March 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2012:0346-1: dhcp: fixed dhcp-client lease parsing problems
by maintenance＠opensuse.org 09 Mar '12

09 Mar '12

openSUSE Recommended Update: dhcp: fixed dhcp-client lease parsing problems ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0346-1 Rating: low References: #739696 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes the following issue for dhcp: - 739696: dhcp-client lease parsing problems Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dhcp-5685 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 4.2.1]: dhcp-4.2.1-0.13.1 dhcp-client-4.2.1-0.13.1 dhcp-devel-4.2.1-0.13.1 dhcp-doc-4.2.1-0.13.1 dhcp-relay-4.2.1-0.13.1 dhcp-server-4.2.1-0.13.1 References: https://bugzilla.novell.com/739696

1 0

openSUSE-SU-2012:0345-1: moderate: usbmuxd: fixed a heap based buffer overflow
by opensuse-security＠opensuse.org 09 Mar '12

09 Mar '12

openSUSE Security Update: usbmuxd: fixed a heap based buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0345-1 Rating: moderate References: #742546 Cross-References: CVE-2012-0065 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of usbmuxd fixes a heap-based buffer overflow which could be triggered via an overly long "SerialNumber" field (CVE-2012-0065). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch iproxy-5868 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.0.7]: iproxy-1.0.7-3.5.1 libusbmuxd-devel-1.0.7-3.5.1 libusbmuxd1-1.0.7-3.5.1 usbmuxd-1.0.7-3.5.1 References: http://support.novell.com/security/cve/CVE-2012-0065.html https://bugzilla.novell.com/742546

1 0

openSUSE-SU-2012:0344-1: gnutls: Fixed potential information leak in DTLS implementation
by opensuse-security＠opensuse.org 09 Mar '12

09 Mar '12

openSUSE Security Update: gnutls: Fixed potential information leak in DTLS implementation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0344-1 Rating: low References: #739898 Cross-References: CVE-2012-0390 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of GnuTLS fixes a vulnerability in the DTLS implementation which could allow remote attackers to recover partial plaintext via a timing side-channel attack. (CVE-2012-0390). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch gnutls-5827 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gnutls-2.8.6-5.8.1 libgnutls-devel-2.8.6-5.8.1 libgnutls-extra-devel-2.8.6-5.8.1 libgnutls-extra26-2.8.6-5.8.1 libgnutls26-2.8.6-5.8.1 - openSUSE 11.4 (x86_64): libgnutls26-32bit-2.8.6-5.8.1 References: http://support.novell.com/security/cve/CVE-2012-0390.html https://bugzilla.novell.com/739898

1 0

openSUSE-SU-2012:0343-1: libxslt: fixed Out-of-bounds read when parsing certain patterns
by opensuse-security＠opensuse.org 09 Mar '12

09 Mar '12

openSUSE Security Update: libxslt: fixed Out-of-bounds read when parsing certain patterns ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0343-1 Rating: low References: #746039 Cross-References: CVE-2011-3970 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libxslt was prone to an out-of-bounds read flaw when parsing certain patterns (CVE-2011-3970). This could lead to a Denial of Service. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libxslt-5811 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxslt-1.1.26-3.4.1 libxslt-devel-1.1.26-3.4.1 - openSUSE 11.4 (x86_64): libxslt-32bit-1.1.26-3.4.1 libxslt-devel-32bit-1.1.26-3.4.1 References: http://support.novell.com/security/cve/CVE-2011-3970.html https://bugzilla.novell.com/746039

1 0

openSUSE-SU-2012:0342-1: moderate: libxml2: fixed hash table collisions CPU usage DoS
by opensuse-security＠opensuse.org 09 Mar '12

09 Mar '12

openSUSE Security Update: libxml2: fixed hash table collisions CPU usage DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0342-1 Rating: moderate References: #748561 Cross-References: CVE-2012-0841 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libxml2 fixes the hash table collision flaw which could be exploited by attackers to cause a Denial of Service (CVE-2012-0841). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libxml2-5873 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-16.23.1 libxml2-devel-2.7.8-16.23.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-16.23.1 libxml2-devel-32bit-2.7.8-16.23.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-16.23.1 References: http://support.novell.com/security/cve/CVE-2012-0841.html https://bugzilla.novell.com/748561

