail-debuginfo-1.1.2+3.1.20-0.15.4 libfreebl3-3.13.3-0.41.2 libfreebl3-debuginfo-3.13.3-0.41.2 libsoftokn3-3.13.3-0.41.2 libsoftokn3-debuginfo-3.13.3-0.41.2 mozilla-js192-1.9.2.28-0.22.2 mozilla-js192-debuginfo-1.9.2.28-0.22.2 mozilla-nspr-4.9.0-0.13.1 mozilla-nspr-debuginfo-4.9.0-0.13.1 mozilla-nspr-debugsource-4.9.0-0.13.1 mozilla-nspr-devel-4.9.0-0.13.1 mozilla-nss-3.13.3-0.41.2 mozilla-nss-certs-3.13.3-0.41.2 mozilla-nss-certs-debuginfo-3.13.3-0.41.2 mozilla-nss-debuginfo-3.13.3-0.41.2 mozilla-nss-debugsource-3.13.3-0.41.2 mozilla-nss-devel-3.13.3-0.41.2 mozilla-nss-sysinit-3.13.3-0.41.2 mozilla-nss-sysinit-debuginfo-3.13.3-0.41.2 mozilla-nss-tools-3.13.3-0.41.2 mozilla-nss-tools-debuginfo-3.13.3-0.41.2 mozilla-xulrunner192-1.9.2.28-0.22.2 mozilla-xulrunner192-buildsymbols-1.9.2.28-0.22.2 mozilla-xulrunner192-debuginfo-1.9.2.28-0.22.2 mozilla-xulrunner192-debugsource-1.9.2.28-0.22.2 mozilla-xulrunner192-devel-1.9.2.28-0.22.2 mozilla-xulrunner192-devel-debuginfo-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-debuginfo-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-common-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-other-1.9.2.28-0.22.2 seamonkey-2.8-0.15.1 seamonkey-debuginfo-2.8-0.15.1 seamonkey-debugsource-2.8-0.15.1 seamonkey-dom-inspector-2.8-0.15.1 seamonkey-irc-2.8-0.15.1 seamonkey-translations-common-2.8-0.15.1 seamonkey-translations-other-2.8-0.15.1 seamonkey-venkman-2.8-0.15.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.13.3-0.41.2 libfreebl3-debuginfo-32bit-3.13.3-0.41.2 libsoftokn3-32bit-3.13.3-0.41.2 libsoftokn3-debuginfo-32bit-3.13.3-0.41.2 mozilla-js192-32bit-1.9.2.28-0.22.2 mozilla-js192-debuginfo-32bit-1.9.2.28-0.22.2 mozilla-nspr-32bit-4.9.0-0.13.1 mozilla-nspr-debuginfo-32bit-4.9.0-0.13.1 mozilla-nss-32bit-3.13.3-0.41.2 mozilla-nss-certs-32bit-3.13.3-0.41.2 mozilla-nss-certs-debuginfo-32bit-3.13.3-0.41.2 mozilla-nss-debuginfo-32bit-3.13.3-0.41.2 mozilla-nss-sysinit-32bit-3.13.3-0.41.2 mozilla-nss-sysinit-debuginfo-32bit-3.13.3-0.41.2 mozilla-xulrunner192-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-debuginfo-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-debuginfo-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-common-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-other-32bit-1.9.2.28-0.22.2 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2012-0451.html http://support.novell.com/security/cve/CVE-2012-0455.html http://support.novell.com/security/cve/CVE-2012-0456.html http://support.novell.com/security/cve/CVE-2012-0457.html http://support.novell.com/security/cve/CVE-2012-0458.html http://support.novell.com/security/cve/CVE-2012-0459.html http://support.novell.com/security/cve/CVE-2012-0460.html http://support.novell.com/security/cve/CVE-2012-0461.html http://support.novell.com/security/cve/CVE-2012-0462.html http://support.novell.com/security/cve/CVE-2012-0463.html http://support.novell.com/security/cve/CVE-2012-0464.html https://bugzilla.novell.com/745303 https://bugzilla.novell.com/746591 https://bugzilla.novell.com/747320 https://bugzilla.novell.com/749440 https://bugzilla.novell.com/750044 https://bugzilla.novell.com/750673

1 0

openSUSE-SU-2012:0416-1: moderate: update for libzip
by opensuse-security＠opensuse.org 27 Mar '12

27 Mar '12

openSUSE Security Update: update for libzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0416-1 Rating: moderate References: #751829 #751830 Cross-References: CVE-2012-1162 CVE-2012-1163 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: No description available. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-176 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libzip-0.10-28.3.1 libzip-debuginfo-0.10-28.3.1 libzip-debugsource-0.10-28.3.1 libzip-devel-0.10-28.3.1 libzip2-0.10-28.3.1 libzip2-debuginfo-0.10-28.3.1 References: http://support.novell.com/security/cve/CVE-2012-1162.html http://support.novell.com/security/cve/CVE-2012-1163.html https://bugzilla.novell.com/751829 https://bugzilla.novell.com/751830

1 0

openSUSE-SU-2012:0415-1: moderate: update for gnash
by opensuse-security＠opensuse.org 27 Mar '12

27 Mar '12

openSUSE Security Update: update for gnash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0415-1 Rating: moderate References: #752373 Cross-References: CVE-2012-1175 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted swf files could cause an integer overflow in gnash Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-177 - openSUSE 11.4: zypper in -t patch openSUSE-2012-177 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): gnash-0.8.8-9.6.1 gnash-debuginfo-0.8.8-9.6.1 gnash-debugsource-0.8.8-9.6.1 gnash-devel-0.8.8-9.6.1 - openSUSE 11.4 (i586 x86_64): gnash-0.8.8-6.13.1 gnash-debuginfo-0.8.8-6.13.1 gnash-debugsource-0.8.8-6.13.1 gnash-devel-0.8.8-6.13.1 References: http://support.novell.com/security/cve/CVE-2012-1175.html https://bugzilla.novell.com/752373

1 0

openSUSE-SU-2012:0414-1: moderate: update for openssl
by opensuse-security＠opensuse.org 26 Mar '12

26 Mar '12

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0414-1 Rating: moderate References: #748738 Cross-References: CVE-2006-7250 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted MIME headers could crash openssl's ASN.1 parser Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-174 - openSUSE 11.4: zypper in -t patch openSUSE-2012-174 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libopenssl-devel-1.0.0e-34.7.1 libopenssl1_0_0-1.0.0e-34.7.1 libopenssl1_0_0-debuginfo-1.0.0e-34.7.1 openssl-1.0.0e-34.7.1 openssl-debuginfo-1.0.0e-34.7.1 openssl-debugsource-1.0.0e-34.7.1 - openSUSE 12.1 (x86_64): libopenssl-devel-32bit-1.0.0e-34.7.1 libopenssl1_0_0-32bit-1.0.0e-34.7.1 libopenssl1_0_0-debuginfo-32bit-1.0.0e-34.7.1 - openSUSE 12.1 (noarch): openssl-doc-1.0.0e-34.7.1 - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0c-18.34.1 libopenssl1_0_0-1.0.0c-18.34.1 libopenssl1_0_0-debuginfo-1.0.0c-18.34.1 openssl-1.0.0c-18.34.1 openssl-debuginfo-1.0.0c-18.34.1 openssl-debugsource-1.0.0c-18.34.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0c-18.34.1 libopenssl1_0_0-debuginfo-32bit-1.0.0c-18.34.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0c-18.34.1 References: http://support.novell.com/security/cve/CVE-2006-7250.html https://bugzilla.novell.com/748738