1 0

openSUSE-RU-2012:0339-1: important: timezone: update to 2012b
by maintenance＠opensuse.org 09 Mar '12

09 Mar '12

openSUSE Recommended Update: timezone: update to 2012b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0339-1 Rating: important References: #748550 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update provides 2012b which provides the following important changes: * Cuba has delayed start of DST by 3 weeks (now starts April 1 rather than March 11 * Chile 2011/2012 and 2012/2013 summer time date adjustments. * Falkland Islands onto permanent summer time (we're assuming for the foreseeable future, though 2012 is all we're fairly certain of.) * Armenia has abolished Summer Time. * Tokelau jumped the International Date Line back last December (just the same as their near neighbour, Samoa). * America/Creston is a new zone for a small area of British Columbia * There will be a leapsecod 2012-06-30 23:59:60 UTC. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch timezone-2012b-5920 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2012b]: timezone-2012b-0.2.1 - openSUSE 11.4 (noarch) [New Version: 2012b]: timezone-java-2012b-0.2.1 References: https://bugzilla.novell.com/748550

1 0

openSUSE-RU-2012:0336-1: pm-utils: fix script 50rcnetwork error and update savestate/restorestate functions
by maintenance＠opensuse.org 08 Mar '12

08 Mar '12

openSUSE Recommended Update: pm-utils: fix script 50rcnetwork error and update savestate/restorestate functions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0336-1 Rating: low References: #670074 #749031 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue for pm-utils: - 749031: fix script 50rcnetwork error and update savestate/restorestate functions - 670074: add pm-utils-1.4.1-vtXX-upower-battery-AC-adapter.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pm-utils-5908 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pm-utils-1.4.1-5.13.1 pm-utils-ndiswrapper-1.4.1-5.13.1 References: https://bugzilla.novell.com/670074 https://bugzilla.novell.com/749031

1 0

openSUSE-SU-2012:0333-1: icecast
by opensuse-security＠opensuse.org 08 Mar '12

08 Mar '12

openSUSE Security Update: icecast ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0333-1 Rating: low References: #737255 Cross-References: CVE-2011-4612 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Icecast didn't strip newlines from log entries, therefore allowing uses to forge log entries (CVE-2011-4612). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch icecast-5932 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): icecast-2.3.2-60.61.1 References: http://support.novell.com/security/cve/CVE-2011-4612.html https://bugzilla.novell.com/737255

1 0

openSUSE-SU-2012:0331-1: important: flash-player
by opensuse-security＠opensuse.org 07 Mar '12

07 Mar '12

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0331-1 Rating: important References: #750614 Cross-References: CVE-2012-0768 CVE-2012-0769 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: flash-player 11.1.102.63 fixes two security issues: - memory corruption vulnerability in Matrix3D could lead to code executionn (CVE-2012-0768) - integer errors that could lead to information disclosure (CVE-2012-0769) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-5927 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.1.102.63]: flash-player-11.1.102.63-0.2.1 References: http://support.novell.com/security/cve/CVE-2012-0768.html http://support.novell.com/security/cve/CVE-2012-0769.html https://bugzilla.novell.com/750614

1 0

openSUSE-SU-2012:0330-1: moderate: gnash
by opensuse-security＠opensuse.org 07 Mar '12

07 Mar '12

openSUSE Security Update: gnash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0330-1 Rating: moderate References: #732324 Cross-References: CVE-2011-4328 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gnash used predictable and world readable temporary file names to store HTTP cookies (CVE-2011-4328). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch gnash-5931 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gnash-0.8.8-6.7.1 gnash-devel-0.8.8-6.7.1 References: http://support.novell.com/security/cve/CVE-2011-4328.html https://bugzilla.novell.com/732324

1 0