1 0

openSUSE-RU-2012:0403-1: moderate: python: fix regression in acceptance of unicode strings in add_option calls
by maintenance＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Recommended Update: python: fix regression in acceptance of unicode strings in add_option calls ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0403-1 Rating: moderate References: Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue for python: - Fix regression in acceptance of unicode strings in add_option calls (http://bugs.python.org/issue9161) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-173 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): python-2.7-9.40.1 python-curses-2.7-9.40.1 python-curses-debuginfo-2.7-9.40.1 python-debuginfo-2.7-9.40.1 python-debugsource-2.7-9.40.1 python-demo-2.7-9.40.1 python-gdbm-2.7-9.40.1 python-gdbm-debuginfo-2.7-9.40.1 python-idle-2.7-9.40.1 python-tk-2.7-9.40.1 python-tk-debuginfo-2.7-9.40.1 - openSUSE 11.4 (x86_64): python-32bit-2.7-9.40.1 python-debuginfo-32bit-2.7-9.40.1 References:

1 0

openSUSE-RU-2012:0402-1: moderate: update for logrotate
by maintenance＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Recommended Update: update for logrotate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0402-1 Rating: moderate References: #751358 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: the previous logrotate introduced a regression that made logrotate fail in some cases Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-172 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): logrotate-3.7.9-6.12.1 logrotate-debuginfo-3.7.9-6.12.1 logrotate-debugsource-3.7.9-6.12.1 References: https://bugzilla.novell.com/751358

1 0

openSUSE-RU-2012:0401-1: moderate: update for postfix
by maintenance＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Recommended Update: update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0401-1 Rating: moderate References: #743369 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: - rcpostfix now updates the aliases too - update to 2.8.8 Bugfixes: tlsproxy(8) stored TLS sessions with a serverID of "tlsproxy" instead of "smtpd", wasting an opportunity for session reuse. File: tlsproxy/tlsproxy.c. missing lookup table entry and terminator, causing proxymap server segfault when postscreen(8) or verify(8) attempted to access their cache via the proxymap server. This could never have worked anyway, because the Postfix 2.8 proxymap protocol does not support cache cleanup. File util/dict.c. the Postfix client sqlite quoting routine returned the unquoted result instead of the quoted text. The opportunities for misuse are limited, because Postfix sqlite files are usually owned by root, and Postfix daemons usually run with non-root privileges so they can't corrupt the database. Problem reported by Rob McGee (rob0). File: global/dict_sqlite.c. the trace service did not distinguish between notifications for a non-bounce or a bounce message. This code pre-dates DSN support and should have been updated when it was re-purposed to handle DSN SUCCESS notifications. Problem reported by Sabahattin Gucukoglu. File: bounce/bounce_trace_service.c. - use latest VDA patch (2.8.5) - bnc#743369 - yast2 mail module does not open the firewall - Set MD5DIR in SuSEconfig.postfix to avoid warnings - bnc738693 - upgrade from 11.4 enables mysql service for systemd Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-171 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): postfix-2.8.8-3.10.1 postfix-debuginfo-2.8.8-3.10.1 postfix-debugsource-2.8.8-3.10.1 postfix-devel-2.8.8-3.10.1 postfix-mysql-2.8.8-3.10.1 postfix-mysql-debuginfo-2.8.8-3.10.1 postfix-postgresql-2.8.8-3.10.1 postfix-postgresql-debuginfo-2.8.8-3.10.1 - openSUSE 12.1 (noarch): postfix-doc-2.8.8-3.10.1 References: https://bugzilla.novell.com/743369

1 0

openSUSE-SU-2012:0400-1: osc: Update to 0.134.1
by opensuse-security＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Security Update: osc: Update to 0.134.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0400-1 Rating: low References: #624980 #679980 #711770 #749335 Cross-References: CVE-2012-1095 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update of osc to 0.134.1 provides the following changes: * adding unlock command * maintenance_incident requests get created with source revision of package * Enables new maintenance submissions for new OBS 2.3 maintenance model * Fixes srcmd5 revisions in submit request, when link target != submission target * patchinfo call can work without checked out copy now * use qemu as fallback for building not directly supported architectures * "results --watch" option to watch build results until they finished building * fixes injection of terminal control chars (bnc#749335)(CVE-2012-1095) * support dryrun of branching to preview the expected result. "osc sm" is doing this now by default. * maintenance requests accept package lists as source and target incidents to be merged in * add "setincident" command to "request" to re-direct a maintenance request * ask user to create "maintenance incident" request when submit request is failing at release project * "osc my patchinfos" is showing patchinfos where any open bug is assigned to user * "osc my" or "osc my work" is including assigned patchinfos * "osc branch --maintenance" is creating setups for maintenance * removed debug code lead to warning message (fix by Marcus_H) * add --meta option also to "list", "cat" and "less" commands * project checkout is skipping packages linking to project local packages by default * add --keep-link option to copypac command * source validators are not called by default anymore: * support source services using OBS project or package name * support updateing _patchinfo file with new issues just by calling "osc patchinfo" again * branch --add-repositories can be used to add repos from source project to target project * branch --extend-package-names can be used to do mbranch like branch of a single package * branch --new-package can be used to do branch from a not yet existing package (to define later submit target) * show declined requests which created by user Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-170 - openSUSE 11.4: zypper in -t patch openSUSE-2012-170 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): build-initvm-2012.03.06-2.4.1 build-initvm-debuginfo-2012.03.06-2.4.1 - openSUSE 12.1 (x86_64): build-initvm-debuginfo-32bit-2012.03.06-2.4.1 build-initvm-debuginfo-i586-2012.03.06-2.4.1 build-initvm-i586-2012.03.06-2.4.1 - openSUSE 12.1 (noarch): build-2012.03.06-2.4.1 build-mkbaselibs-2012.03.06-2.4.1 build-mkbaselibs-sle-2012.03.06-2.4.1 build-mkdrpms-2012.03.06-2.4.1 obs-service-download_files-0.3-5.4.1 obs-service-format_spec_file-0.4.1-13.4.1 obs-service-source_validator-0.2-3.5.1 osc-0.134.1-2.4.1 - openSUSE 12.1 (ia64): build-initvm-debuginfo-x86-2012.03.06-2.4.1 - openSUSE 11.4 (i586 x86_64): build-initvm-2012.03.06-10.1 build-initvm-debuginfo-2012.03.06-10.1 - openSUSE 11.4 (x86_64): build-initvm-debuginfo-32bit-2012.03.06-10.1 build-initvm-debuginfo-i586-2012.03.06-10.1 build-initvm-i586-2012.03.06-10.1 - openSUSE 11.4 (noarch): build-2012.03.06-10.1 build-mkbaselibs-2012.03.06-10.1 build-mkbaselibs-sle-2012.03.06-10.1 build-mkdrpms-2012.03.06-10.1 obs-service-download_files-0.3-6.1 obs-service-format_spec_file-0.4.1-6.1 obs-service-source_validator-0.2-7.1 osc-0.134.1-6.1 - openSUSE 11.4 (ia64): build-initvm-debuginfo-x86-2012.03.06-10.1 References: http://support.novell.com/security/cve/CVE-2012-1095.html https://bugzilla.novell.com/624980 https://bugzilla.novell.com/679980 https://bugzilla.novell.com/711770 https://bugzilla.novell.com/749335

1 0

openSUSE-RU-2012:0397-1: moderate: ddclient: fix issue with updating ip on renewal
by maintenance＠opensuse.org 21 Mar '12

21 Mar '12

openSUSE Recommended Update: ddclient: fix issue with updating ip on renewal ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0397-1 Rating: moderate References: #730519 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for ddclient: - 730519: fix issue with updating ip on renewal Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-169 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): ddclient-3.8.0-19.17.1 References: https://bugzilla.novell.com/730519

1 0

openSUSE-RU-2012:0396-1: moderate: ddclient: fix issue with updating ip on renewal
by maintenance＠opensuse.org 21 Mar '12

21 Mar '12

openSUSE Recommended Update: ddclient: fix issue with updating ip on renewal ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0396-1 Rating: moderate References: #730519 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for ddclient: - 730519: fix issue with updating ip on renewal Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-169 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): ddclient-3.8.0-19.17.1 References: https://bugzilla.novell.com/730519

1 0